ashb commented on a change in pull request #11158:
URL: https://github.com/apache/airflow/pull/11158#discussion_r499784748
##########
File path: airflow/cli/commands/role_command.py
##########
@@ -41,3 +39,259 @@ def roles_create(args):
appbuilder = cached_app().appbuilder # pylint: disable=no-member
for role_name in args.role:
appbuilder.sm.add_role(role_name)
+
+
+mapping = {
+ # ========================= Airflow Views
+ ("Airflow", "can_blocked"): [("Dag", "can_read"), ("DagRun", "can_read")],
+ ("Airflow", "can_clear"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_delete")],
Review comment:
I wonder if this should be `(TI, can_edit)` -- we don't actually delete
the TI row when clearing, just clear/null out its status.
##########
File path: airflow/cli/commands/role_command.py
##########
@@ -41,3 +39,259 @@ def roles_create(args):
appbuilder = cached_app().appbuilder # pylint: disable=no-member
for role_name in args.role:
appbuilder.sm.add_role(role_name)
+
+
+mapping = {
+ # ========================= Airflow Views
+ ("Airflow", "can_blocked"): [("Dag", "can_read"), ("DagRun", "can_read")],
+ ("Airflow", "can_clear"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_delete")],
+ ("Airflow", "can_code"): [("Dag", "can_read"), ("DagCode", "can_read")],
+ ("Airflow", "can_dag_details"): [("Dag", "can_read"), ("DagRun",
"can_read")],
+ ("Airflow", "can_dag_stats"): [("Dag", "can_read"), ("DagRun",
"can_read")],
+ ("Airflow", "can_dagrun_clear"): [
+ ("Dag", "can_read"),
+ ("Task", "can_read"),
+ ("TaskInstance", "can_delete"),
+ ],
+ ("Airflow", "can_dagrun_failed"): [("Dag", "can_read"), ("DagRun",
"can_edit")],
+ ("Airflow", "can_dagrun_success"): [("Dag", "can_read"), ("DagRun",
"can_edit")],
Review comment:
These two also edit TaskInstances I think - so do we assume that
can_edit on a DagRun implies can_edit on those task instances?
##########
File path: airflow/cli/commands/role_command.py
##########
@@ -41,3 +39,259 @@ def roles_create(args):
appbuilder = cached_app().appbuilder # pylint: disable=no-member
for role_name in args.role:
appbuilder.sm.add_role(role_name)
+
+
+mapping = {
+ # ========================= Airflow Views
+ ("Airflow", "can_blocked"): [("Dag", "can_read"), ("DagRun", "can_read")],
+ ("Airflow", "can_clear"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_delete")],
+ ("Airflow", "can_code"): [("Dag", "can_read"), ("DagCode", "can_read")],
+ ("Airflow", "can_dag_details"): [("Dag", "can_read"), ("DagRun",
"can_read")],
+ ("Airflow", "can_dag_stats"): [("Dag", "can_read"), ("DagRun",
"can_read")],
+ ("Airflow", "can_dagrun_clear"): [
+ ("Dag", "can_read"),
+ ("Task", "can_read"),
+ ("TaskInstance", "can_delete"),
+ ],
Review comment:
I'm not sure if this one needs TI, but maybe it does for consistency.
