Repository navigation
Custom FAB actions no longer work #39144
Description
Apache Airflow version
2.9.0
If "Other Airflow 2 version" selected, which one?
No response
What happened?
Before the auth manager/FAB transition in 2.9.0, plugins were able to include custom actions. This no longer works:
[2024-04-19T21:24:50.050+0000] {app.py:1744} ERROR - Exception on /testappbuilderbaseview/ [GET]
Traceback (most recent call last):
File "/home/airflow/.local/lib/python3.12/site-packages/flask/app.py", line 2529, in wsgi_app
response = self.full_dispatch_request()
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/airflow/.local/lib/python3.12/site-packages/flask/app.py", line 1825, in full_dispatch_request
rv = self.handle_user_exception(e)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/airflow/.local/lib/python3.12/site-packages/flask/app.py", line 1823, in full_dispatch_request
rv = self.dispatch_request()
^^^^^^^^^^^^^^^^^^^^^^^
File "/home/airflow/.local/lib/python3.12/site-packages/flask/app.py", line 1799, in dispatch_request
return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/airflow/.local/lib/python3.12/site-packages/airflow/providers/fab/auth_manager/decorators/auth.py", line 118, in decorated
is_authorized=appbuilder.sm.check_authorization(permissions, dag_id),
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/airflow/.local/lib/python3.12/site-packages/airflow/providers/fab/auth_manager/security_manager/override.py", line 2305, in check_authorization
elif not self.has_access(*perm):
^^^^^^^^^^^^^^^^^^^^^^
File "/home/airflow/.local/lib/python3.12/site-packages/airflow/www/security_manager.py", line 142, in has_access
return is_authorized_method(action_name, resource_pk, user)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/airflow/.local/lib/python3.12/site-packages/airflow/www/security_manager.py", line 340, in <lambda>
method=get_method_from_fab_action_map()[action],
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^
KeyError: 'can_do'
What you think should happen instead?
Custom actions should continue to function.
How to reproduce
This is a simple plugin that reproduces the issue:
from airflow.plugins_manager import AirflowPlugin
from airflow.www.auth import has_access
from flask_appbuilder import expose, BaseView as AppBuilderBaseView
class TestAppBuilderBaseView(AppBuilderBaseView):
default_view = "test"
base_permissions = ['can_do']
@expose("/")
@has_access(
[
("can_do", "TestAppBuilderBaseView"),
]
)
def test(self):
return "hello"
v_appbuilder_view = TestAppBuilderBaseView()
v_appbuilder_package = {
"name": "Test View",
"category": "Test Plugin",
"view": v_appbuilder_view,
}
class AirflowTestPlugin(AirflowPlugin):
name = "test_plugin"
appbuilder_views = [v_appbuilder_package]
Note that users with the new action + resource perm still face the above traceback.
Operating System
Debian (official image)
Versions of Apache Airflow Providers
apache-airflow-providers-fab==1.0.2
Deployment
Official Apache Airflow Helm Chart
Deployment details
No response
Anything else?
No response
Are you willing to submit PR?
- Yes I am willing to submit a PR!
Code of Conduct
- I agree to follow this project's Code of Conduct
Activity
potiuk commentedon Apr 20, 2024
CC: @vincbeck
vincbeck commentedon Apr 22, 2024
I see the issue ... I hate plugins ... I'll work on a fix
vincbeck commentedon Apr 22, 2024
#39167
tagoad commentedon May 1, 2024
is there a workaround for this until the fix is deployed? I can't run my dev environment locally
vincbeck commentedon May 1, 2024
Besides removing the
@has_accessfrom the view you defined in your plugin, I dont see any. I am not saying this is something you should do. It really depends on your setup and who has access to your Airflow environment. By removing@has_accessfrom a view, you let anyone has access to this pageTJaniF commentedon May 1, 2024
If you are referring to the Astro CLI local environment you can set
AIRFLOW__ASTRONOMER__UPDATE_CHECK_INTERVAL=0as a workaround (this works for the base Astro CLI, if you have custom plugins you would additionally have to implement the fix @vincbeck mentioned).jedcunningham commentedon May 5, 2024
#39167 doesn't appear to actually fix this. PR incoming.