potiuk opened a new pull request, #70736:
URL: https://github.com/apache/airflow/pull/70736
A team specific Connection or Variable lives in the
`_<TEAM_NAME>___<SECRET_ID>`
namespace of the environment. An id that already spells such a namespace out
therefore reaches that variable through the team agnostic lookup, which is
only
correct when the namespace is the one the lookup is made for.
`_is_team_specific_accessed_as_global` guarded that, and had two gaps:
- its pattern `_[^_]+___.+` could not span an underscore in the team name,
and
team names may contain underscores (`^[a-zA-Z0-9_-]{3,50}$`);
- it only applied when no team was in scope (`team_name is None`), so with a
team
in scope it did nothing. The team scoped probe above it only returns on a
*hit*,
so a miss fell through to `os.environ.get(PREFIX + id.upper())` — byte
identical
to another team's variable name.
This recognises a namespaced id without assuming the team name has no
underscores, denies it outright when no team is in scope, and otherwise
allows it
only when it begins with the namespace prefix the team in scope itself
builds.
The stored id is deliberately **not** parsed. A team name may contain
underscores, so `_a___b___c` is simultaneously team `a` with id `b___c` and
team
`a___b` with id `c`, and no pattern can separate them — any "first `___`
wins"
rule silently picks one reading and mis-scopes the other. Comparing against
the
prefix the caller constructs needs no such reading, which makes the invariant
statable: *a lookup for team `T` can only read a variable whose name begins
with
`PREFIX + "_" + T.upper() + "___"`, and a lookup with no team scope can never
read a name that could be any team's namespace.*
Both `get_conn_value` and `get_variable` share the helper, so this covers
Connections and Variables together.
### Behaviour change
Ids of the shape `_<something>___<something>` are no longer resolvable
through the
team agnostic environment variable name from any scope. Previously that was
blocked only for the narrower `_<no-underscores>___…` shape and only when no
team
was in scope.
A differential comparison of old versus new resolution across 11 ids × 8 team
scopes gives 57 combinations unchanged and 31 changed, with **every change
in the
`value → None` direction** — none the reverse, and no id lacking the `_…___…`
shape changed at all. Practically: a deployment that stored a *team agnostic*
connection or variable whose id begins with `_` and contains `___` loses that
lookup for teamed callers too. It was already unreachable for untenanted
callers
before this change. Legitimate global ids and same team lookups are
unaffected.
### Test plan
- [x] New
`airflow-core/tests/unit/always/test_secrets_environment_variables.py`, 32
cases — every test parametrized over both lookups and over an
underscore-bearing (`team_a`) and underscore-free (`teama`) team name
- [x] Negative: not resolved without a team scope; not resolved for another
team
- [x] Positive: resolved for its own team; an id spelling out its own team
namespace still resolves; team scoped wins over team agnostic; team agnostic
still resolves for any team scope
- [x] 6 of these fail on `main` without the change
- [x] `ruff check` / `ruff format --check` clean on both files
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Opus 5 (1M context)
Generated-by: Claude Opus 5 (1M context) following the guidelines at
https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
