Skip to content

Check team permissions on bulk APIs for Connections, Variables and Pools#67293

Open
vincbeck wants to merge 1 commit into
apache:mainfrom
aws-mwaa:vincbeck/bulk_teams
Open

Check team permissions on bulk APIs for Connections, Variables and Pools#67293
vincbeck wants to merge 1 commit into
apache:mainfrom
aws-mwaa:vincbeck/bulk_teams

Conversation

@vincbeck
Copy link
Copy Markdown
Contributor

@vincbeck vincbeck commented May 21, 2026

When creating/updating connections, variables or pools through the bulk API, we currently no not check whether the user has access to team passed in the request body. Adding it now.


Was generative AI tooling used to co-author this PR?
  • Yes (please specify the tool below)
    Claude

  • Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
  • For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
  • When adding dependency, check compliance with the ASF 3rd Party License Policy.
  • For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.

elif action.action == BulkAction.CREATE:
teams.add(entity_team_name)
if action.action_on_existence == BulkActionOnExistence.OVERWRITE:
teams.add(existing_team_name)
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think existing_team_name will always be None here. The callers build the team mapping dict from a list that's filtered with if action.action != BulkAction.CREATE (e.g., line 449 for pools), which excludes all CREATE actions, including CREATE-with-overwrite. So the .get() call that populates existing_team_name never finds the key.

I believe the filters for pools, connections and variables need to also include CREATE-with-overwrite entities, something like:

if action.action != BulkAction.CREATE or action.action_on_existence == BulkActionOnExistence.OVERWRITE

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:API Airflow's REST/HTTP API

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants