SameerMesiah97 commented on code in PR #76702:
URL: https://github.com/apache/airflow/pull/76702#discussion_r4506479966
##########
providers/keycloak/tests/unit/keycloak/auth_manager/cli/test_commands.py:
##########
@@ -778,12 +807,22 @@ def test_create_team_command(
decision_strategy="AFFIRMATIVE",
_dry_run=False,
)
+ mock_attach_policy.assert_any_call(
+ client,
+ "test-id",
+ permission_name="AdminViewAccess",
+ policy_name="Allow-GlobalReadOnly",
+ scope_names=["GET"],
+ resource_names=["AdminView"],
+ decision_strategy="AFFIRMATIVE",
+ _dry_run=False,
+ )
admin_view_policies = [
c.kwargs["policy_name"]
for c in mock_attach_policy.call_args_list
if c.kwargs["permission_name"] == "AdminViewAccess" or "AdminView"
in c.kwargs["resource_names"]
]
- assert admin_view_policies == ["Allow-SuperAdmin"]
+ assert admin_view_policies == ["Allow-SuperAdmin",
"Allow-GlobalReadOnly"]
Review Comment:
Could we add a regression test for the final permissions after `create-team`
completes? `_attach_readonly_permissions()` adds team-scoped resources to
`ReadOnly`, but the subsequent `_update_read_only_permission_resources()`
appears to remove them again. The current mocked call assertions wouldn’t catch
this.
##########
providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/commands.py:
##########
@@ -329,7 +332,11 @@ def _update_read_only_permission_resources(
scope_ids = [s["id"] for s in scopes if s["name"] in ["GET", "MENU",
"LIST"]]
resource_names = TEAM_SCOPED_RESOURCE_NAMES | GLOBAL_SCOPED_RESOURCE_NAMES
resource_ids = [r["_id"] for r in resources if r["name"] in resource_names]
- policy_ids = _get_permission_policy_ids(client, client_uuid, permission_id)
+ existing_policy_ids = _get_permission_policy_ids(client, client_uuid,
permission_id)
+ read_only_policy_id = _get_policy_id(client, client_uuid,
_role_policy_name(READ_ONLY_ROLE_NAME))
+ policy_ids = [policy_id for policy_id in existing_policy_ids if policy_id
== read_only_policy_id]
+ if read_only_policy_id and read_only_policy_id not in policy_ids:
Review Comment:
It looks like you have a redundant list traversal here and I think
`_get_permission_policy_ids` call is not needed. Please see the below:
```
read_only_policy_id = _get_policy_id(
client, client_uuid, _role_policy_name(READ_ONLY_ROLE_NAME)
)
policy_ids = [read_only_policy_id] if read_only_policy_id else []
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
