RehanAhmad25 opened a new pull request, #72499: URL: https://github.com/apache/airflow/pull/72499
Adds `format="password"` as a supported JSON Schema keyword for `Param`, and closes the loop on where that value ends up plaintext today. The trigger-form input side of this already worked (`FieldPassword.tsx` already masks the input whenever `schema.format == "password"`), but nothing downstream of that respected the declaration. This PR: - Registers password-format param values with `mask_secret()` in `process_params()` (task-sdk), so they're redacted in **Task Logs** and **Rendered Templates**. Verified this in source: `_serialize_rendered_fields()` in `task-sdk/src/airflow/sdk/execution_time/task_runner.py` calls `redact()` against the same masker singleton, in the worker, before rendered fields are sent to the API server. - Redacts `conf` in the **DAG Run Details page and REST API**: a helper checks each top-level `conf` key against its DAG's declared `Param` schema and replaces the value with `***` when `format == "password"`. Applied to `get_dag_run`, both pagination branches of `get_dag_runs` (including the `dag_id="~"` all-DAGs case, resolved per-run against that run's own DAG), and `get_list_dag_runs_batch`. **Deliberately out of scope for this PR** (discussed on the issue): - XCom display a value pushed to XCom isn't touched by any of the above, since neither the XCom model nor its API routes run values through `redact()`. This is the same known limitation that already applies to `Connection.password` today (confirmed: `_mask_connection_secrets()` masks it "from logs" per its own docstring, nothing else). - Fernet encryption of `conf` at rest in the metadata DB is flagged as a separate, larger discussion rather than folded into this fix. - Nested object schemas with their own `format` on a sub-property `format="password"` is only honored on string-typed params for now. Docs for `format="password"` in `core-concepts/params.rst` will follow in a follow-up commit on this PR (or a fast-follow), explicitly stating what's covered and what isn't so nobody assumes broader coverage than what's implemented. Closes: #72377 --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes (please specify the tool below) Generated-by: Claude (Anthropic) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
