potiuk opened a new pull request, #71136: URL: https://github.com/apache/airflow/pull/71136
Another follow-up after @amoghrajesh's #71078, which fixed this same regression in the AWS, Key Vault, Google Secret Manager and Lockbox secrets backends. The core `EnvironmentVariablesBackend` carries it too, and was not covered there — cc @vatsrahul1001 @amoghrajesh. The backend refuses any connection or variable id carrying the team namespace separator, because such an id cannot be attributed to a team unambiguously — a team name may itself contain the separator, so `_a___b___c` reads as team `a` with id `b___c` just as well as team `a___b` with id `c`. That refusal fires unconditionally, including in deployments that never enabled multi-team mode. There, an ordinary connection or variable id that happens to contain `___` is silently reported as missing — no exception, and nothing distinguishes it from a secret that was never set. No team scoped secret can be read while multi-team is off: the lookups are only ever handed a `team_name` in that mode. So the id has a single meaning there and nothing needs refusing. Same gate as #71078, applied at the same place in the logic. ### What this changes for the tests The existing team-scoping tests all assert the refusal, so they now run with multi-team enabled. Two of them (`test_connection_env_var_do_not_access_team_specific` and `test_variable_env_var_do_not_access_team_specific`) would otherwise fail, because `AIRFLOW_CONN__TEAM___TEST_MYSQL` legitimately resolves as an ordinary connection named `_team___test_mysql` once multi-team is off — that is the intended trade, and the same one #71078 makes on the provider side. ### Test plan - [x] New `TestEnvironmentVariablesBackendWithoutMultiTeam` — verified against unmodified code: it **fails** with `assert None == 'team-agnostic-value'`, the reported symptom exactly - [x] `test_secrets.py`, `test_secrets_environment_variables.py`, `test_secrets_backends.py` — 72 passed - [x] Full `airflow-core/tests/unit/always` — 2008 passed; the one failure (`example_mysql_to_gcs.py`) is a missing `mysqlclient` on the host and reproduces on unmodified `main` - [x] `ruff` / `ruff format` / static checks clean No newsfragment: #70736 is milestoned 3.3.1 and unreleased, so the regression never reached users. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 5) Generated-by: Claude Code (Opus 5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
