apache-airflow-providers-fab 2.0.2rc2__tar.gz → 2.1.0rc1__tar.gz

{apache_airflow_providers_fab-2.0.2rc2 → apache_airflow_providers_fab-2.1.0rc1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: apache-airflow-providers-fab
-Version: 2.0.2rc2
+Version: 2.1.0rc1
 Summary: Provider package apache-airflow-providers-fab for Apache Airflow
 Keywords: airflow-provider,fab,airflow,integration
 Author-email: Apache Software Foundation <dev@airflow.apache.org>
@@ -22,11 +22,11 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: System :: Monitoring
 License-File: 3rd-party-licenses/LICENSES-ui.txt
 License-File: NOTICE
-Requires-Dist: apache-airflow>=3.0.0rc1
+Requires-Dist: apache-airflow>=3.0.2rc1
 Requires-Dist: apache-airflow-providers-common-compat>=1.2.1rc1
 Requires-Dist: blinker>=1.6.2
 Requires-Dist: flask>=2.2.1,<2.3
-Requires-Dist: flask-appbuilder==4.5.3
+Requires-Dist: flask-appbuilder==4.6.3
 Requires-Dist: flask-login>=0.6.2
 Requires-Dist: flask-session>=0.4.0,<0.6
 Requires-Dist: flask-wtf>=1.1.0
@@ -36,8 +36,8 @@ Requires-Dist: werkzeug>=2.2,<4
 Requires-Dist: wtforms>=3.0,<4
 Requires-Dist: kerberos>=1.3.0 ; extra == "kerberos"
 Project-URL: Bug Tracker, https://github.com/apache/airflow/issues
-Project-URL: Changelog, https://airflow.apache.org/docs/apache-airflow-providers-fab/2.0.2/changelog.html
-Project-URL: Documentation, https://airflow.apache.org/docs/apache-airflow-providers-fab/2.0.2
+Project-URL: Changelog, https://airflow.staged.apache.org/docs/apache-airflow-providers-fab/2.1.0/changelog.html
+Project-URL: Documentation, https://airflow.staged.apache.org/docs/apache-airflow-providers-fab/2.1.0
 Project-URL: Mastodon, https://fosstodon.org/@airflow
 Project-URL: Slack Chat, https://s.apache.org/airflow-slack
 Project-URL: Source Code, https://github.com/apache/airflow
@@ -69,7 +69,7 @@ Provides-Extra: kerberos
 
 Package ``apache-airflow-providers-fab``
 
-Release: ``2.0.2``
+Release: ``2.1.0``
 
 
 `Flask App Builder <https://flask-appbuilder.readthedocs.io/>`__
@@ -82,7 +82,7 @@ This is a provider package for ``fab`` provider. All classes for this provider p
 are in ``airflow.providers.fab`` python package.
 
 You can find package information and changelog for the provider
-in the `documentation <https://airflow.apache.org/docs/apache-airflow-providers-fab/2.0.2/>`_.
+in the `documentation <https://airflow.apache.org/docs/apache-airflow-providers-fab/2.1.0/>`_.
 
 Installation
 ------------
@@ -99,11 +99,11 @@ Requirements
 ==========================================  ==================
 PIP package                                 Version required
 ==========================================  ==================
-``apache-airflow``                          ``>=3.0.0``
+``apache-airflow``                          ``>=3.0.2``
 ``apache-airflow-providers-common-compat``  ``>=1.2.1``
 ``blinker``                                 ``>=1.6.2``
 ``flask``                                   ``>=2.2.1,<2.3``
-``flask-appbuilder``                        ``==4.5.3``
+``flask-appbuilder``                        ``==4.6.3``
 ``flask-login``                             ``>=0.6.2``
 ``flask-session``                           ``>=0.4.0,<0.6``
 ``flask-wtf``                               ``>=1.1.0``
@@ -133,5 +133,5 @@ Dependent package
 ==================================================================================================================  =================
 
 The changelog for the provider package can be found in the
-`changelog <https://airflow.apache.org/docs/apache-airflow-providers-fab/2.0.2/changelog.html>`_.
+`changelog <https://airflow.apache.org/docs/apache-airflow-providers-fab/2.1.0/changelog.html>`_.
 

