Standardize default fab perms#14946
Conversation
jhtimmins
requested review from
ashb,
ephraimbuddy,
kaxil,
mik-laj,
ryanahamilton and
vikramkoka
as code owners
boring-cyborg
Bot
added
area:API
jhtimmins
force-pushed
the
standardize-default-fab-perms
branch
2 times, most recently
from
bb2378d to
71f4062
Compare
|
The Workflow run is cancelling this PR. It has some failed jobs matching ^Pylint$,^Static checks,^Build docs$,^Spell check docs$,^Provider packages,^Checks: Helm tests$,^Test OpenAPI*. |
jhtimmins
force-pushed
the
standardize-default-fab-perms
branch
from
71f4062 to
7f3d0c0
Compare
|
The Workflow run is cancelling this PR. It has some failed jobs matching ^Pylint$,^Static checks,^Build docs$,^Spell check docs$,^Provider packages,^Checks: Helm tests$,^Test OpenAPI*. |
There was a problem hiding this comment.
Wondering if there's a mistake here on using RESOURCE_PERMISSION_VIEW?
kaxil
force-pushed
the
standardize-default-fab-perms
branch
from
7f3d0c0 to
434928e
Compare
|
Rebased to latest master to fix the failing errors around providers |
There was a problem hiding this comment.
Should we also set conf.getboolean('webserver', 'UPDATE_FAB_PERMS'): somehow?
There was a problem hiding this comment.
@ashb What would be the purpose of that?
There was a problem hiding this comment.
I honestly couldn't tell you anymore.
Converts the docs_link permission resource name to Documentation. This is an extension of #14946, which standardized default FAB permissions.
jhtimmins
force-pushed
the
standardize-default-fab-perms
branch
from
434928e to
3bed2c2
Compare
|
FYI: This PR and #14840 "fight" |
There was a problem hiding this comment.
What's the difference between this two? Just want to make sure we don't accidentally give permissions to a user to change password for other users :)
There was a problem hiding this comment.
resetmypassword just lets a user update their own password.
resetpasswords lets them update any user's password, and should be limited to Admin-level users.
There was a problem hiding this comment.
Is there a specific reason we call "/userstatschartview" as RESOURCE_USER_STATS_CHART but for userinfo one we call it RESOURCE_MY_PROFILE
i.e. RESOURCE_MY vs RESOURCE_USER. Should we standardize it to say RESOURCE_USER_STATS_CHART and the other one as RESOURCE_USER_PROFILE?
There was a problem hiding this comment.
userstatschartview applies to all users, whereas RESOURCE_MY_PROFILE only applies to the logged in user.
jhtimmins
force-pushed
the
standardize-default-fab-perms
branch
from
1822c42 to
4b8ec3b
Compare
jhtimmins
force-pushed
the
standardize-default-fab-perms
branch
from
4b8ec3b to
20e6b9a
Compare
|
The Workflow run is cancelling this PR. It has some failed jobs matching ^Pylint$,^Static checks,^Build docs$,^Spell check docs$,^Provider packages,^Checks: Helm tests$,^Test OpenAPI*. |
|
The PR most likely needs to run full matrix of tests because it modifies parts of the core of Airflow. However, committers might decide to merge it quickly and take the risk. If they don't merge it quickly - please rebase it to the latest master at your convenience, or amend the last commit of the PR, and push it with --force-with-lease. |
github-actions
Bot
added
the
full tests needed
4 participants
This PR applies the Stable API permissions model to the existing FAB permission views.
In order to merge, the new
/usersand/rolesendpoints were updated to use the FAB permissions model.The following mapping changes are included
PermissionModelView.can_list=>Permissions.can_readPermissionViewModelView.can_list=>Permission Views.can_readResetMyPasswordView.can_this_form_get=>My Password.can_readResetMyPasswordView.can_this_form_post=>My Password.can_editResetPasswordView.can_this_form_get=>Passwords.can_readResetPasswordView.can_this_form_post=>Passwords.can_editRoleModelView.can_delete=>Roles.can_deleteRoleModelView.can_download=>Roles.can_readRoleModelView.can_show=>Roles.can_readRoleModelView.can_list=>Roles.can_readRoleModelView.can_edit=>Roles.can_editRoleModelView.can_add=>Roles.can_createRoleModelView.can_copyrole=>Roles.can_createViewMenuModelView.can_list=>View Menus.can_readUserDBModelView.can_add=>View Menus.can_createUserDBModelView.can_userinfo=>My Profile.can_readUserDBModelView.can_download=>View Menus.can_readUserDBModelView.can_show=>View Menus.can_readUserDBModelView.can_list=>View Menus.can_readUserDBModelView.can_edit=>View Menus.can_editUserDBModelView.resetmypassword=>My Password.can_readUserDBModelView.resetpasswords=>Passwords.can_readUserDBModelView.userinfoedit=>My Profile.can_editUserDBModelView.can_delete=>View Menus.can_deleteUserInfoEditView.can_this_form_get=>My Profile.can_readUserInfoEditView.can_this_form_post=>My Profile.can_editUserStatsChartView.can_chart=>User Stats Chart.can_readUserLDAPModelView.can_userinfo=>My Profile.can_readUserOAuthModelView.can_userinfo=>My Profile.can_readUserOIDModelView.can_userinfo=>My Profile.can_readUserRemoteUserModelView.can_userinfo=>My Profile.can_readDagRunModelView.can_clear=>Dags.can_read,TaskInstances.can_delete