FAB: fix 403 from roles endpoint despite admin rights - #64097
Merged
Conversation
Widen `_MAP_METHOD_NAME_TO_FAB_ACTION_NAME` from `dict[ExtendedResourceMethod, str]` to `dict[str, str]` and add a `"PATCH" -> ACTION_CAN_EDIT` entry so that PATCH endpoints resolve to the correct FAB permission without extending the auth-model enums. Closes: apache#59510
…ag_ids The PATCH→can_edit entry added in 839e2e9 broke get_authorized_dag_ids for PUT requests. The method used the *reverse* map (action→method) to match permissions, but reversing a many-to-one map (PUT and PATCH both map to can_edit) silently dropped PUT in favour of PATCH. Switch to the forward map instead: look up the FAB action for the incoming HTTP method once, then compare directly against each permission's action name. This is both correct for aliased methods and simpler.
eladkal
changed the title
eladkal
approved these changes
Mar 23, 2026
Dev-iL
changed the title
vincbeck
approved these changes
Mar 23, 2026
aaron-y-chen
pushed a commit
to aaron-y-chen/airflow
that referenced
this pull request
Mar 30, 2026
* fix(providers/fab): map PATCH to can_edit in FAB action map Widen `_MAP_METHOD_NAME_TO_FAB_ACTION_NAME` from `dict[ExtendedResourceMethod, str]` to `dict[str, str]` and add a `"PATCH" -> ACTION_CAN_EDIT` entry so that PATCH endpoints resolve to the correct FAB permission without extending the auth-model enums. Closes: apache#59510 * fix(providers/fab): use forward method→action map in get_authorized_dag_ids The PATCH→can_edit entry added in 839e2e9 broke get_authorized_dag_ids for PUT requests. The method used the *reverse* map (action→method) to match permissions, but reversing a many-to-one map (PUT and PATCH both map to can_edit) silently dropped PUT in favour of PATCH. Switch to the forward map instead: look up the FAB action for the incoming HTTP method once, then compare directly against each permission's action name. This is both correct for aliased methods and simpler. --------- Co-authored-by: Yoann Abriel <yoann.abriel@gmail.com>
Suraj-kumar00
pushed a commit
to Suraj-kumar00/airflow
that referenced
this pull request
Apr 7, 2026
* fix(providers/fab): map PATCH to can_edit in FAB action map Widen `_MAP_METHOD_NAME_TO_FAB_ACTION_NAME` from `dict[ExtendedResourceMethod, str]` to `dict[str, str]` and add a `"PATCH" -> ACTION_CAN_EDIT` entry so that PATCH endpoints resolve to the correct FAB permission without extending the auth-model enums. Closes: apache#59510 * fix(providers/fab): use forward method→action map in get_authorized_dag_ids The PATCH→can_edit entry added in 839e2e9 broke get_authorized_dag_ids for PUT requests. The method used the *reverse* map (action→method) to match permissions, but reversing a many-to-one map (PUT and PATCH both map to can_edit) silently dropped PUT in favour of PATCH. Switch to the forward map instead: look up the FAB action for the incoming HTTP method once, then compare directly against each permission's action name. This is both correct for aliased methods and simpler. --------- Co-authored-by: Yoann Abriel <yoann.abriel@gmail.com>
abhijeets25012-tech
pushed a commit
to abhijeets25012-tech/airflow
that referenced
this pull request
Apr 9, 2026
* fix(providers/fab): map PATCH to can_edit in FAB action map Widen `_MAP_METHOD_NAME_TO_FAB_ACTION_NAME` from `dict[ExtendedResourceMethod, str]` to `dict[str, str]` and add a `"PATCH" -> ACTION_CAN_EDIT` entry so that PATCH endpoints resolve to the correct FAB permission without extending the auth-model enums. Closes: apache#59510 * fix(providers/fab): use forward method→action map in get_authorized_dag_ids The PATCH→can_edit entry added in 839e2e9 broke get_authorized_dag_ids for PUT requests. The method used the *reverse* map (action→method) to match permissions, but reversing a many-to-one map (PUT and PATCH both map to can_edit) silently dropped PUT in favour of PATCH. Switch to the forward map instead: look up the FAB action for the incoming HTTP method once, then compare directly against each permission's action name. This is both correct for aliased methods and simpler. --------- Co-authored-by: Yoann Abriel <yoann.abriel@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR addresses the CI failures in the approved version of #63359.
related: #63359
closes: #59510
Was generative AI tooling used to co-author this PR?
Generated-by: Claude Opus 4.6 following the guidelines
{pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.