{apache_airflow_providers_fab-2.0.2rc2 → apache_airflow_providers_fab-2.1.0rc1}/README.rst

@@ -23,7 +23,7 @@
 
 Package ``apache-airflow-providers-fab``
 
-Release: ``2.0.2``
+Release: ``2.1.0``
 
 
 `Flask App Builder <https://flask-appbuilder.readthedocs.io/>`__
@@ -36,7 +36,7 @@ This is a provider package for ``fab`` provider. All classes for this provider p
 are in ``airflow.providers.fab`` python package.
 
 You can find package information and changelog for the provider
-in the `documentation <https://airflow.apache.org/docs/apache-airflow-providers-fab/2.0.2/>`_.
+in the `documentation <https://airflow.apache.org/docs/apache-airflow-providers-fab/2.1.0/>`_.
 
 Installation
 ------------
@@ -53,11 +53,11 @@ Requirements
 ==========================================  ==================
 PIP package                                 Version required
 ==========================================  ==================
-``apache-airflow``                          ``>=3.0.0``
+``apache-airflow``                          ``>=3.0.2``
 ``apache-airflow-providers-common-compat``  ``>=1.2.1``
 ``blinker``                                 ``>=1.6.2``
 ``flask``                                   ``>=2.2.1,<2.3``
-``flask-appbuilder``                        ``==4.5.3``
+``flask-appbuilder``                        ``==4.6.3``
 ``flask-login``                             ``>=0.6.2``
 ``flask-session``                           ``>=0.4.0,<0.6``
 ``flask-wtf``                               ``>=1.1.0``
@@ -87,4 +87,4 @@ Dependent package
 ==================================================================================================================  =================
 
 The changelog for the provider package can be found in the
-`changelog <https://airflow.apache.org/docs/apache-airflow-providers-fab/2.0.2/changelog.html>`_.
+`changelog <https://airflow.apache.org/docs/apache-airflow-providers-fab/2.1.0/changelog.html>`_.

{apache_airflow_providers_fab-2.0.2rc2 → apache_airflow_providers_fab-2.1.0rc1}/docs/auth-manager/webserver-authentication.rst

@@ -232,15 +232,15 @@ Here is an example of what you might have in your webserver_config.py:
 
 .. code-block:: python
 
-  import os
-  import jwt
-  import requests
   import logging
   from base64 import b64decode
+
+  import jwt
+  import requests
   from cryptography.hazmat.primitives import serialization
-  from flask_appbuilder.security.manager import AUTH_DB, AUTH_OAUTH
-  from airflow import configuration as conf
-  from airflow.www.security import AirflowSecurityManager
+  from flask_appbuilder.security.manager import AUTH_OAUTH
+
+  from airflow.providers.fab.auth_manager.security_manager.override import FabAirflowSecurityManagerOverride
 
   log = logging.getLogger(__name__)
 
@@ -284,11 +284,11 @@ Here is an example of what you might have in your webserver_config.py:
   public_key = serialization.load_der_public_key(key_der)
 
 
-  class CustomSecurityManager(AirflowSecurityManager):
+  class CustomSecurityManager(FabAirflowSecurityManagerOverride):
       def get_oauth_user_info(self, provider, response):
           if provider == "keycloak":
               token = response["access_token"]
-              me = jwt.decode(token, public_key, algorithms=["HS256", "RS256"])
+              me = jwt.decode(token, public_key, algorithms=["HS256", "RS256"], audience="account")
 
               # Extract roles from resource access
               realm_access = me.get("realm_access", {})

{apache_airflow_providers_fab-2.0.2rc2 → apache_airflow_providers_fab-2.1.0rc1}/docs/changelog.rst