##########
File path: airflow/cli/commands/role_command.py
##########
@@ -41,3 +39,259 @@ def roles_create(args):
appbuilder = cached_app().appbuilder # pylint: disable=no-member
for role_name in args.role:
appbuilder.sm.add_role(role_name)
+
+
+mapping = {
+ # ========================= Airflow Views
+ ("Airflow", "can_blocked"): [("Dag", "can_read"), ("DagRun", "can_read")],
+ ("Airflow", "can_clear"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_delete")],
+ ("Airflow", "can_code"): [("Dag", "can_read"), ("DagCode", "can_read")],
+ ("Airflow", "can_dag_details"): [("Dag", "can_read"), ("DagRun",
"can_read")],
+ ("Airflow", "can_dag_stats"): [("Dag", "can_read"), ("DagRun",
"can_read")],
+ ("Airflow", "can_dagrun_clear"): [
+ ("Dag", "can_read"),
+ ("Task", "can_read"),
+ ("TaskInstance", "can_delete"),
+ ],
+ ("Airflow", "can_dagrun_failed"): [("Dag", "can_read"), ("DagRun",
"can_edit")],
+ ("Airflow", "can_dagrun_success"): [("Dag", "can_read"), ("DagRun",
"can_edit")],
+ ("Airflow", "can_delete"): [("Dag", "can_delete")],
+ ("Airflow", "can_duration"): [("Dag", "can_read"), ("TaskInstance",
"can_read"), ("Task", "can_read")],
+ ("Airflow", "can_extra_links"): [("Dag", "can_read"), ("Task",
"can_read")],
+ ("Airflow", "can_failed"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_edit")],
+ ("Airflow", "can_gantt"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_read")],
+ ("Airflow", "can_get_logs_with_metadata"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Log", "can_read"),
+ ],
+ ("Airflow", "can_graph"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Task", "can_read"),
+ ("Log", "can_read"),
+ ],
+ ("Airflow", "can_index"): [("Dag", "can_read")],
+ ("Airflow", "can_landing_times"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Task", "can_read"),
+ ],
+ ("Airflow", "can_last_dagruns"): [("Dag", "can_read"), ("DagRun",
"can_read")],
+ ("Airflow", "can_log"): [("Dag", "can_read"), ("TaskInstance",
"can_read"), ("Log", "can_read")],
+ ("Airflow", "can_paused"): [("Dag", "can_paused")],
+ ("Airflow", "can_redirect_to_external_log"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Log", "can_read"),
Review comment:
Same here as "can_get_logs_with_metadata" -- this is not (Audit)Logs,
but task execution logs.
##########
File path: airflow/cli/commands/role_command.py
##########
@@ -41,3 +39,259 @@ def roles_create(args):
appbuilder = cached_app().appbuilder # pylint: disable=no-member
for role_name in args.role:
appbuilder.sm.add_role(role_name)
+
+
+mapping = {
+ # ========================= Airflow Views
+ ("Airflow", "can_blocked"): [("Dag", "can_read"), ("DagRun", "can_read")],
+ ("Airflow", "can_clear"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_delete")],
+ ("Airflow", "can_code"): [("Dag", "can_read"), ("DagCode", "can_read")],
+ ("Airflow", "can_dag_details"): [("Dag", "can_read"), ("DagRun",
"can_read")],
+ ("Airflow", "can_dag_stats"): [("Dag", "can_read"), ("DagRun",
"can_read")],
+ ("Airflow", "can_dagrun_clear"): [
+ ("Dag", "can_read"),
+ ("Task", "can_read"),
+ ("TaskInstance", "can_delete"),
+ ],
+ ("Airflow", "can_dagrun_failed"): [("Dag", "can_read"), ("DagRun",
"can_edit")],
+ ("Airflow", "can_dagrun_success"): [("Dag", "can_read"), ("DagRun",
"can_edit")],
+ ("Airflow", "can_delete"): [("Dag", "can_delete")],
+ ("Airflow", "can_duration"): [("Dag", "can_read"), ("TaskInstance",
"can_read"), ("Task", "can_read")],
+ ("Airflow", "can_extra_links"): [("Dag", "can_read"), ("Task",
"can_read")],
+ ("Airflow", "can_failed"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_edit")],
+ ("Airflow", "can_gantt"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_read")],
+ ("Airflow", "can_get_logs_with_metadata"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Log", "can_read"),
+ ],
+ ("Airflow", "can_graph"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Task", "can_read"),
+ ("Log", "can_read"),
+ ],
+ ("Airflow", "can_index"): [("Dag", "can_read")],
+ ("Airflow", "can_landing_times"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Task", "can_read"),
+ ],
