Skip to content

Standardize default fab perms #14946

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jhtimmins merged 16 commits into from
Apr 12, 2021
Merged

Standardize default fab perms #14946

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
16 commits
Select commit Hold shift + click to select a range
11603b7
Add back changes.
jhtimmins Mar 19, 2021
496b5ec
Add custom view class tests.
jhtimmins Mar 19, 2021
faa904f
Cover missing clear permission.
jhtimmins Mar 20, 2021
a3c3552
Add some of the mappings.
jhtimmins Mar 21, 2021
e8e35a7
Add the rest of the mappings.
jhtimmins Mar 21, 2021
a13fdf9
Fix permission names.
jhtimmins Mar 21, 2021
d84e34c
Fix permission names.
jhtimmins Mar 21, 2021
e78a920
Use standard names for new users endpoints.
jhtimmins Mar 23, 2021
01fe741
Document user access.
jhtimmins Mar 23, 2021
b311879
Remove unused tests.
jhtimmins Mar 24, 2021
f5eabdc
Make roles tests pass by cleaning test roles from test_views.py.
jhtimmins Mar 24, 2021
b159636
Remove old permission names.
jhtimmins Mar 31, 2021
0afc351
Update role tests.
jhtimmins Mar 31, 2021
20e6b9a
Reorder permissions.
jhtimmins Apr 12, 2021
99714c7
Remove RESOURCE_ROLE_MODEL_VIEW.
jhtimmins Apr 12, 2021
eaa1150
Remove db merge.
jhtimmins Apr 12, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .github/actions/cancel-workflow-runs
Open in desktop
Submodule cancel-workflow-runs updated 3 files
+2 −166 README.md
+1 −24 dist/index.js
+1 −30 src/main.ts
12 changes: 6 additions & 6 deletions airflow/api_connexion/endpoints/role_and_permission_endpoint.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ def _check_action_and_resource(sm, perms):
raise BadRequest(detail=f"The specified resource: '{item[1]}' was not found")


@security.requires_access([(permissions.ACTION_CAN_SHOW, permissions.RESOURCE_ROLE_MODEL_VIEW)])
@security.requires_access([(permissions.ACTION_CAN_READ, permissions.RESOURCE_ROLE)])
def get_role(role_name):
"""Get role"""
ab_security_manager = current_app.appbuilder.sm
Expand All @@ -57,7 +57,7 @@ def get_role(role_name):
return role_schema.dump(role)


@security.requires_access([(permissions.ACTION_CAN_LIST, permissions.RESOURCE_ROLE_MODEL_VIEW)])
@security.requires_access([(permissions.ACTION_CAN_READ, permissions.RESOURCE_ROLE)])
@format_parameters({'limit': check_limit})
def get_roles(limit, order_by='name', offset=None):
"""Get roles"""
Expand All @@ -73,7 +73,7 @@ def get_roles(limit, order_by='name', offset=None):
return role_collection_schema.dump(RoleCollection(roles=roles, total_entries=total_entries))


@security.requires_access([(permissions.ACTION_CAN_LIST, permissions.RESOURCE_PERMISSION_MODEL_VIEW)])
@security.requires_access([(permissions.ACTION_CAN_READ, permissions.RESOURCE_PERMISSION)])
@format_parameters({'limit': check_limit})
def get_permissions(limit=None, offset=None):
"""Get permissions"""
Expand All @@ -84,7 +84,7 @@ def get_permissions(limit=None, offset=None):
return action_collection_schema.dump(ActionCollection(actions=actions, total_entries=total_entries))


@security.requires_access([(permissions.ACTION_CAN_DELETE, permissions.RESOURCE_ROLE_MODEL_VIEW)])
@security.requires_access([(permissions.ACTION_CAN_DELETE, permissions.RESOURCE_ROLE)])
def delete_role(role_name):
"""Delete a role"""
ab_security_manager = current_app.appbuilder.sm
Expand All @@ -95,7 +95,7 @@ def delete_role(role_name):
return NoContent, 204


@security.requires_access([(permissions.ACTION_CAN_EDIT, permissions.RESOURCE_ROLE_MODEL_VIEW)])
@security.requires_access([(permissions.ACTION_CAN_EDIT, permissions.RESOURCE_ROLE)])
def patch_role(role_name, update_mask=None):
"""Update a role"""
appbuilder = current_app.appbuilder
Expand Down Expand Up @@ -130,7 +130,7 @@ def patch_role(role_name, update_mask=None):
return role_schema.dump(role)