@@ -20,6 +20,36 @@
 Changelog
 ---------
 
+2.1.0
+.....
+
+Features
+~~~~~~~~
+
+* ``Add back ProxyFix Middleware for flask app builder (#49942)``
+* ``Move access_denied_message webserver config to fab (#50208)``
+* ``Move webserver expose_hostname config to fab (#50269)``
+
+Misc
+~~~~
+
+* ``Bump the fab-ui-package-updates group across 1 directory with 4 updates (#50312)``
+* ``Bump the fab-ui-package-updates group across 1 directory with 4 updates (#50035)``
+* ``Upgrade 'flask-appbuilder' to 4.6.3 in FAB provider (#50513)``
+
+Doc-only
+~~~~~~~~
+
+* ``docs: Update oauth keycloak example with new security manager (#50284)``
+* ``docs: conditionally render section‐move links in sections‐and‐options include (#50582)``
+
+.. Below changes are excluded from the changelog. Move them to
+   appropriate section above if needed. Do not delete the lines(!):
+   * ``Update description of provider.yaml dependencies (#50231)``
+   * ``Avoid committing history for providers (#49907)``
+   * ``Fix main - Generate FAB assets (#50546)``
+   * ``Fix Fab docs (#50594)``
+
 2.0.2
 .....
 

apache_airflow_providers_fab-2.1.0rc1/docs/commits.rst

@@ -0,0 +1,35 @@
+
+ .. Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.  See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership.  The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License.  You may obtain a copy of the License at
+
+ ..   http://www.apache.org/licenses/LICENSE-2.0
+
+ .. Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied.  See the License for the
+    specific language governing permissions and limitations
+    under the License.
+
+ .. NOTE! THIS FILE IS AUTOMATICALLY GENERATED AND WILL BE OVERWRITTEN!
+
+ .. IF YOU WANT TO MODIFY THIS FILE, YOU SHOULD MODIFY THE TEMPLATE
+    `PROVIDER_COMMITS_TEMPLATE.rst.jinja2` IN the `dev/breeze/src/airflow_breeze/templates` DIRECTORY
+
+ .. THE REMAINDER OF THE FILE IS AUTOMATICALLY GENERATED. IT WILL BE OVERWRITTEN!
+
+Package apache-airflow-providers-fab
+------------------------------------------------------
+
+`Flask App Builder <https://flask-appbuilder.readthedocs.io/>`__
+
+
+This is detailed commit list of changes for versions provider package: ``fab``.
+For high-level changelog, see :doc:`package information including changelog <index>`.
+
+.. airflow-providers-commits::

{apache_airflow_providers_fab-2.0.2rc2 → apache_airflow_providers_fab-2.1.0rc1}/docs/configurations-ref.rst

@@ -16,4 +16,6 @@
     under the License.
 
 .. include:: /../../../devel-common/src/sphinx_exts/includes/providers-configurations-ref.rst
+
+
 .. include:: /../../../devel-common/src/sphinx_exts/includes/sections-and-options.rst

{apache_airflow_providers_fab-2.0.2rc2 → apache_airflow_providers_fab-2.1.0rc1}/docs/index.rst

@@ -84,7 +84,7 @@ apache-airflow-providers-fab package
 `Flask App Builder <https://flask-appbuilder.readthedocs.io/>`__
 
 
-Release: 2.0.2
+Release: 2.1.0
 
 Provider package
 ----------------
@@ -102,16 +102,16 @@ For the minimum Airflow version supported, see ``Requirements`` below.
 Requirements
 ------------
 
-The minimum Apache Airflow version supported by this provider distribution is ``3.0.0``.
+The minimum Apache Airflow version supported by this provider distribution is ``3.0.2``.
 