+ ("Airflow", "can_last_dagruns"): [("Dag", "can_read"), ("DagRun",
"can_read")],
+ ("Airflow", "can_log"): [("Dag", "can_read"), ("TaskInstance",
"can_read"), ("Log", "can_read")],
+ ("Airflow", "can_paused"): [("Dag", "can_paused")],
+ ("Airflow", "can_redirect_to_external_log"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Log", "can_read"),
+ ],
+ ("Airflow", "can_refresh"): [("Dag", "can_edit")],
+ ("Airflow", "can_refresh_all"): [("Dag", "can_edit")],
+ ("Airflow", "can_rendered"): [("Dag", "can_read"), ("TaskInstance",
"can_read")],
+ ("Airflow", "can_run"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_create")],
Review comment:
This one isn't quite right -- the TI already exists here, so
`can_create` isn't correct, but I'm not sure what would be correct here. Hmmm
##########
File path: airflow/cli/commands/role_command.py
##########
@@ -41,3 +39,259 @@ def roles_create(args):
appbuilder = cached_app().appbuilder # pylint: disable=no-member
for role_name in args.role:
appbuilder.sm.add_role(role_name)
+
+
+mapping = {
+ # ========================= Airflow Views
+ ("Airflow", "can_blocked"): [("Dag", "can_read"), ("DagRun", "can_read")],
+ ("Airflow", "can_clear"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_delete")],
+ ("Airflow", "can_code"): [("Dag", "can_read"), ("DagCode", "can_read")],
+ ("Airflow", "can_dag_details"): [("Dag", "can_read"), ("DagRun",
"can_read")],
+ ("Airflow", "can_dag_stats"): [("Dag", "can_read"), ("DagRun",
"can_read")],
+ ("Airflow", "can_dagrun_clear"): [
+ ("Dag", "can_read"),
+ ("Task", "can_read"),
+ ("TaskInstance", "can_delete"),
+ ],
+ ("Airflow", "can_dagrun_failed"): [("Dag", "can_read"), ("DagRun",
"can_edit")],
+ ("Airflow", "can_dagrun_success"): [("Dag", "can_read"), ("DagRun",
"can_edit")],
+ ("Airflow", "can_delete"): [("Dag", "can_delete")],
+ ("Airflow", "can_duration"): [("Dag", "can_read"), ("TaskInstance",
"can_read"), ("Task", "can_read")],
+ ("Airflow", "can_extra_links"): [("Dag", "can_read"), ("Task",
"can_read")],
+ ("Airflow", "can_failed"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_edit")],
+ ("Airflow", "can_gantt"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_read")],
+ ("Airflow", "can_get_logs_with_metadata"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Log", "can_read"),
+ ],
+ ("Airflow", "can_graph"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Task", "can_read"),
+ ("Log", "can_read"),
+ ],
+ ("Airflow", "can_index"): [("Dag", "can_read")],
+ ("Airflow", "can_landing_times"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Task", "can_read"),
+ ],
+ ("Airflow", "can_last_dagruns"): [("Dag", "can_read"), ("DagRun",
"can_read")],
+ ("Airflow", "can_log"): [("Dag", "can_read"), ("TaskInstance",
"can_read"), ("Log", "can_read")],
+ ("Airflow", "can_paused"): [("Dag", "can_paused")],
+ ("Airflow", "can_redirect_to_external_log"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Log", "can_read"),
+ ],
+ ("Airflow", "can_refresh"): [("Dag", "can_edit")],
+ ("Airflow", "can_refresh_all"): [("Dag", "can_edit")],
+ ("Airflow", "can_rendered"): [("Dag", "can_read"), ("TaskInstance",
"can_read")],
+ ("Airflow", "can_run"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_create")],
+ ("Airflow", "can_success"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_edit")],
+ ("Airflow", "can_task"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_read")],
+ ("Airflow", "can_task_instances"): [
+ ("Dag", "can_read"),
+ ("Task", "can_read"),
+ ("TaskInstance", "can_read"),
+ ],
+ ("Airflow", "can_task_stats"): [("DagRun", "can_read"), ("TaskInstance",
"can_read")],
+ ("Airflow", "can_tree"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Task", "can_read"),
+ ("Log", "can_read"),
+ ],
+ ("Airflow", "can_tries"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_read")],
+ ("Airflow", "can_trigger"): [("Dag", "can_read"), ("DagRun",
"can_create")],
+ ("Airflow", "can_xcom"): [("Dag", "can_read"), ("TaskInstance",
"can_read"), ("XCom", "can_read")],
+ # =========================
+ ("Config", "can_read"): [("Config", "can_read")], # config_endpoint
+ ("ConfigurationView", "can_conf"): [], # views.py
