dhkim1920 commented on PR #70906:
URL: https://github.com/apache/airflow/pull/70906#issuecomment-5154739647
@potiuk
Thanks for catching this. I traced the global `Admin` permission and
confirmed that `Admin` and `SuperAdmin` are separate alternative role policies,
so the same issue applies there as well.
I folded the fix into this PR:
- Set the default non-team global `Admin` permission to `AFFIRMATIVE` for
both the `Admin` and `SuperAdmin` policies.
- Kept the default `UNANIMOUS` strategy for permissions with only one
attached policy.
- Extended the existing non-team test to verify both global administrator
roles.
- Extended the multi-team test to verify that Viewer, User, Op, and Admin
policies all use `AFFIRMATIVE`.
- Added a provider changelog note explaining that existing teams must
rerun `create-team <team>`, while non-team installations must rerun
`create-permissions`. It also notes the effect on manually attached
policies.
The new global Admin assertion failed before the production change because
the expected `AFFIRMATIVE` strategy was missing.
Validation completed:
- `breeze testing providers-tests --test-type
"Providers[common.compat,keycloak]"` — 459 passed, 3 skipped
- `breeze ci selective-check --commit-ref HEAD`
- `prek run --from-ref upstream/main --stage pre-commit`
- `prek run --from-ref upstream/main --stage manual`
Thanks again for identifying the analogous global permission case.
---
Drafted-by: OpenAI Codex (GPT-5); reviewed by @dhkim1920 before posting
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