@security.requires_access([(permissions.ACTION_CAN_ADD, permissions.RESOURCE_ROLE_MODEL_VIEW)])
@security.requires_access([(permissions.ACTION_CAN_CREATE, permissions.RESOURCE_ROLE)])
def post_role():
"""Create a new role"""
appbuilder = current_app.appbuilder
Expand Down
4 changes: 2 additions & 2 deletions airflow/api_connexion/endpoints/user_endpoint.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@
from airflow.security import permissions


@security.requires_access([(permissions.ACTION_CAN_SHOW, permissions.RESOURCE_USER_DB_MODELVIEW)])
@security.requires_access([(permissions.ACTION_CAN_READ, permissions.RESOURCE_USER)])
def get_user(username):
"""Get a user"""
ab_security_manager = current_app.appbuilder.sm
Expand All @@ -39,7 +39,7 @@ def get_user(username):
return user_collection_item_schema.dump(user)


@security.requires_access([(permissions.ACTION_CAN_LIST, permissions.RESOURCE_USER_DB_MODELVIEW)])
@security.requires_access([(permissions.ACTION_CAN_READ, permissions.RESOURCE_USER)])
@format_parameters({'limit': check_limit})
def get_users(limit, order_by='id', offset=None):
"""Get users"""
Expand Down
172 changes: 172 additions & 0 deletions airflow/migrations/versions/a13f7613ad25_resource_based_permissions_for_default_.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,172 @@
#
# Licensed to the Apache Software Foundation (ASF) under one
# or more contributor license agreements. See the NOTICE file
# distributed with this work for additional information
# regarding copyright ownership. The ASF licenses this file
# to you under the Apache License, Version 2.0 (the
# "License"); you may not use this file except in compliance
# with the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing,
# software distributed under the License is distributed on an
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
# KIND, either express or implied. See the License for the
# specific language governing permissions and limitations
# under the License.

"""Resource based permissions for default FAB views.

Revision ID: a13f7613ad25
Revises: e165e7455d70
Create Date: 2021-03-20 21:23:05.793378

"""
import logging

from airflow.security import permissions
from airflow.www.app import create_app

# revision identifiers, used by Alembic.
revision = 'a13f7613ad25'
down_revision = 'e165e7455d70'
branch_labels = None
depends_on = None


mapping = {
("PermissionModelView", "can_list"): [
(permissions.ACTION_CAN_READ, permissions.RESOURCE_PERMISSION),
],
("PermissionViewModelView", "can_list"): [
(permissions.ACTION_CAN_READ, permissions.RESOURCE_PERMISSION_VIEW),

@ephraimbuddy ephraimbuddy Mar 25, 2021

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wondering if there's a mistake here on using RESOURCE_PERMISSION_VIEW?

@ephraimbuddy ephraimbuddy Mar 25, 2021 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah...Got it