+ ("ConnectionModelView", "can_add"): [("Connection", "can_create")], #
views.py
+ ("ConnectionModelView", "can_delete"): [("Connection", "can_delete")], #
views.py
+ ("ConnectionModelView", "can_edit"): [("Connection", "can_edit")], #
views.py
+ ("ConnectionModelView", "can_list"): [("Connection", "can_read")], #
views.py
+ ("ConnectionModelView", "muldelete"): [("Connection", "can_delete")], #
views.py
+ ("DagModelView", "can_list"): [("Dag", "can_read")], # views.py
+ ("DagModelView", "can_show"): [("Dag", "can_read")], # views.py
+ ("DagRunModelView", "can_add"): [("DagRun", "can_create")], # views.py
+ ("DagRunModelView", "can_list"): [("DagRun", "can_read")], # views.py
+ ("DagRunModelView", "muldelete"): [("DagRun", "can_delete")], # views.py
+ ("DagRunModelView", "set_failed"): [("DagRun", "can_edit")], # views.py
+ ("DagRunModelView", "set_running"): [("DagRun", "can_edit")], # views.py
+ ("DagRunModelView", "set_success"): [("DagRun", "can_edit")], # views.py
+ ("ImportError", "can_read"): [], # import_error_endpoint
+ ("JobModelView", "can_list"): [("Job", "can_read")], # views.py
+ ("Log", "can_read"): [], # event_log_endpoint.py
+ ("LogModelView", "can_list"): [("Log", "can_read")], # views.py
+ ("MenuApi", "can_get"): [], # FAB menu.py
+ ("PermissionModelView", "can_list"): [("Permission", "can_read")], # FAB
+ ("PermissionViewModelView", "can_list"): [("PermissionView", "can_read")],
# FAB
+ ("PoolModelView", "can_add"): [("Pool", "can_create")], # views.py
+ ("PoolModelView", "can_delete"): [("Pool", "can_delete")], # views.py
+ ("PoolModelView", "can_edit"): [("Pool", "can_edit")], # views.py
+ ("PoolModelView", "can_list"): [("Pool", "can_read")], # views.py
+ ("PoolModelView", "muldelete"): [("Pool", "can_delete")], # views.py
+ ("ResetMyPasswordView", "can_this_form_get"): [], # FAB
+ ("ResetMyPasswordView", "can_this_form_post"): [], # FAB
+ ("ResetPasswordView", "can_this_form_get"): [], # FAB
+ ("ResetPasswordView", "can_this_form_post"): [], # FAB
+ ("RoleModelView", "can_add"): [("Role", "can_create")], # FAB
+ ("RoleModelView", "can_delete"): [("Role", "can_delete")], # FAB
+ ("RoleModelView", "can_download"): [("Role", "can_read")], # FAB
+ ("RoleModelView", "can_edit"): [("Role", "can_edit")], # FAB
+ ("RoleModelView", "can_list"): [("Role", "can_read")], # FAB
+ ("RoleModelView", "can_show"): [("Role", "can_read")], # FAB
+ ("RoleModelView", "copyrole"): [("Role", "can_create")], # FAB
+ ("SlaMissModelView", "can_list"): [("SlaMiss", "can_read")], # views.py
+ ("Task", "can_edit"): [("Task", "can_edit")], # task_endpoint.py
+ ("Task", "can_read"): [("Task", "can_read")], # task_endpoint.py
+ ("TaskInstanceModelView", "can_list"): [("TaskInstance", "can_read")], #
views.py
+ ("TaskInstanceModelView", "clear"): [], # views.py
+ ("TaskInstanceModelView", "set_failed"): [("TaskInstance", "can_edit")],
# views.py
+ ("TaskInstanceModelView", "set_retry"): [("TaskInstance", "can_edit")], #
views.py
+ ("TaskInstanceModelView", "set_running"): [("TaskInstance", "can_edit")],
# views.py
+ ("TaskInstanceModelView", "set_success"): [("TaskInstance", "can_edit")],
# views.py
+ ("TaskRescheduleModelView", "can_list"): [("TaskReschedule", "can_read")],
# views.py
+ ("UserDBModelView", "can_add"): [("UserDB", "can_create")], # FAB
+ ("UserDBModelView", "can_delete"): [("UserDB", "can_delete")], # FAB
+ ("UserDBModelView", "can_download"): [], # FAB
+ ("UserDBModelView", "can_edit"): [("UserDB", "can_edit")], # FAB
+ ("UserDBModelView", "can_list"): [("UserDB", "can_read")], # FAB
+ ("UserDBModelView", "can_show"): [], # FAB
+ ("UserDBModelView", "can_userinfo"): [], # FAB
+ ("UserDBModelView", "resetmypassword"): [], # FAB
+ ("UserDBModelView", "resetpasswords"): [], # FAB
+ ("UserDBModelView", "userinfoedit"): [], # FAB
+ ("UserInfoEditView", "can_this_form_get"): [], # FAB
+ ("UserInfoEditView", "can_this_form_post"): [], # FAB
+ ("UserStatsChartView", "can_chart"): [], # FAB
Review comment:
These are FAB built in permissions -- should we leave them alone, or
have we subclassed the view to change the resource name?
