waterWang opened a new pull request, #71313:
URL: https://github.com/apache/airflow/pull/71313
## Problem
The `ReadOnly` scope-based permission is created with `resources: []`
(unbound), which matches **every** resource carrying GET/LIST/MENU scopes in
Keycloak — including per-team resources like `Dag:team-b`. This shadows the
correctly built `ReadOnly-{team}` aggregate permissions and grants read access
on role alone, bypassing team isolation.
## Fix (4 changes)
1. **Bind `ReadOnly` to explicit global resources** — both in
`_get_permissions_to_create` (non-teams and teams) and in
`_attach_default_role_permissions`, so the permission covers only non-team
resources (Dag, Connection, Pool, Variable, Team, Asset, AssetAlias,
Configuration) instead of matching everything.
2. **Expand `ReadOnly-{team}` to all team-scoped resources** — previously
only covered `Dag:{team}` and `Team:{team}`. Now covers all
`TEAM_SCOPED_RESOURCE_NAMES` (Connection, Dag, Pool, Team, Variable),
consistent with the `Admin-{team}` permission.
3. **Expand `Admin` global permission to include global resources** — under
`--teams`, the global Admin permission now covers both team and global
resources, so Admin users can interact with shared (teamless) resources as
documented.
4. **Set `resource_names` explicitly in `_attach_default_role_permissions`
for both `ReadOnly` and `Admin` permissions** — replaces `resource_names=[]`
with the full list of known resources, preventing unbound-scope leakage.
## Test
Modified tests in `test_commands.py` to reflect the new resource bindings.
Fixes #71277
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
