anmolxlight commented on PR #72495:
URL: https://github.com/apache/airflow/pull/72495#issuecomment-5595582617

   @stephen-bracken Good question. No, deliberately not.
   
   `get_rbac_reference()` covers the resource surface only: resource name, 
authorizing `is_authorized_*` method, allowed actions, scoping enum 
(`DagAccessEntity`, `AccessView`, ...), and details dataclass fields 
(`DagDetails`, ...).
   
   Role to permission mapping is not part of it because roles are a 
`SimpleAuthManager` concept (`ADMIN`/`OP`/`USER`/`VIEWER`/`PUBLIC` with 
hierarchical ordering). `BaseAuthManager` itself is role-agnostic, and provider 
managers like Keycloak bring their own role model, so the reference gives them 
the resource surface their own roles must map onto rather than baking in one 
manager's role hierarchy.
   
   Happy to add a `SimpleAuthManager.get_role_reference()` on top if you think 
that mapping is worth exposing too. Just say the word.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to