feng-tao commented on a change in pull request #4642: [WIP] [AIRFLOW-2694]
Declare permissions in DAG definition
URL: https://github.com/apache/airflow/pull/4642#discussion_r253692717
##########
File path: airflow/models/__init__.py
##########
@@ -4244,6 +4254,63 @@ def _test_cycle_helper(self, visit_map, task_id):
visit_map[task_id] = DagBag.CYCLE_DONE
+ def _set_dag_permissions(self, access_control):
+ """Grant permissions on this DAG's ViewModel to the given role(s).
+
+ :param access_control: a dict where each key is a rolename and
+ each value is a set() of permission names (e.g.,
+ {'can_dag_read'}
+ :type access_control: dict
+
+ """
+ sm = cached_appbuilder().sm
Review comment:
I think extending the `/refresh` endpoint should work. We need to pass the
`access_control` info from scheduler to webserver endpoint during the DAG
`_init_` constructor. I am not so sure how to put the `set_dag_permissions`
function inside `sync_perms` cli though.
I think we couldn't get the dag access_control information until scheduler
parses the dag information. And we need to persist these infomation somewhere
in the db. Then the cli knows how to persist the permission with roles mapping
information, right? In this case, I don't know how the CLI could figure how to
call the ``sync_perm_for_dag``.
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
With regards,
Apache Git Services
