You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "Lothnic (via GitHub)" <gi...@apache.org> on 2026/08/18 20:00:10 UTC
[PR] Keep sync-perm going when a Dag has bad access_control [airflow]
Lothnic opened a new pull request, #71798:
URL: https://github.com/apache/airflow/pull/71798
A single Dag whose access_control references a non-existent role (or an invalid resource/action) made airflow sync-perm --include-dags abort partway through, leaving every remaining Dag without its permissions synced. Skip the misconfigured Dag and continue with the rest so one bad Dag can no longer block permission sync for all good ones.
<!-- SPDX-License-Identifier: Apache-2.0
https://www.apache.org/licenses/LICENSE-2.0 -->
<!--
Thank you for contributing!
Please provide above a brief description of the changes made in this pull request.
Write a good git commit message following this guide: https://chris.beams.io/posts/git-commit/
Please make sure that your code changes are covered with tests.
And in case of new features or big changes remember to adjust the documentation.
For user-facing UI changes, please attach before/after screenshots (or a short
screen recording) so reviewers can assess the visual impact.
Feel free to ping (in general) for the review if you do not see reaction for a few days
(72 Hours is the minimum reaction time you can expect from volunteers) - we sometimes miss notifications.
In case of an existing issue, reference it using one of the following:
* closes: #ISSUE
* related: #ISSUE
-->
---
##### Was generative AI tooling used to co-author this PR?
<!--
If generative AI tooling has been used in the process of authoring this PR, please
change below checkbox to `[X]` followed by the name of the tool, uncomment the "Generated-by".
-->
- [x] Yes (please specify the tool below)
<!--
Generated-by: [Tool Name] following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
-->
---
* Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-guidelines)** for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
* For fundamental code changes, an Airflow Improvement Proposal ([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals)) is needed.
* When adding dependency, check compliance with the [ASF 3rd Party License Policy](https://www.apache.org/legal/resolved.html#category-x).
* For significant user-facing changes create newsfragment: `{pr_number}.significant.rst`, in [airflow-core/newsfragments](https://github.com/apache/airflow/tree/main/airflow-core/newsfragments). You can add this file in a follow-up commit after the PR is created so you know the PR number.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Keep sync-perm going when a Dag has bad access_control [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on code in PR #71798:
URL: https://github.com/apache/airflow/pull/71798#discussion_r4057159562
##########
providers/fab/tests/unit/fab/auth_manager/test_security.py:
##########
@@ -1055,7 +1055,28 @@ def test_create_dag_specific_permissions_airflow3(session, security_manager, mon
security_manager.create_dag_specific_permissions()
-def test_get_all_permissions(security_manager):
+def test_create_dag_specific_permissions_skips_dag_with_bad_access_control(security_manager, monkeypatch):
+ """A single DAG with an invalid access_control must not abort syncing the remaining DAGs."""
+ bad_dag = DAG("bad_access_control", schedule=None, access_control={"NonExistentRole": {ACTION_CAN_READ}})
+ good_dag = DAG("good_access_control", schedule=None, access_control={"Public": {ACTION_CAN_READ}})
+
+ import airflow.providers.fab.auth_manager.security_manager
+
+ _iter_dags_mock = mock.Mock(return_value=[bad_dag, good_dag])
Review Comment:
Nit: `mock.Mock(return_value=...)` without `spec`. It mirrors the neighbouring `_iter_dags` test, so no need to change it here; just noting it.
##########
providers/fab/src/airflow/providers/fab/auth_manager/security_manager/override.py:
##########
@@ -1008,7 +1008,14 @@ def create_dag_specific_permissions(self) -> None:
self._merge_perm(action_name, dag_resource_name)
if dag.access_control is not None:
- self.sync_perm_for_dag(dag.dag_id, dag.access_control)
+ try:
+ self.sync_perm_for_dag(dag.dag_id, dag.access_control)
+ except FabException:
+ self.log.exception(
+ "Failed to sync permissions for DAG '%s'; skipping it and continuing with "
Review Comment:
Prose convention in the repo (including log strings) is "Dag", so: `"Failed to sync permissions for Dag '%s'; skipping it and continuing with the remaining Dags. ..."`.
##########
providers/fab/tests/unit/fab/auth_manager/test_security.py:
##########
@@ -1055,7 +1055,28 @@ def test_create_dag_specific_permissions_airflow3(session, security_manager, mon
security_manager.create_dag_specific_permissions()
-def test_get_all_permissions(security_manager):
+def test_create_dag_specific_permissions_skips_dag_with_bad_access_control(security_manager, monkeypatch):
Review Comment:
This hunk replaces the `def test_get_all_permissions(security_manager):` line, so that existing test disappears and its body (the `assert_queries_count(1)` block, the `isinstance(perms, set)` checks and the `("can_read", "Connections")` assertion) now runs as the tail of this new test. Please add the new test as its own function and restore `def test_get_all_permissions(security_manager):` in front of the original body.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Keep sync-perm going when a Dag has bad access_control [airflow]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on PR #71798:
URL: https://github.com/apache/airflow/pull/71798#issuecomment-5785291628
Awesome work, congrats on your first merged pull request! You are invited to check our [Issue Tracker](https://github.com/apache/airflow/issues) for additional contributions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Keep sync-perm going when a Dag has bad access_control [airflow]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on PR #71798:
URL: https://github.com/apache/airflow/pull/71798#issuecomment-5333366589
Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our [Contributors' Guide](https://github.com/apache/airflow/blob/main/contributing-docs/README.rst)
Here are some useful points:
- Pay attention to the quality of your code (ruff, mypy and type annotations). Our [prek-hooks]( https://github.com/apache/airflow/blob/main/contributing-docs/08_static_code_checks.rst#prerequisites-for-prek-hooks) will help you with that.
- In case of a new feature add useful documentation (in docstrings or in `docs/` directory). Adding a new operator? Check this short [guide](https://github.com/apache/airflow/blob/main/airflow-core/docs/howto/custom-operator.rst) Consider adding an example Dag that shows how users should use it.
- Consider using [Breeze environment](https://github.com/apache/airflow/blob/main/dev/breeze/doc/README.rst) for testing locally, it's a heavy docker but it ships with a working Airflow and a lot of integrations.
- Be patient and persistent. It might take some time to get a review or get the final approval from Committers.
- Please follow [ASF Code of Conduct](https://www.apache.org/foundation/policies/conduct) for all communication including (but not limited to) comments on Pull Requests, Mailing list and Slack.
- Be sure to read the [Airflow Coding style]( https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#coding-style-and-best-practices).
- Always keep your Pull Requests rebased, otherwise your build might fail due to changes not related to your commits.
Apache Airflow is a community-driven project and together we are making it better 🚀.
In case of doubts contact the developers at:
Mailing List: dev@airflow.apache.org
Slack: https://s.apache.org/airflow-slack
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Keep sync-perm going when a Dag has bad access_control [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk merged PR #71798:
URL: https://github.com/apache/airflow/pull/71798
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org