Fix some docs and test gaps following up multi team secret refusal

providers/amazon/tests/unit/amazon/aws/secrets/test_systems_manager.py

@@ -31,6 +31,8 @@
 
 from tests_common.test_utils.config import conf_vars
 
+multi_team_enabled = conf_vars({("core", "multi_team"): "True"})
+
 URI_CONNECTION = pytest.param(
     "postgres://my-login:my-pass@my-host:5432/my-schema?param1=val1&param2=val2", id="uri-connection"
 )
@@ -116,7 +118,7 @@ def test_get_conn_value_with_team_name(self):
         returned_uri = ssm_backend.get_conn_value(conn_id="test_postgres", team_name="my_team")
         assert returned_uri == "postgresql://airflow:airflow@host:5432/airflow"
 
-    @conf_vars({("core", "multi_team"): "True"})
+    @multi_team_enabled
     @mock_aws
     def test_global_caller_cannot_access_team_scoped_connection(self):
         param = {
@@ -128,7 +130,7 @@ def test_global_caller_cannot_access_team_scoped_connection(self):
         ssm_backend.client.put_parameter(**param)
         assert ssm_backend.get_conn_value(conn_id="my_team--test_postgres") is None
 
-    @conf_vars({("core", "multi_team"): "True"})
+    @multi_team_enabled
     @mock_aws
     def test_another_teams_secret_is_not_reachable(self):
         """A caller scoped to one team must not reach another team's parameter by naming it."""
@@ -142,7 +144,7 @@ def test_another_teams_secret_is_not_reachable(self):
 
         assert ssm_backend.get_conn_value(conn_id="my_team--test_postgres", team_name="other_team") is None
 
-    @conf_vars({("core", "multi_team"): "True"})
+    @multi_team_enabled
     @mock_aws
     def test_team_whose_name_extends_the_callers_is_not_reachable(self):
         """A prefix match on the caller's own namespace is not proof of ownership."""
@@ -156,7 +158,7 @@ def test_team_whose_name_extends_the_callers_is_not_reachable(self):
 
         assert ssm_backend.get_conn_value(conn_id="my_team--prod--test_postgres", team_name="my_team") is None
 
-    @conf_vars({("core", "multi_team"): "True"})
+    @multi_team_enabled
     @mock_aws
     def test_team_scoped_lookup_cannot_reach_a_longer_teams_namespace(self):
         """The team scoped name is not safe by construction -- the id can extend it.
@@ -176,7 +178,7 @@ def test_team_scoped_lookup_cannot_reach_a_longer_teams_namespace(self):
 
         assert ssm_backend.get_conn_value(conn_id="prod--test_postgres", team_name="my_team") is None
 
-    @conf_vars({("core", "multi_team"): "True"})
+    @multi_team_enabled
     @mock_aws
     def test_refusing_an_ambiguous_id_is_logged(self, caplog):
         """A silent ``None`` is indistinguishable from a missing secret, so the refusal is logged.
@@ -288,7 +290,7 @@ def test_get_variable_with_team_name(self):
 
         assert ssm_backend.get_variable(key="hello", team_name="my_team") == "world"
 
-    @conf_vars({("core", "multi_team"): "True"})
+    @multi_team_enabled
     @mock_aws
     def test_global_caller_cannot_access_team_scoped_variable(self):
         param = {"Name": "/airflow/variables/my_team--hello", "Type": "String", "Value": "world"}

providers/google/docs/secrets-backends/google-cloud-secret-manager-backend.rst

@@ -233,8 +233,12 @@ secret. Avoid ``--`` in connection ids and variable keys.
 
 .. warning::
 
-    This refusal applies whether or not you use teams. If you already store a connection or
-    variable whose id contains ``--``, it stops resolving after upgrading and you must rename it.
+    This refusal only applies when ``[core] multi_team`` is enabled — with multi-team support
+    off, no team-scoped name can exist for a ``--``-containing id to collide with, so it resolves
+    normally. If you already store a connection or variable whose id contains ``--``, it keeps
+    working until multi-team support is enabled, at which point it silently stops resolving (a
+    warning is logged, but lookups do not raise) instead of raising outright. Check for ids
+    containing ``--`` before turning on ``multi_team``.
 
 ``get_config`` is not team-scoped and is unaffected by any of the above.
 

providers/microsoft/azure/tests/unit/microsoft/azure/secrets/test_key_vault.py

@@ -235,6 +235,10 @@ def test_ambiguous_id_resolves_when_multi_team_is_disabled(self, mock_client):
         assert backend.get_variable("prod__hello") == "world"
         assert backend.get_config("prod--sql_alchemy_conn") == "world"
 
+        mock_client.get_secret.assert_any_call(name="airflow-connections-prod--my-db")
+        mock_client.get_secret.assert_any_call(name="airflow-variables-prod--hello")
+        mock_client.get_secret.assert_any_call(name="airflow-config-prod--sql-alchemy-conn")
+
     @mock.patch(f"{KEY_VAULT_MODULE}.AzureKeyVaultBackend._get_secret")
     def test_variable_prefix_none_value(self, mock_get_secret):
         """