 ==========================================  ==================
 PIP package                                 Version required
 ==========================================  ==================
-``apache-airflow``                          ``>=3.0.0``
+``apache-airflow``                          ``>=3.0.2``
 ``apache-airflow-providers-common-compat``  ``>=1.2.1``
 ``blinker``                                 ``>=1.6.2``
 ``flask``                                   ``>=2.2.1,<2.3``
-``flask-appbuilder``                        ``==4.5.3``
+``flask-appbuilder``                        ``==4.6.3``
 ``flask-login``                             ``>=0.6.2``
 ``flask-session``                           ``>=0.4.0,<0.6``
 ``flask-wtf``                               ``>=1.1.0``
@@ -146,5 +146,5 @@ Downloading official packages
 You can download officially released packages and verify their checksums and signatures from the
 `Official Apache Download site <https://downloads.apache.org/airflow/providers/>`_
 
-* `The apache-airflow-providers-fab 2.0.2 sdist package <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.0.2.tar.gz>`_ (`asc <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.0.2.tar.gz.asc>`__, `sha512 <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.0.2.tar.gz.sha512>`__)
-* `The apache-airflow-providers-fab 2.0.2 wheel package <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.0.2-py3-none-any.whl>`_ (`asc <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.0.2-py3-none-any.whl.asc>`__, `sha512 <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.0.2-py3-none-any.whl.sha512>`__)
+* `The apache-airflow-providers-fab 2.1.0 sdist package <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.1.0.tar.gz>`_ (`asc <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.1.0.tar.gz.asc>`__, `sha512 <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.1.0.tar.gz.sha512>`__)
+* `The apache-airflow-providers-fab 2.1.0 wheel package <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.1.0-py3-none-any.whl>`_ (`asc <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.1.0-py3-none-any.whl.asc>`__, `sha512 <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.1.0-py3-none-any.whl.sha512>`__)

{apache_airflow_providers_fab-2.0.2rc2 → apache_airflow_providers_fab-2.1.0rc1}/provider.yaml

@@ -28,10 +28,14 @@ description: |
 # For providers until we think it should be released.
 state: ready
 
-source-date-epoch: 1745478857
+source-date-epoch: 1747132761
 
-# note that those versions are maintained by release manager - do not update them manually
+# Note that those versions are maintained by release manager - do not update them manually
+# with the exception of case where other provider in sources has >= new provider version.
+# In such case adding >= NEW_VERSION and bumping to NEW_VERSION in a provider have
+# to be done in the same PR
 versions:
+  - 2.1.0
   - 2.0.2
   - 2.0.1
   - 2.0.0
@@ -56,6 +60,20 @@ config:
   fab:
     description: This section contains configs specific to FAB provider.
     options:
+      access_denied_message:
+        description: |
+          The message displayed when a user attempts to execute actions beyond their authorised privileges.
+        version_added: 2.1.0
+        type: string
+        example: ~
+        default: "Access is Denied"
+      expose_hostname:
+        description: |
+          Expose hostname in the web server
+        version_added: 2.1.0
+        type: string
+        example: ~
+        default: "False"
       auth_rate_limited:
         description: |
           Boolean for enabling rate limiting on authentication endpoints.
@@ -119,6 +137,58 @@ config:
         type: integer
         example: ~
         default: "43200"
+      enable_proxy_fix:
+        description: |
+          Enable werkzeug ``ProxyFix`` middleware for reverse proxy
+        version_added: 2.1.0
+        type: boolean
+        example: ~
+        default: "False"
+      proxy_fix_x_for:
+        description: |
+          Number of values to trust for ``X-Forwarded-For``.
+          See `Werkzeug: X-Forwarded-For Proxy Fix
+          <https://werkzeug.palletsprojects.com/en/2.3.x/middleware/proxy_fix/>`__ for more details.
+        version_added: 2.1.0
+        type: integer
+        example: ~
+        default: "1"
+      proxy_fix_x_proto:
+        description: |
+          Number of values to trust for ``X-Forwarded-Proto``.
+          See `Werkzeug: X-Forwarded-For Proxy Fix
+          <https://werkzeug.palletsprojects.com/en/2.3.x/middleware/proxy_fix/>`__ for more details.
+        version_added: 2.1.0
+        type: integer
+        example: ~
+        default: "1"
+      proxy_fix_x_host:
+        description: |
+          Number of values to trust for ``X-Forwarded-Host``.
+          See `Werkzeug: X-Forwarded-For Proxy Fix
+          <https://werkzeug.palletsprojects.com/en/2.3.x/middleware/proxy_fix/>`__ for more details.
+        version_added: 2.1.0
+        type: integer
+        example: ~
+        default: "1"
+      proxy_fix_x_port:
+        description: |
+          Number of values to trust for ``X-Forwarded-Port``.
+          See `Werkzeug: X-Forwarded-For Proxy Fix
+          <https://werkzeug.palletsprojects.com/en/2.3.x/middleware/proxy_fix/>`__ for more details.
+        version_added: 2.1.0
+        type: integer
+        example: ~
+        default: "1"
+      proxy_fix_x_prefix:
+        description: |
+          Number of values to trust for ``X-Forwarded-Prefix``.
+          See `Werkzeug: X-Forwarded-For Proxy Fix
+          <https://werkzeug.palletsprojects.com/en/2.3.x/middleware/proxy_fix/>`__ for more details.
+        version_added: 2.1.0
+        type: integer
+        example: ~
+        default: "1"
 
