jedcunningham opened a new pull request, #76329:
URL: https://github.com/apache/airflow/pull/76329
The Dag bundle pages were authorized through the Dags inside each bundle: a
bundle was listed if the caller could read a Dag in it, and its file list and
counts were narrowed to those Dags. A bundle is deployed as a whole, so that
made the counts differ between users and hid exactly the case the page most
needs to show — a bundle whose only file fails before defining a Dag.
This gives bundles their own `AccessView.DAG_BUNDLES` permission instead:
- `GET /api/v2/dagBundles`, `/{bundle_name}` and `/{bundle_name}/files`
require the new view. It is Op and Admin by default in SimpleAuthManager and
FAB (a new `Dag Bundles` resource on the Op role), and SuperAdmin-only in
multi-team Keycloak.
- Holders of the view see every file in the bundle with full Dag and
import-error counts, and the bundle url. The text of an import error and the
contents of a Dag stay behind their own permissions.
- In multi-team mode bundles are scoped to the caller's teams: the view is
checked per team, and team membership is checked separately so an auth manager
that ignores `team_name` for views can't expose another team's bundles.
- Viewers lose access to `GET /dagBundles`, which the import-error dialogs
used to decide whether to show the bundle name. A small `GET
/ui/dagBundles/count`, gated on Dag read, now answers that instead.
- FAB and Keycloak keep their previous behaviour on cores without the new
view.
The bundle endpoints have only shipped in 3.4.0 pre-releases, so the API
changes (non-nullable `import_error_count`, unconditional `bundle_url`) don't
break a released contract.
Verified locally: the Dag bundle route tests (public and UI), the
SimpleAuthManager and Keycloak auth-manager tests, the FAB auth-manager view
and menu tests, the permission-doc generator tests, the full UI unit suite,
plus mypy, `tsc` and eslint. The e2e spec was not run.
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Code (Opus 5.5)
Generated-by: Claude Code (Opus 5.5) following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