##########
File path: airflow/cli/commands/role_command.py
##########
@@ -41,3 +39,259 @@ def roles_create(args):
appbuilder = cached_app().appbuilder # pylint: disable=no-member
for role_name in args.role:
appbuilder.sm.add_role(role_name)
+
+
+mapping = {
+ # ========================= Airflow Views
+ ("Airflow", "can_blocked"): [("Dag", "can_read"), ("DagRun", "can_read")],
+ ("Airflow", "can_clear"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_delete")],
+ ("Airflow", "can_code"): [("Dag", "can_read"), ("DagCode", "can_read")],
+ ("Airflow", "can_dag_details"): [("Dag", "can_read"), ("DagRun",
"can_read")],
+ ("Airflow", "can_dag_stats"): [("Dag", "can_read"), ("DagRun",
"can_read")],
+ ("Airflow", "can_dagrun_clear"): [
+ ("Dag", "can_read"),
+ ("Task", "can_read"),
+ ("TaskInstance", "can_delete"),
+ ],
+ ("Airflow", "can_dagrun_failed"): [("Dag", "can_read"), ("DagRun",
"can_edit")],
+ ("Airflow", "can_dagrun_success"): [("Dag", "can_read"), ("DagRun",
"can_edit")],
+ ("Airflow", "can_delete"): [("Dag", "can_delete")],
+ ("Airflow", "can_duration"): [("Dag", "can_read"), ("TaskInstance",
"can_read"), ("Task", "can_read")],
+ ("Airflow", "can_extra_links"): [("Dag", "can_read"), ("Task",
"can_read")],
+ ("Airflow", "can_failed"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_edit")],
+ ("Airflow", "can_gantt"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_read")],
+ ("Airflow", "can_get_logs_with_metadata"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Log", "can_read"),
+ ],
+ ("Airflow", "can_graph"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Task", "can_read"),
+ ("Log", "can_read"),
Review comment:
```suggestion
```
##########
File path: airflow/cli/commands/role_command.py
##########
@@ -41,3 +39,259 @@ def roles_create(args):
appbuilder = cached_app().appbuilder # pylint: disable=no-member
for role_name in args.role:
appbuilder.sm.add_role(role_name)
+
+
+mapping = {
+ # ========================= Airflow Views
+ ("Airflow", "can_blocked"): [("Dag", "can_read"), ("DagRun", "can_read")],
+ ("Airflow", "can_clear"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_delete")],
+ ("Airflow", "can_code"): [("Dag", "can_read"), ("DagCode", "can_read")],
+ ("Airflow", "can_dag_details"): [("Dag", "can_read"), ("DagRun",
"can_read")],
+ ("Airflow", "can_dag_stats"): [("Dag", "can_read"), ("DagRun",
"can_read")],
+ ("Airflow", "can_dagrun_clear"): [
+ ("Dag", "can_read"),
+ ("Task", "can_read"),
+ ("TaskInstance", "can_delete"),
+ ],
+ ("Airflow", "can_dagrun_failed"): [("Dag", "can_read"), ("DagRun",
"can_edit")],
+ ("Airflow", "can_dagrun_success"): [("Dag", "can_read"), ("DagRun",
"can_edit")],
+ ("Airflow", "can_delete"): [("Dag", "can_delete")],
+ ("Airflow", "can_duration"): [("Dag", "can_read"), ("TaskInstance",
"can_read"), ("Task", "can_read")],
+ ("Airflow", "can_extra_links"): [("Dag", "can_read"), ("Task",
"can_read")],
+ ("Airflow", "can_failed"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_edit")],
+ ("Airflow", "can_gantt"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_read")],
+ ("Airflow", "can_get_logs_with_metadata"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Log", "can_read"),
Review comment:
I think `Log` is a different resource -- this "get-logs" is different to
the LogsModelView -- the later is "Audit Logs", this is reading the log file
from task execution.
##########
File path: airflow/cli/commands/role_command.py
##########
@@ -41,3 +39,259 @@ def roles_create(args):
appbuilder = cached_app().appbuilder # pylint: disable=no-member
for role_name in args.role:
appbuilder.sm.add_role(role_name)
+
+
+mapping = {
+ # ========================= Airflow Views
+ ("Airflow", "can_blocked"): [("Dag", "can_read"), ("DagRun", "can_read")],
+ ("Airflow", "can_clear"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_delete")],
+ ("Airflow", "can_code"): [("Dag", "can_read"), ("DagCode", "can_read")],
+ ("Airflow", "can_dag_details"): [("Dag", "can_read"), ("DagRun",
"can_read")],
+ ("Airflow", "can_dag_stats"): [("Dag", "can_read"), ("DagRun",
"can_read")],
+ ("Airflow", "can_dagrun_clear"): [
+ ("Dag", "can_read"),
+ ("Task", "can_read"),
+ ("TaskInstance", "can_delete"),
+ ],
+ ("Airflow", "can_dagrun_failed"): [("Dag", "can_read"), ("DagRun",
"can_edit")],
+ ("Airflow", "can_dagrun_success"): [("Dag", "can_read"), ("DagRun",
"can_edit")],
+ ("Airflow", "can_delete"): [("Dag", "can_delete")],
+ ("Airflow", "can_duration"): [("Dag", "can_read"), ("TaskInstance",
"can_read"), ("Task", "can_read")],
+ ("Airflow", "can_extra_links"): [("Dag", "can_read"), ("Task",
"can_read")],
+ ("Airflow", "can_failed"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_edit")],
+ ("Airflow", "can_gantt"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_read")],
Review comment:
DagRun?