 auth-managers:
   - airflow.providers.fab.auth_manager.fab_auth_manager.FabAuthManager

{apache_airflow_providers_fab-2.0.2rc2 → apache_airflow_providers_fab-2.1.0rc1}/pyproject.toml

@@ -25,7 +25,7 @@ build-backend = "flit_core.buildapi"
 
 [project]
 name = "apache-airflow-providers-fab"
-version = "2.0.2rc2"
+version = "2.1.0rc1"
 description = "Provider package apache-airflow-providers-fab for Apache Airflow"
 readme = "README.rst"
 authors = [
@@ -57,7 +57,7 @@ license-files = ["NOTICE", "*/LICENSE*"]
 # Make sure to run ``breeze static-checks --type update-providers-dependencies --all-files``
 # After you modify the dependencies, and rebuild your Breeze CI image with ``breeze ci-image build``
 dependencies = [
-    "apache-airflow>=3.0.0rc1",
+    "apache-airflow>=3.0.2rc1",
     "apache-airflow-providers-common-compat>=1.2.1rc1",
     # Blinker use for signals in Flask, this is an optional dependency in Flask 2.2 and lower.
     # In Flask 2.3 it becomes a mandatory dependency, and flask signals are always available.
@@ -71,7 +71,7 @@ dependencies = [
     # Every time we update FAB version here, please make sure that you review the classes and models in
     # `airflow/providers/fab/auth_manager/security_manager/override.py` with their upstream counterparts.
     # In particular, make sure any breaking changes, for example any new methods, are accounted for.
-    "flask-appbuilder==4.5.3",
+    "flask-appbuilder==4.6.3",
     "flask-login>=0.6.2",
     # Flask-Session 0.6 add new arguments into the SqlAlchemySessionInterface constructor as well as
     # all parameters now are mandatory which make AirflowDatabaseSessionInterface incompatible with this version.
@@ -127,8 +127,8 @@ apache-airflow-providers-common-sql = {workspace = true}
 apache-airflow-providers-standard = {workspace = true}
 
 [project.urls]
-"Documentation" = "https://airflow.apache.org/docs/apache-airflow-providers-fab/2.0.2"
-"Changelog" = "https://airflow.apache.org/docs/apache-airflow-providers-fab/2.0.2/changelog.html"
+"Documentation" = "https://airflow.staged.apache.org/docs/apache-airflow-providers-fab/2.1.0"
+"Changelog" = "https://airflow.staged.apache.org/docs/apache-airflow-providers-fab/2.1.0/changelog.html"
 "Bug Tracker" = "https://github.com/apache/airflow/issues"
 "Source Code" = "https://github.com/apache/airflow"
 "Slack Chat" = "https://s.apache.org/airflow-slack"

