Custom FAB actions no longer work

[jedcunningham]

Apache Airflow version

2.9.0

If "Other Airflow 2 version" selected, which one?

No response

What happened?

Before the auth manager/FAB transition in 2.9.0, plugins were able to include custom actions. This no longer works:

[2024-04-19T21:24:50.050+0000] {app.py:1744} ERROR - Exception on /testappbuilderbaseview/ [GET]                                                             
Traceback (most recent call last):                                                                                                                           
  File "/home/airflow/.local/lib/python3.12/site-packages/flask/app.py", line 2529, in wsgi_app                                                              
    response = self.full_dispatch_request()                                                                                                                  
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^                                                                                                                  
  File "/home/airflow/.local/lib/python3.12/site-packages/flask/app.py", line 1825, in full_dispatch_request                                                 
    rv = self.handle_user_exception(e)                                                                                                                       
         ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^                                                                                                                       
  File "/home/airflow/.local/lib/python3.12/site-packages/flask/app.py", line 1823, in full_dispatch_request                                                 
    rv = self.dispatch_request()                                                                                                                             
         ^^^^^^^^^^^^^^^^^^^^^^^                                                                                                                             
  File "/home/airflow/.local/lib/python3.12/site-packages/flask/app.py", line 1799, in dispatch_request                                                      
    return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args)                                                                                 
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^                                                                                 
  File "/home/airflow/.local/lib/python3.12/site-packages/airflow/providers/fab/auth_manager/decorators/auth.py", line 118, in decorated                     
    is_authorized=appbuilder.sm.check_authorization(permissions, dag_id),                                                                                    
                  ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^                                                                                     
  File "/home/airflow/.local/lib/python3.12/site-packages/airflow/providers/fab/auth_manager/security_manager/override.py", line 2305, in check_authorization
    elif not self.has_access(*perm):                                                                                                                         
             ^^^^^^^^^^^^^^^^^^^^^^                                                                                                                          
  File "/home/airflow/.local/lib/python3.12/site-packages/airflow/www/security_manager.py", line 142, in has_access                                          
    return is_authorized_method(action_name, resource_pk, user)                                                                                              
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^                                                                                              
  File "/home/airflow/.local/lib/python3.12/site-packages/airflow/www/security_manager.py", line 340, in <lambda>                                            
    method=get_method_from_fab_action_map()[action],                                                                                                         
           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^                                                                                                          
KeyError: 'can_do'                                                                                                                                           

What you think should happen instead?

Custom actions should continue to function.

How to reproduce

This is a simple plugin that reproduces the issue:

from airflow.plugins_manager import AirflowPlugin
from airflow.www.auth import has_access
from flask_appbuilder import expose, BaseView as AppBuilderBaseView


class TestAppBuilderBaseView(AppBuilderBaseView):
    default_view = "test"
    base_permissions = ['can_do']

    @expose("/")
    @has_access(
        [
            ("can_do", "TestAppBuilderBaseView"),
        ]
    )
    def test(self):
        return "hello"


v_appbuilder_view = TestAppBuilderBaseView()
v_appbuilder_package = {
    "name": "Test View",
    "category": "Test Plugin",
    "view": v_appbuilder_view,
}

class AirflowTestPlugin(AirflowPlugin):
    name = "test_plugin"
    appbuilder_views = [v_appbuilder_package]

Note that users with the new action + resource perm still face the above traceback.

Operating System

Debian (official image)

Versions of Apache Airflow Providers

apache-airflow-providers-fab==1.0.2

Deployment

Official Apache Airflow Helm Chart

Deployment details

No response

Anything else?

No response

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[potiuk]

CC: @vincbeck

[vincbeck]

I see the issue ... I hate plugins ... I'll work on a fix

[vincbeck]

#39167

[tagoad]

is there a workaround for this until the fix is deployed? I can't run my dev environment locally

[vincbeck]

Besides removing the @has_access from the view you defined in your plugin, I dont see any. I am not saying this is something you should do. It really depends on your setup and who has access to your Airflow environment. By removing @has_access from a view, you let anyone has access to this page

[TJaniF]

is there a workaround for this until the fix is deployed? I can't run my dev environment locally

If you are referring to the Astro CLI local environment you can set AIRFLOW__ASTRONOMER__UPDATE_CHECK_INTERVAL=0 as a workaround (this works for the base Astro CLI, if you have custom plugins you would additionally have to implement the fix @vincbeck mentioned).

[jedcunningham]

#39167 doesn't appear to actually fix this. PR incoming.