dheerenmohta opened a new pull request, #71933:
URL: https://github.com/apache/airflow/pull/71933
PATCH /roles/{name} only ever added permissions found in the request body to
a role; it never revoked permissions that were on the role but missing from the
body, so there was no way to remove a permission from a role through the stable
REST API. The endpoint already required "PUT"-level authorization, and every
other PATCH endpoint in this API (connections, dags, dag runs, pools,
variables) treats a field as fully replaced once it is present in the request
(via model_fields_set) or named in update_mask -- roles just never extended
that convention to the "actions" list. This also fixes update_mask silently
letting stray "actions" in the body get applied even when the mask didn't
request it.
A 2023 attempt (apache/airflow#30193) added a separate POST
.../actions/revoke endpoint instead of fixing PATCH, which required callers to
compute their own diff and stalled on bikeshedding over new exception classes
and HTTP status codes; it went stale and was closed unmerged. This instead
makes PATCH itself diff against the role's current permissions and apply
add/remove using the security manager's existing single-item methods, so the
request body can just state the desired end state.
closes: #18714
related: #30193
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Code (Sonnet 5)
Generated-by: Claude Code (Sonnet 5) following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
