abhishekmauryaKsolves commented on PR #71160: URL: https://github.com/apache/airflow/pull/71160#issuecomment-5245735845
Thanks for the feedback — I've refactored this to address both points. Centralization (comment 2): Moved the per-key sensitive-option detection out of the API service layer entirely and into AirflowConfigParser.is_sensitive_option() itself, alongside the existing team-scoped resolution logic it already has. The _PER_KEY_SENSITIVE_PREFIXES dict and the two standalone helper functions (_is_per_key_sensitive_option, _mask_per_key_sensitive_options) that lived in services/public/config.py are gone — there's now a single source of truth for what counts as sensitive, living where the rest of the sensitivity logic already lives. CLI gap (comment 1): This fell out for free once masking moved into is_sensitive_option() — airflow config list already goes through conf.as_dict() / conf.is_sensitive_option(), so it now masks per-key secrets-backend-kwarg options (both the base spelling and the team-scoped one) with zero changes to config_command.py. Added test_cli_show_config_should_not_show_per_key_secrets_backend_kwargs and test_cli_show_config_should_not_show_team_scoped_per_key_secrets_backend_kwargs to cover it. Both the /config API endpoint and config list CLI command now share the exact same masking path, so there's no risk of the two drifting apart again. All existing + new tests pass (API, CLI, and the shared parser test suite), and prek is clean. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
