Add REPARSE_ALL permission for reparsing files with no registered Dag - #73274
Merged
pierrejeambrun merged 2 commits intoSep 17, 2026
Merged
Conversation
Reparsing a file that has no registered Dag needs a permission of its own: such a file has no per-Dag key to authorize the reparse against, and the existing IMPORT_ERRORS_ALL view only governs seeing those errors. Gating the reparse action on that view would let anyone who can view an error also trigger its reparse. A dedicated admin-by-default, team-scoped permission keeps seeing and acting separate. It is consumed by a follow-up that adds reparse of unregistered files from the UI.
1 task
pierrejeambrun
marked this pull request as ready for review
September 17, 2026 10:49
This PR extends the common-compat access-view shim with REPARSE_ALL, which the FAB auth manager consumes, so FAB needs the upcoming common-compat release. The "# use next version" marker records that intent and satisfies the provider dependency CI guard that fires when common-compat changes alongside a provider.
vincbeck
approved these changes
Sep 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reparsing a file that failed to import before defining any Dag has no per-Dag key to authorize against. Viewing such a file's import error is already gated on the dedicated
IMPORT_ERRORS_ALLview; reparsing it is a distinct action, and gating a write on a view permission would let anyone who can see the error also trigger the reparse.This adds a dedicated
AccessView.REPARSE_ALL-- admin-granted by default, and scoped per team via the file's bundle where the auth manager supports multi-team isolation -- mirroringIMPORT_ERRORS_ALL(#69790).AccessView.REPARSE_ALL.Adminby default (All Reparsesresource). Keycloak and Amazon authorize views generically, so they need no change.related: #69790
Was generative AI tooling used to co-author this PR?
Generated-by: Claude Code (Opus 4.8) following the guidelines