Skip to content

Commit 142f12b

Browse files
CyberNativeAICyberNativeAI
authored
Update remaining FAB Website permissions rows for Airflow 3 (#74653)
1 parent 1461ddf commit 142f12b

1 file changed

Lines changed: 37 additions & 41 deletions

File tree

‎providers/fab/docs/auth-manager/access-control.rst‎

Lines changed: 37 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -822,92 +822,88 @@ Website Permissions
822822
Action Permissions Minimum Role
823823
====================================== ======================================================================= ============
824824
Access homepage Website.can_read Viewer
825-
Show Browse menu Browse.menu_access Viewer
826825
Show Dags menu Dags.menu_access Viewer
827826
Get Dag stats Dags.can_read, Dag Runs.can_read Viewer
828-
Show Task Instances menu Task Instances.menu_access Viewer
829827
Get Task stats Dags.can_read, Dag Runs.can_read, Task Instances.can_read Viewer
830828
Get last Dag runs Dags.can_read, Dag Runs.can_read Viewer
831829
Get Dag code Dags.can_read, Dag Code.can_read Viewer
832830
Get Dag details Dags.can_read, Dag Runs.can_read Viewer
833-
Show Dag Dependencies menu Dag Dependencies.menu_access Viewer
834-
Get Dag Dependencies Dag Dependencies.can_read Viewer
835-
Get rendered Dag Dags.can_read, Task Instances.can_read Viewer
836-
Get Logs with metadata Dags.can_read, Task Instances.can_read, Task Logs.can_read Viewer
837-
Get Log Dags.can_read, Task Instances.can_read, Task Logs.can_read Viewer
838-
Redirect to external Log Dags.can_read, Task Instances.can_read, Task Logs.can_read Viewer
831+
Get Dag Dependencies Dags.can_read, Dag Dependencies.can_read Viewer
832+
Get rendered Dag Dags.can_read, Dag Runs.can_read, Task Instances.can_read Viewer
833+
Get Logs with metadata Dags.can_read, Dag Runs.can_read, Task Instances.can_read, Viewer
834+
Task Logs.can_read
835+
Get Log Dags.can_read, Dag Runs.can_read, Task Instances.can_read, Viewer
836+
Task Logs.can_read
837+
Redirect to external Log Dags.can_read, Dag Runs.can_read, Task Instances.can_read, Viewer
838+
Task Logs.can_read
839839
Get Task Dags.can_read, Task Instances.can_read Viewer
840840
Show XCom menu XComs.menu_access Op
841841
Get XCom Dags.can_read, Task Instances.can_read, XComs.can_read Viewer
842-
Create XCom XComs.can_create Op
843-
Delete XCom XComs.can_delete Op
844-
Triggers Task Instance Dags.can_edit, Task Instances.can_create User
842+
Create XCom Dags.can_edit, XComs.can_create Op
843+
Delete XCom Dags.can_edit, XComs.can_delete Op
845844
Delete Dag Dags.can_delete User
846-
Show Dag Runs menu Dag Runs.menu_access Viewer
847845
Trigger Dag run Dags.can_edit, Dag Runs.can_create User
848-
Clear Dag Dags.can_edit, Task Instances.can_delete User
849-
Clear Dag Run Dags.can_edit, Task Instances.can_delete User
846+
Clear Dag Dags.can_edit, Dag Runs.can_edit, Task Instances.can_edit User
847+
Clear Dag Run Dags.can_edit, Dag Runs.can_edit User
850848
Mark Dag Run as failed DAGS.can_edit, Dag Runs.can_edit User
851849
Mark Dag Run as success DAGS.can_edit, Dag Runs.can_edit User
852-
Mark Task as failed Dags.can_edit, Task Instances.can_edit User
853-
Mark Task as success Dags.can_edit, Task Instances.can_edit User
850+
Mark Task as failed Dags.can_edit, Dag Runs.can_edit, Task Instances.can_edit User
851+
Mark Task as success Dags.can_edit, Dag Runs.can_edit, Task Instances.can_edit User
854852
Get Dag as grid Dags.can_read, Dag Runs.can_read, Task Instances.can_read Viewer
855853
Get Dag as graph Dags.can_read, Dag Runs.can_read, Task Instances.can_read, Viewer
856854
Dag Dependencies.can_read
857855
Get Dag as duration graph Dags.can_read, Dag Runs.can_read, Task Instances.can_read Viewer
858856
Show all tries Dags.can_read, Dag Runs.can_read, Task Instances.can_read Viewer
859857
Toggle Dag paused status Dags.can_edit User
860858
Show Gantt Chart Dags.can_read, Dag Runs.can_read, Task Instances.can_read Viewer
861-
Get external links Dags.can_read, Task Instances.can_read Viewer
862-
Show Task Instances Dags.can_read, Task Instances.can_read Viewer
859+
Get external links Dags.can_read, Dag Runs.can_read, Task Instances.can_read Viewer
860+
Show Task Instances Dags.can_read, Dag Runs.can_read, Task Instances.can_read Viewer
863861
Show Configurations menu Configurations.menu_access Op
864-
Show Configs Configurations.can_read Viewer
862+
Show Configs Configurations.can_read Op
865863
Delete multiple records Dags.can_edit User
866-
Set Task Instance as running Dags.can_edit User
867-
Set Task Instance as success Dags.can_edit User
868-
Set Task Instance as up_for_retry Dags.can_edit User
864+
Set Task Instance as success Dags.can_edit, Dag Runs.can_edit, Task Instances.can_edit User
869865
Autocomplete Dags.can_read Viewer
870866
Show Asset menu Assets.menu_access Viewer
871867
Show Assets Assets.can_read Viewer
872-
Show Docs menu Docs.menu_access Viewer
873-
Show Documentation menu Documentation.menu_access Viewer
868+
Show REST API Reference link Documentation.menu_access Viewer
874869
Show Jobs menu Jobs.menu_access Viewer
875-
Show Audit Log Audit Logs.menu_access Viewer
870+
Show Audit Log Audit Logs.menu_access Admin
876871
Reset Password My Password.can_read, My Password.can_edit Viewer
877-
Show Permissions menu Permission Views.menu_access Admin
872+
Show Permissions menu Permission Pairs.menu_access Admin
878873
List Permissions Permission Views.can_read Admin
879874
Get My Profile My Profile.can_read Viewer
880875
Update My Profile My Profile.can_edit Viewer
881-
List Logs Audit Logs.can_read Viewer
876+
List Logs Dags.can_read, Audit Logs.can_read Admin
882877
List Jobs Jobs.can_read Viewer
883-
List Plugins Plugins.can_read Viewer
884-
Show Plugins menu Plugins.menu_access Viewer
878+
List Plugins Plugins.can_read Op
879+
Show Plugins menu Plugins.menu_access Op
885880
Show Providers menu Providers.menu_access Op
886881
List Providers Providers.can_read Op
887-
List Task Reschedules Task Reschedules.can_read Admin
888-
Show Triggers menu Triggers.menu_access Admin
889-
List Triggers Triggers.can_read Admin
890-
Show Admin menu Admin.menu_access Viewer
891882
Show Connections menu Connections.menu_access Op
892-
Show Pools menu Pools.menu_access Viewer
883+
Show Pools menu Pools.menu_access Op
893884
Show Variables menu Variables.menu_access Op
894-
Show Roles menu Roles.menu_access Admin
885+
Show Roles menu List Roles.menu_access Admin
895886
List Roles Roles.can_read Admin
896887
Create Roles Roles.can_create Admin
897888
Update Roles Roles.can_edit Admin
898889
Delete Roles Roles.can_delete Admin
899-
Show Users menu Users.menu_access Admin
890+
Show Users menu List Users.menu_access Admin
900891
Create Users Users.can_create Admin
901892
Update Users Users.can_edit Admin
902893
Delete Users Users.can_delete Admin
903894
Reset user Passwords Passwords.can_edit, Passwords.can_read Admin
904895
====================================== ======================================================================= ============
905896

