You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "amoghrajesh (via GitHub)" <gi...@apache.org> on 2023/08/02 04:18:37 UTC
[GitHub] [airflow] amoghrajesh opened a new pull request, #33022: Affix webserver access_denied warning to be configurable
amoghrajesh opened a new pull request, #33022:
URL: https://github.com/apache/airflow/pull/33022
<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
-->
<!--
Thank you for contributing! Please make sure that your code changes
are covered with tests. And in case of new features or big changes
remember to adjust the documentation.
Feel free to ping committers for the review!
In case of an existing issue, reference it using one of the following:
closes: #ISSUE
related: #ISSUE
How to write a good git commit message:
http://chris.beams.io/posts/git-commit/
-->
Add a possibility to make the airflow webserver's access denied message - which occurs when an user tries to perform some operation outside their user rights. Allow this to be configurable through config so that every webserver installation can have a custom message without changing the airflow code.
Note: This message is not per call to the `has_access` function, but per webserver installation which is a more realistic case.
Took suggestions from community and approached the problem accordingly.
- Made a function `get_access_denied_message` so that the "unit" is testable.
<!-- Please keep an empty line above the dashes. -->
---
**^ Add meaningful description above**
Read the **[Pull Request Guidelines](https://github.com/apache/airflow/blob/main/CONTRIBUTING.rst#pull-request-guidelines)** for more information.
In case of fundamental code changes, an Airflow Improvement Proposal ([AIP](https://cwiki.apache.org/confluence/display/AIRFLOW/Airflow+Improvement+Proposals)) is needed.
In case of a new dependency, check compliance with the [ASF 3rd Party License Policy](https://www.apache.org/legal/resolved.html#category-x).
In case of backwards incompatible changes please leave a note in a newsfragment file, named `{pr_number}.significant.rst` or `{issue_number}.significant.rst`, in [newsfragments](https://github.com/apache/airflow/tree/main/newsfragments).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] uranusjr commented on a diff in pull request #33022: Affix webserver access_denied warning to be configurable
Posted by "uranusjr (via GitHub)" <gi...@apache.org>.
uranusjr commented on code in PR #33022:
URL: https://github.com/apache/airflow/pull/33022#discussion_r1281429065
##########
airflow/www/auth.py:
##########
@@ -28,6 +28,10 @@
T = TypeVar("T", bound=Callable)
+def get_access_denied_message():
+ return conf.get("webserver", "access_denied_message")
Review Comment:
This should either use `get_mandatory` or provide a fallback.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] potiuk commented on a diff in pull request #33022: Affix webserver access_denied warning to be configurable
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on code in PR #33022:
URL: https://github.com/apache/airflow/pull/33022#discussion_r1281720327
##########
airflow/www/auth.py:
##########
@@ -28,6 +28,10 @@
T = TypeVar("T", bound=Callable)
+def get_access_denied_message():
+ return conf.get("webserver", "access_denied_message")
Review Comment:
Not really. The `get_mandatory` is needed only when we want to have a value but the value has no default (for example when we want to get a URL that has no default but we **really** need it to be configured).
The way it works when it is put in config.yml is that "default" is automatically used as fallback if there is no fallback (It's been working like that already for quite some time via defaul_config.cfg - so my recent change has not changed it - jut made it works without the default_config.cfg
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] hussein-awala commented on pull request #33022: Affix webserver access_denied warning to be configurable
Posted by "hussein-awala (via GitHub)" <gi...@apache.org>.
hussein-awala commented on PR #33022:
URL: https://github.com/apache/airflow/pull/33022#issuecomment-1662870889
Waiting for a second look from @uranusjr before merge
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] amoghrajesh commented on a diff in pull request #33022: Affix webserver access_denied warning to be configurable
Posted by "amoghrajesh (via GitHub)" <gi...@apache.org>.
amoghrajesh commented on code in PR #33022:
URL: https://github.com/apache/airflow/pull/33022#discussion_r1282241143
##########
tests/www/test_security.py:
##########
@@ -969,3 +971,16 @@ def test_users_can_be_found(app, security_manager, session, caplog):
assert len(users) == 1
delete_user(app, "Test")
assert "Error adding new user to database" in caplog.text
+
+
+def test_access_denied_message():
+ with mock.patch.dict(
+ os.environ,
+ {"AIRFLOW__WEBSERVER__ACCESS_DENIED_MESSAGE": "My custom access denied message"},
+ clear=True,
+ ):
+ initialize_config()
+ assert conf.get("webserver", "access_denied_message") == "My custom access denied message"
+
+ initialize_config()
+ assert conf.get("webserver", "access_denied_message") == "Access is Denied"
Review Comment:
Yeah why not. Very valid suggestions. Incorporated them.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] pankajkoti commented on a diff in pull request #33022: Affix webserver access_denied warning to be configurable
Posted by "pankajkoti (via GitHub)" <gi...@apache.org>.
pankajkoti commented on code in PR #33022:
URL: https://github.com/apache/airflow/pull/33022#discussion_r1282156302
##########
airflow/config_templates/config.yml:
##########
@@ -1349,6 +1349,13 @@ operators:
webserver:
description: ~
options:
+ access_denied_message:
+ description: |
+ The message displayed when an user tries to perform operations outside their rights.
Review Comment:
okay so
"The message displayed when a user attempts to execute actions beyond their authorised privileges."
?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [airflow] eladkal merged pull request #33022: Affix webserver access_denied warning to be configurable
Posted by "eladkal (via GitHub)" <gi...@apache.org>.
eladkal merged PR #33022:
URL: https://github.com/apache/airflow/pull/33022
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org