##########
File path: airflow/cli/commands/role_command.py
##########
@@ -41,3 +39,259 @@ def roles_create(args):
appbuilder = cached_app().appbuilder # pylint: disable=no-member
for role_name in args.role:
appbuilder.sm.add_role(role_name)
+
+
+mapping = {
+ # ========================= Airflow Views
+ ("Airflow", "can_blocked"): [("Dag", "can_read"), ("DagRun", "can_read")],
+ ("Airflow", "can_clear"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_delete")],
+ ("Airflow", "can_code"): [("Dag", "can_read"), ("DagCode", "can_read")],
+ ("Airflow", "can_dag_details"): [("Dag", "can_read"), ("DagRun",
"can_read")],
+ ("Airflow", "can_dag_stats"): [("Dag", "can_read"), ("DagRun",
"can_read")],
+ ("Airflow", "can_dagrun_clear"): [
+ ("Dag", "can_read"),
+ ("Task", "can_read"),
+ ("TaskInstance", "can_delete"),
+ ],
+ ("Airflow", "can_dagrun_failed"): [("Dag", "can_read"), ("DagRun",
"can_edit")],
+ ("Airflow", "can_dagrun_success"): [("Dag", "can_read"), ("DagRun",
"can_edit")],
+ ("Airflow", "can_delete"): [("Dag", "can_delete")],
+ ("Airflow", "can_duration"): [("Dag", "can_read"), ("TaskInstance",
"can_read"), ("Task", "can_read")],
+ ("Airflow", "can_extra_links"): [("Dag", "can_read"), ("Task",
"can_read")],
+ ("Airflow", "can_failed"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_edit")],
+ ("Airflow", "can_gantt"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_read")],
+ ("Airflow", "can_get_logs_with_metadata"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Log", "can_read"),
+ ],
+ ("Airflow", "can_graph"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Task", "can_read"),
+ ("Log", "can_read"),
+ ],
+ ("Airflow", "can_index"): [("Dag", "can_read")],
+ ("Airflow", "can_landing_times"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Task", "can_read"),
+ ],
+ ("Airflow", "can_last_dagruns"): [("Dag", "can_read"), ("DagRun",
"can_read")],
+ ("Airflow", "can_log"): [("Dag", "can_read"), ("TaskInstance",
"can_read"), ("Log", "can_read")],
+ ("Airflow", "can_paused"): [("Dag", "can_paused")],
+ ("Airflow", "can_redirect_to_external_log"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Log", "can_read"),
+ ],
+ ("Airflow", "can_refresh"): [("Dag", "can_edit")],
+ ("Airflow", "can_refresh_all"): [("Dag", "can_edit")],
Review comment:
These are actually just read-operations (it refreshes from the DB
ensuring there's no stale cache). It may go away soon anyway, but it isn't
really an "edit"
##########
File path: airflow/cli/commands/role_command.py
##########
@@ -41,3 +39,259 @@ def roles_create(args):
appbuilder = cached_app().appbuilder # pylint: disable=no-member
for role_name in args.role:
appbuilder.sm.add_role(role_name)
+
+
+mapping = {
+ # ========================= Airflow Views
+ ("Airflow", "can_blocked"): [("Dag", "can_read"), ("DagRun", "can_read")],
+ ("Airflow", "can_clear"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_delete")],
+ ("Airflow", "can_code"): [("Dag", "can_read"), ("DagCode", "can_read")],
+ ("Airflow", "can_dag_details"): [("Dag", "can_read"), ("DagRun",
"can_read")],
+ ("Airflow", "can_dag_stats"): [("Dag", "can_read"), ("DagRun",
"can_read")],
+ ("Airflow", "can_dagrun_clear"): [
+ ("Dag", "can_read"),
+ ("Task", "can_read"),
+ ("TaskInstance", "can_delete"),
+ ],
+ ("Airflow", "can_dagrun_failed"): [("Dag", "can_read"), ("DagRun",
"can_edit")],
+ ("Airflow", "can_dagrun_success"): [("Dag", "can_read"), ("DagRun",
"can_edit")],
+ ("Airflow", "can_delete"): [("Dag", "can_delete")],
+ ("Airflow", "can_duration"): [("Dag", "can_read"), ("TaskInstance",
"can_read"), ("Task", "can_read")],
+ ("Airflow", "can_extra_links"): [("Dag", "can_read"), ("Task",
