potiuk opened a new pull request, #71136:
URL: https://github.com/apache/airflow/pull/71136

   Another follow-up after @amoghrajesh's #71078, which fixed this same 
regression in the AWS, Key Vault, Google Secret Manager and Lockbox secrets 
backends. The core `EnvironmentVariablesBackend` carries it too, and was not 
covered there — cc @vatsrahul1001 @amoghrajesh.
   
   The backend refuses any connection or variable id carrying the team 
namespace separator, because such an id cannot be attributed to a team 
unambiguously — a team name may itself contain the separator, so `_a___b___c` 
reads as team `a` with id `b___c` just as well as team `a___b` with id `c`.
   
   That refusal fires unconditionally, including in deployments that never 
enabled multi-team mode. There, an ordinary connection or variable id that 
happens to contain `___` is silently reported as missing — no exception, and 
nothing distinguishes it from a secret that was never set.
   
   No team scoped secret can be read while multi-team is off: the lookups are 
only ever handed a `team_name` in that mode. So the id has a single meaning 
there and nothing needs refusing. Same gate as #71078, applied at the same 
place in the logic.
   
   ### What this changes for the tests
   
   The existing team-scoping tests all assert the refusal, so they now run with 
multi-team enabled. Two of them 
(`test_connection_env_var_do_not_access_team_specific` and 
`test_variable_env_var_do_not_access_team_specific`) would otherwise fail, 
because `AIRFLOW_CONN__TEAM___TEST_MYSQL` legitimately resolves as an ordinary 
connection named `_team___test_mysql` once multi-team is off — that is the 
intended trade, and the same one #71078 makes on the provider side.
   
   ### Test plan
   
   - [x] New `TestEnvironmentVariablesBackendWithoutMultiTeam` — verified 
against unmodified code: it **fails** with `assert None == 
'team-agnostic-value'`, the reported symptom exactly
   - [x] `test_secrets.py`, `test_secrets_environment_variables.py`, 
`test_secrets_backends.py` — 72 passed
   - [x] Full `airflow-core/tests/unit/always` — 2008 passed; the one failure 
(`example_mysql_to_gcs.py`) is a missing `mysqlclient` on the host and 
reproduces on unmodified `main`
   - [x] `ruff` / `ruff format` / static checks clean
   
   No newsfragment: #70736 is milestoned 3.3.1 and unreleased, so the 
regression never reached users.
   
   ---
   
   ##### Was generative AI tooling used to co-author this PR?
   
   - [X] Yes — Claude Code (Opus 5)
   
   Generated-by: Claude Code (Opus 5) following [the 
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to