anmolxlight commented on PR #72495: URL: https://github.com/apache/airflow/pull/72495#issuecomment-5595582617
@stephen-bracken Good question. No, deliberately not. `get_rbac_reference()` covers the resource surface only: resource name, authorizing `is_authorized_*` method, allowed actions, scoping enum (`DagAccessEntity`, `AccessView`, ...), and details dataclass fields (`DagDetails`, ...). Role to permission mapping is not part of it because roles are a `SimpleAuthManager` concept (`ADMIN`/`OP`/`USER`/`VIEWER`/`PUBLIC` with hierarchical ordering). `BaseAuthManager` itself is role-agnostic, and provider managers like Keycloak bring their own role model, so the reference gives them the resource surface their own roles must map onto rather than baking in one manager's role hierarchy. Happy to add a `SimpleAuthManager.get_role_reference()` on top if you think that mapping is worth exposing too. Just say the word. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