"can_read")],
+ ("Airflow", "can_failed"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_edit")],
+ ("Airflow", "can_gantt"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_read")],
+ ("Airflow", "can_get_logs_with_metadata"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Log", "can_read"),
+ ],
+ ("Airflow", "can_graph"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Task", "can_read"),
+ ("Log", "can_read"),
+ ],
+ ("Airflow", "can_index"): [("Dag", "can_read")],
+ ("Airflow", "can_landing_times"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Task", "can_read"),
+ ],
+ ("Airflow", "can_last_dagruns"): [("Dag", "can_read"), ("DagRun",
"can_read")],
+ ("Airflow", "can_log"): [("Dag", "can_read"), ("TaskInstance",
"can_read"), ("Log", "can_read")],
+ ("Airflow", "can_paused"): [("Dag", "can_paused")],
+ ("Airflow", "can_redirect_to_external_log"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Log", "can_read"),
+ ],
+ ("Airflow", "can_refresh"): [("Dag", "can_edit")],
+ ("Airflow", "can_refresh_all"): [("Dag", "can_edit")],
+ ("Airflow", "can_rendered"): [("Dag", "can_read"), ("TaskInstance",
"can_read")],
+ ("Airflow", "can_run"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_create")],
+ ("Airflow", "can_success"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_edit")],
+ ("Airflow", "can_task"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_read")],
+ ("Airflow", "can_task_instances"): [
+ ("Dag", "can_read"),
+ ("Task", "can_read"),
+ ("TaskInstance", "can_read"),
+ ],
+ ("Airflow", "can_task_stats"): [("DagRun", "can_read"), ("TaskInstance",
"can_read")],
+ ("Airflow", "can_tree"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Task", "can_read"),
+ ("Log", "can_read"),
Review comment:
```suggestion
```
##########
File path: airflow/cli/commands/role_command.py
##########
@@ -41,3 +39,259 @@ def roles_create(args):
appbuilder = cached_app().appbuilder # pylint: disable=no-member
for role_name in args.role:
appbuilder.sm.add_role(role_name)
+
+
+mapping = {
+ # ========================= Airflow Views
+ ("Airflow", "can_blocked"): [("Dag", "can_read"), ("DagRun", "can_read")],
+ ("Airflow", "can_clear"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_delete")],
+ ("Airflow", "can_code"): [("Dag", "can_read"), ("DagCode", "can_read")],
+ ("Airflow", "can_dag_details"): [("Dag", "can_read"), ("DagRun",
"can_read")],
+ ("Airflow", "can_dag_stats"): [("Dag", "can_read"), ("DagRun",
"can_read")],
+ ("Airflow", "can_dagrun_clear"): [
+ ("Dag", "can_read"),
+ ("Task", "can_read"),
+ ("TaskInstance", "can_delete"),
+ ],
+ ("Airflow", "can_dagrun_failed"): [("Dag", "can_read"), ("DagRun",
"can_edit")],
+ ("Airflow", "can_dagrun_success"): [("Dag", "can_read"), ("DagRun",
"can_edit")],
+ ("Airflow", "can_delete"): [("Dag", "can_delete")],
+ ("Airflow", "can_duration"): [("Dag", "can_read"), ("TaskInstance",
"can_read"), ("Task", "can_read")],
+ ("Airflow", "can_extra_links"): [("Dag", "can_read"), ("Task",
"can_read")],
+ ("Airflow", "can_failed"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_edit")],
+ ("Airflow", "can_gantt"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_read")],
+ ("Airflow", "can_get_logs_with_metadata"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Log", "can_read"),
+ ],
+ ("Airflow", "can_graph"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Task", "can_read"),
+ ("Log", "can_read"),
+ ],
+ ("Airflow", "can_index"): [("Dag", "can_read")],
+ ("Airflow", "can_landing_times"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Task", "can_read"),
+ ],
+ ("Airflow", "can_last_dagruns"): [("Dag", "can_read"), ("DagRun",
"can_read")],