],
("ResetMyPasswordView", "can_this_form_get"): [
(permissions.ACTION_CAN_READ, permissions.RESOURCE_MY_PASSWORD),
],
("ResetMyPasswordView", "can_this_form_post"): [
(permissions.ACTION_CAN_EDIT, permissions.RESOURCE_MY_PASSWORD),
],
("ResetPasswordView", "can_this_form_get"): [
(permissions.ACTION_CAN_READ, permissions.RESOURCE_PASSWORD),
],
("ResetPasswordView", "can_this_form_post"): [
(permissions.ACTION_CAN_EDIT, permissions.RESOURCE_PASSWORD),
],
("RoleModelView", "can_delete"): [
(permissions.ACTION_CAN_DELETE, permissions.RESOURCE_ROLE),
],
("RoleModelView", "can_download"): [
(permissions.ACTION_CAN_READ, permissions.RESOURCE_ROLE),
],
("RoleModelView", "can_show"): [
(permissions.ACTION_CAN_READ, permissions.RESOURCE_ROLE),
],
("RoleModelView", "can_list"): [
(permissions.ACTION_CAN_READ, permissions.RESOURCE_ROLE),
],
("RoleModelView", "can_edit"): [
(permissions.ACTION_CAN_EDIT, permissions.RESOURCE_ROLE),
],
("RoleModelView", "can_add"): [
(permissions.ACTION_CAN_CREATE, permissions.RESOURCE_ROLE),
],
("RoleModelView", "can_copyrole"): [
(permissions.ACTION_CAN_CREATE, permissions.RESOURCE_ROLE),
],
("ViewMenuModelView", "can_list"): [
(permissions.ACTION_CAN_READ, permissions.RESOURCE_VIEW_MENU),
],
("UserDBModelView", "can_add"): [
(permissions.ACTION_CAN_CREATE, permissions.RESOURCE_VIEW_MENU),
],
("UserDBModelView", "can_userinfo"): [
(permissions.ACTION_CAN_READ, permissions.RESOURCE_MY_PROFILE),
],
("UserDBModelView", "can_download"): [
(permissions.ACTION_CAN_READ, permissions.RESOURCE_VIEW_MENU),
],
("UserDBModelView", "can_show"): [
(permissions.ACTION_CAN_READ, permissions.RESOURCE_VIEW_MENU),
],
("UserDBModelView", "can_list"): [
(permissions.ACTION_CAN_READ, permissions.RESOURCE_VIEW_MENU),
],
("UserDBModelView", "can_edit"): [
(permissions.ACTION_CAN_EDIT, permissions.RESOURCE_VIEW_MENU),
],
("UserDBModelView", "resetmypassword"): [
(permissions.ACTION_CAN_READ, permissions.RESOURCE_MY_PASSWORD),
],
("UserDBModelView", "resetpasswords"): [
(permissions.ACTION_CAN_READ, permissions.RESOURCE_PASSWORD),
],
("UserDBModelView", "userinfoedit"): [
(permissions.ACTION_CAN_EDIT, permissions.RESOURCE_MY_PROFILE),
],
("UserDBModelView", "can_delete"): [
(permissions.ACTION_CAN_DELETE, permissions.RESOURCE_VIEW_MENU),
],
("UserInfoEditView", "can_this_form_get"): [
(permissions.ACTION_CAN_READ, permissions.RESOURCE_MY_PROFILE),
],
("UserInfoEditView", "can_this_form_post"): [
(permissions.ACTION_CAN_EDIT, permissions.RESOURCE_MY_PROFILE),
],
("UserStatsChartView", "can_chart"): [
(permissions.ACTION_CAN_READ, permissions.RESOURCE_USER_STATS_CHART),
],
("UserLDAPModelView", "can_userinfo"): [
(permissions.ACTION_CAN_READ, permissions.RESOURCE_MY_PROFILE),
],
("UserOAuthModelView", "can_userinfo"): [
(permissions.ACTION_CAN_READ, permissions.RESOURCE_MY_PROFILE),
],
("UserOIDModelView", "can_userinfo"): [
(permissions.ACTION_CAN_READ, permissions.RESOURCE_MY_PROFILE),
],
("UserRemoteUserModelView", "can_userinfo"): [
(permissions.ACTION_CAN_READ, permissions.RESOURCE_MY_PROFILE),
],
("DagRunModelView", "can_clear"): [
(permissions.ACTION_CAN_READ, permissions.RESOURCE_DAG),
(permissions.ACTION_CAN_DELETE, permissions.RESOURCE_TASK_INSTANCE),
],
}


def remap_permissions():
"""Apply Map Airflow view permissions."""
appbuilder = create_app(config={'FAB_UPDATE_PERMS': False}).appbuilder

@ashb ashb Mar 26, 2021

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we also set conf.getboolean('webserver', 'UPDATE_FAB_PERMS'): somehow?

@jhtimmins jhtimmins Apr 12, 2021

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ashb What would be the purpose of that?