{apache_airflow_providers_fab-2.0.2rc2 → apache_airflow_providers_fab-2.1.0rc1}/src/airflow/providers/fab/__init__.py

@@ -29,11 +29,11 @@ from airflow import __version__ as airflow_version
 
 __all__ = ["__version__"]
 
-__version__ = "2.0.2"
+__version__ = "2.1.0"
 
 if packaging.version.parse(packaging.version.parse(airflow_version).base_version) < packaging.version.parse(
-    "3.0.0"
+    "3.0.2"
 ):
     raise RuntimeError(
-        f"The package `apache-airflow-providers-fab:{__version__}` needs Apache Airflow 3.0.0+"
+        f"The package `apache-airflow-providers-fab:{__version__}` needs Apache Airflow 3.0.2+"
     )

{apache_airflow_providers_fab-2.0.2rc2 → apache_airflow_providers_fab-2.1.0rc1}/src/airflow/providers/fab/auth_manager/api_endpoints/role_and_permission_endpoint.py

@@ -123,6 +123,8 @@ def patch_role(*, role_name: str, update_mask: UpdateMask = None) -> APIResponse
     """Update a role."""
     security_manager = cast("FabAuthManager", get_auth_manager()).security_manager
     body = request.json
+    if body is None:
+        raise BadRequest("Request body is required")
     try:
         data = role_schema.load(body)
     except ValidationError as err:
@@ -156,6 +158,8 @@ def post_role() -> APIResponse:
     """Create a new role."""
     security_manager = cast("FabAuthManager", get_auth_manager()).security_manager
     body = request.json
+    if body is None:
+        raise BadRequest("Request body is required")
     try:
         data = role_schema.load(body)
     except ValidationError as err:

{apache_airflow_providers_fab-2.0.2rc2 → apache_airflow_providers_fab-2.1.0rc1}/src/airflow/providers/fab/auth_manager/api_endpoints/user_endpoint.py

@@ -88,6 +88,8 @@ def get_users(*, limit: int, order_by: str = "id", offset: str | None = None) ->
 @requires_access_custom_view("POST", permissions.RESOURCE_USER)
 def post_user() -> APIResponse:
     """Create a new user."""
+    if request.json is None:
+        raise BadRequest("Request body is required")
     try:
         data = user_schema.load(request.json)
     except ValidationError as e:
@@ -131,6 +133,8 @@ def post_user() -> APIResponse:
 @requires_access_custom_view("PUT", permissions.RESOURCE_USER)
 def patch_user(*, username: str, update_mask: UpdateMask = None) -> APIResponse:
     """Update a user."""
+    if request.json is None:
+        raise BadRequest("Request body is required")
     try:
         data = user_schema.load(request.json)
     except ValidationError as e:

{apache_airflow_providers_fab-2.0.2rc2 → apache_airflow_providers_fab-2.1.0rc1}/src/airflow/providers/fab/auth_manager/models/__init__.py

@@ -102,11 +102,37 @@ assoc_permission_role = Table(
     "ab_permission_view_role",
     Model.metadata,
     Column("id", Integer, primary_key=True),
-    Column("permission_view_id", Integer, ForeignKey("ab_permission_view.id")),
-    Column("role_id", Integer, ForeignKey("ab_role.id")),
+    Column(
+        "permission_view_id",
+        Integer,
+        ForeignKey("ab_permission_view.id", ondelete="CASCADE"),
+    ),
+    Column("role_id", Integer, ForeignKey("ab_role.id", ondelete="CASCADE")),
     UniqueConstraint("permission_view_id", "role_id"),
 )
 