906-
The Grid, Graph and Gantt views, the duration charts and the list of task tries check
907-
Dag Runs.can_read and Task Instances.can_read on the resources themselves. A Dag-specific
908-
``DAG Run:example_dag_id.can_read`` permission does not replace Dag Runs.can_read for these
909-
views. Granting these permissions does not expose other Dags, because the Dag-level check
910-
(``DAGs.can_read`` or ``DAG:example_dag_id.can_read``) still applies.
897+
The Grid, Graph and Gantt views, the duration charts, the list of task tries, the Task Instances
898+
list and the task instance pages (logs, rendered templates and external links) check
899+
Dag Runs.can_read and Task Instances.can_read on the resources themselves. Marking or clearing
900+
task instances checks Dag Runs.can_edit and Task Instances.can_edit in the same way. A
901+
Dag-specific ``DAG Run:example_dag_id`` permission does not replace these Dag Runs permissions.
902+
Granting these permissions does not expose other Dags, because the Dag-level check (for example
903+
``DAGs.can_read`` or ``DAG:example_dag_id.can_read``) still applies.
904+
905+
The Browse and Admin menus have no permission of their own. They show the entries that the
906+
user has permissions for. The Docs menu is shown to all users.
911907

912908
These Dag-level controls can be set directly through the UI / CLI, or encoded in the dags themselves through the access_control arg.
913909

0 commit comments

Comments
 (0)