+ ("Airflow", "can_log"): [("Dag", "can_read"), ("TaskInstance",
"can_read"), ("Log", "can_read")],
+ ("Airflow", "can_paused"): [("Dag", "can_paused")],
+ ("Airflow", "can_redirect_to_external_log"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Log", "can_read"),
+ ],
+ ("Airflow", "can_refresh"): [("Dag", "can_edit")],
+ ("Airflow", "can_refresh_all"): [("Dag", "can_edit")],
+ ("Airflow", "can_rendered"): [("Dag", "can_read"), ("TaskInstance",
"can_read")],
+ ("Airflow", "can_run"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_create")],
+ ("Airflow", "can_success"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_edit")],
+ ("Airflow", "can_task"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_read")],
+ ("Airflow", "can_task_instances"): [
+ ("Dag", "can_read"),
+ ("Task", "can_read"),
+ ("TaskInstance", "can_read"),
+ ],
+ ("Airflow", "can_task_stats"): [("DagRun", "can_read"), ("TaskInstance",
"can_read")],
+ ("Airflow", "can_tree"): [
+ ("Dag", "can_read"),
+ ("TaskInstance", "can_read"),
+ ("Task", "can_read"),
+ ("Log", "can_read"),
+ ],
+ ("Airflow", "can_tries"): [("Dag", "can_read"), ("Task", "can_read"),
("TaskInstance", "can_read")],
+ ("Airflow", "can_trigger"): [("Dag", "can_read"), ("DagRun",
"can_create")],
+ ("Airflow", "can_xcom"): [("Dag", "can_read"), ("TaskInstance",
"can_read"), ("XCom", "can_read")],
+ # =========================
+ ("Config", "can_read"): [("Config", "can_read")], # config_endpoint
+ ("ConfigurationView", "can_conf"): [], # views.py
+ ("ConnectionModelView", "can_add"): [("Connection", "can_create")], #
views.py
+ ("ConnectionModelView", "can_delete"): [("Connection", "can_delete")], #
views.py
+ ("ConnectionModelView", "can_edit"): [("Connection", "can_edit")], #
views.py
+ ("ConnectionModelView", "can_list"): [("Connection", "can_read")], #
views.py
+ ("ConnectionModelView", "muldelete"): [("Connection", "can_delete")], #
views.py
+ ("DagModelView", "can_list"): [("Dag", "can_read")], # views.py
+ ("DagModelView", "can_show"): [("Dag", "can_read")], # views.py
+ ("DagRunModelView", "can_add"): [("DagRun", "can_create")], # views.py
+ ("DagRunModelView", "can_list"): [("DagRun", "can_read")], # views.py
+ ("DagRunModelView", "muldelete"): [("DagRun", "can_delete")], # views.py
+ ("DagRunModelView", "set_failed"): [("DagRun", "can_edit")], # views.py
+ ("DagRunModelView", "set_running"): [("DagRun", "can_edit")], # views.py
+ ("DagRunModelView", "set_success"): [("DagRun", "can_edit")], # views.py
+ ("ImportError", "can_read"): [], # import_error_endpoint
+ ("JobModelView", "can_list"): [("Job", "can_read")], # views.py
+ ("Log", "can_read"): [], # event_log_endpoint.py
+ ("LogModelView", "can_list"): [("Log", "can_read")], # views.py
+ ("MenuApi", "can_get"): [], # FAB menu.py
+ ("PermissionModelView", "can_list"): [("Permission", "can_read")], # FAB
+ ("PermissionViewModelView", "can_list"): [("PermissionView", "can_read")],
# FAB
+ ("PoolModelView", "can_add"): [("Pool", "can_create")], # views.py
+ ("PoolModelView", "can_delete"): [("Pool", "can_delete")], # views.py
+ ("PoolModelView", "can_edit"): [("Pool", "can_edit")], # views.py
+ ("PoolModelView", "can_list"): [("Pool", "can_read")], # views.py
+ ("PoolModelView", "muldelete"): [("Pool", "can_delete")], # views.py
+ ("ResetMyPasswordView", "can_this_form_get"): [], # FAB
+ ("ResetMyPasswordView", "can_this_form_post"): [], # FAB
+ ("ResetPasswordView", "can_this_form_get"): [], # FAB
+ ("ResetPasswordView", "can_this_form_post"): [], # FAB
Review comment:
What does empty RHS mean here? Are these permissions deleted, or left
unchanged?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