+assoc_user_group = Table(
+    "ab_user_group",
+    Model.metadata,
+    Column("id", Integer, primary_key=True),
+    Column("user_id", Integer, ForeignKey("ab_user.id", ondelete="CASCADE")),
+    Column("group_id", Integer, ForeignKey("ab_group.id", ondelete="CASCADE")),
+    UniqueConstraint("user_id", "group_id"),
+    Index("idx_user_id", "user_id"),
+    Index("idx_user_group_id", "group_id"),
+)
+
+assoc_group_role = Table(
+    "ab_group_role",
+    Model.metadata,
+    Column("id", Integer, primary_key=True),
+    Column("group_id", Integer, ForeignKey("ab_group.id", ondelete="CASCADE")),
+    Column("role_id", Integer, ForeignKey("ab_role.id", ondelete="CASCADE")),
+    UniqueConstraint("group_id", "role_id"),
+    Index("idx_group_id", "group_id"),
+    Index("idx_group_role_id", "role_id"),
+)
+
 
 class Role(Model):
     """Represents a user role to which permissions can be assigned."""
@@ -115,7 +141,29 @@ class Role(Model):
 
     id = Column(Integer, primary_key=True)
     name = Column(String(64), unique=True, nullable=False)
-    permissions = relationship("Permission", secondary=assoc_permission_role, backref="role", lazy="joined")
+    permissions = relationship(
+        "Permission",
+        secondary=assoc_permission_role,
+        backref="role",
+        lazy="joined",
+        passive_deletes=True,
+    )
+
+    def __repr__(self):
+        return self.name
+
+
+class Group(Model):
+    """Represents a user group."""
+
+    __tablename__ = "ab_group"
+
+    id = Column(Integer, primary_key=True)
+    name = Column(String(100), unique=True, nullable=False)
+    label = Column(String(150))
+    description = Column(String(512))
+    users = relationship("User", secondary=assoc_user_group, backref="groups", passive_deletes=True)
+    roles = relationship("Role", secondary=assoc_group_role, backref="groups", passive_deletes=True)
 
     def __repr__(self):
         return self.name
@@ -148,8 +196,8 @@ assoc_user_role = Table(
     "ab_user_role",
     Model.metadata,
     Column("id", Integer, primary_key=True),
-    Column("user_id", Integer, ForeignKey("ab_user.id")),
-    Column("role_id", Integer, ForeignKey("ab_role.id")),
+    Column("user_id", Integer, ForeignKey("ab_user.id", ondelete="CASCADE")),
+    Column("role_id", Integer, ForeignKey("ab_role.id", ondelete="CASCADE")),
     UniqueConstraint("user_id", "role_id"),
 )
 
@@ -170,7 +218,9 @@ class User(Model, BaseUser):
     last_login = Column(DateTime)
     login_count = Column(Integer)
     fail_login_count = Column(Integer)
-    roles = relationship("Role", secondary=assoc_user_role, backref="user", lazy="selectin")
+    roles = relationship(
+        "Role", secondary=assoc_user_role, backref="user", lazy="selectin", passive_deletes=True
+    )
     created_on = Column(DateTime, default=datetime.datetime.now, nullable=True)
     changed_on = Column(DateTime, default=datetime.datetime.now, nullable=True)
 

{apache_airflow_providers_fab-2.0.2rc2 → apache_airflow_providers_fab-2.1.0rc1}/src/airflow/providers/fab/auth_manager/models/anonymous_user.py

@@ -37,13 +37,17 @@ class AnonymousUser(AnonymousUserMixin, BaseUser):
         if not self._roles:
             public_role = current_app.config.get("AUTH_ROLE_PUBLIC", None)
             self._roles = {current_app.appbuilder.sm.find_role(public_role)} if public_role else set()
-        return self._roles
+        return list(self._roles)
 
     @roles.setter
     def roles(self, roles):
         self._roles = roles
         self._perms = set()
 
+    @property
+    def groups(self):
+        return []
+
     @property
     def perms(self):
         if not self._perms: