RehanAhmad25 commented on code in PR #72499:
URL: https://github.com/apache/airflow/pull/72499#discussion_r4499330739
##########
airflow-core/src/airflow/api_fastapi/core_api/datamodels/dag_run.py:
##########
@@ -160,6 +168,23 @@ def validate_exactly_one_selection_mode(self) ->
BulkDAGRunClearBody:
return self
+def mask_password_conf(dag: SerializedDAG | None, conf: dict | None) -> dict |
None:
+ """Replace conf values with "***" for keys the Dag declares as
format="password" string Params."""
+ if not conf or dag is None:
+ return conf
+ params = getattr(dag, "params", None)
+ if not params:
+ return conf
+ masked = dict(conf)
+ for key in masked:
+ if key not in params:
+ continue
+ schema = params.get_param(key).schema
+ if schema.get("type") == "string" and schema.get("format") ==
"password":
+ masked[key] = "***"
Review Comment:
Not at the moment, on purpose. Only top-level string params declared with
format="password" get masked, so a dict param (or a password field inside one)
is left as is. We scoped it that way on the issue to avoid the complexity of
secrets inside objects. If you'd like nested properties handled too, I can add
it here or in a follow-up, whichever you prefer.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