@ashb ashb Apr 12, 2021

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I honestly couldn't tell you anymore.

for old, new in mapping.items():
(old_view_name, old_perm_name) = old
old_pvm = appbuilder.sm.find_permission_view_menu(old_perm_name, old_view_name)
if not old_pvm:
continue
for new_perm_name, new_view_name in new:
new_pvm = appbuilder.sm.add_permission_view_menu(new_perm_name, new_view_name)
for role in appbuilder.sm.get_all_roles():
if appbuilder.sm.exist_permission_on_roles(old_view_name, old_perm_name, [role.id]):
appbuilder.sm.add_permission_role(role, new_pvm)
appbuilder.sm.del_permission_role(role, old_pvm)
appbuilder.sm.del_permission_view_menu(old_perm_name, old_view_name)

if not appbuilder.sm.find_permission(old_perm_name):
continue
view_menus = appbuilder.sm.get_all_view_menu()
if not any(appbuilder.sm.find_permission_view_menu(old_perm_name, view.name) for view in view_menus):
appbuilder.sm.del_permission(old_perm_name)


def upgrade():
"""Apply Resource based permissions."""
log = logging.getLogger()
handlers = log.handlers[:]
remap_permissions()
log.handlers = handlers


def downgrade():
"""Unapply Resource based permissions."""
pass
28 changes: 11 additions & 17 deletions airflow/security/permissions.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
RESOURCE_BROWSE_MENU = "Browse"
RESOURCE_DAG = "DAGs"
RESOURCE_DAG_PREFIX = "DAG:"
RESOURCE_LOGIN = "Logins"
RESOURCE_DOCS_MENU = "Docs"
RESOURCE_DOCS = "Documentation"
RESOURCE_CONFIG = "Configurations"
Expand All @@ -30,38 +31,31 @@
RESOURCE_DAG_RUN = "DAG Runs"
RESOURCE_IMPORT_ERROR = "ImportError"
RESOURCE_JOB = "Jobs"
RESOURCE_MY_PASSWORD = "My Password"
RESOURCE_MY_PROFILE = "My Profile"
RESOURCE_PASSWORD = "Passwords"
RESOURCE_PERMISSION = "Permissions"
RESOURCE_PERMISSION_VIEW = "Permission Views" # Refers to a Perm <-> View mapping, not an MVC View.
RESOURCE_POOL = "Pools"
RESOURCE_PLUGIN = "Plugins"
RESOURCE_ROLE = "Roles"
RESOURCE_SLA_MISS = "SLA Misses"
RESOURCE_TASK_INSTANCE = "Task Instances"
RESOURCE_TASK_LOG = "Task Logs"
RESOURCE_TASK_RESCHEDULE = "Task Reschedules"
RESOURCE_USER = "Users"
RESOURCE_USER_STATS_CHART = "User Stats Chart"
RESOURCE_VARIABLE = "Variables"
RESOURCE_VIEW_MENU = "View Menus"
RESOURCE_WEBSITE = "Website"
RESOURCE_XCOM = "XComs"
RESOURCE_USERINFO_EDIT_VIEW = "UserInfoEditView"
RESOURCE_RESET_MY_PASSWORD_VIEW = "ResetMyPasswordView"
RESOURCE_USER_DB_MODELVIEW = "UserDBModelView"
RESOURCE_USER_OID_MODELVIEW = "UserOIDModelView"
RESOURCE_USER_LDAP_MODELVIEW = "UserLDAPModelView"
RESOURCE_USER_OAUTH_MODELVIEW = "UserOAuthModelView"
RESOURCE_USER_REMOTEUSER_MODELVIEW = "UserRemoteUserModelView"
RESOURCE_ROLE_MODEL_VIEW = "RoleModelView"
RESOURCE_PERMISSION_MODEL_VIEW = "PermissionModelView"


# Action Constants
ACTION_CAN_ADD = "can_add"
ACTION_CAN_LIST = "can_list"
ACTION_CAN_SHOW = "can_show"
ACTION_CAN_CREATE = "can_create"
ACTION_CAN_READ = "can_read"
ACTION_CAN_EDIT = "can_edit"
ACTION_CAN_DELETE = "can_delete"
ACTION_CAN_ACCESS_MENU = "menu_access"
ACTION_CAN_THIS_FORM_GET = "can_this_form_get"
ACTION_CAN_THIS_FORM_POST = "can_this_form_post"
ACTION_RESETMYPASSWORD = "resetmypassword"
ACTION_CAN_USERINFO = "can_userinfo"
ACTION_USERINFOEDIT = "userinfoedit"
DEPRECATED_ACTION_CAN_DAG_READ = "can_dag_read"
DEPRECATED_ACTION_CAN_DAG_EDIT = "can_dag_edit"
Loading