apache-airflow-providers-fab 2.4.2__tar.gz → 2.4.3rc1__tar.gz

{apache_airflow_providers_fab-2.4.2 → apache_airflow_providers_fab-2.4.3rc1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: apache-airflow-providers-fab
-Version: 2.4.2
+Version: 2.4.3rc1
 Summary: Provider package apache-airflow-providers-fab for Apache Airflow
 Keywords: airflow-provider,fab,airflow,integration
 Author-email: Apache Software Foundation <dev@airflow.apache.org>
@@ -21,8 +21,8 @@ Classifier: Programming Language :: Python :: 3.12
 Classifier: Topic :: System :: Monitoring
 License-File: 3rd-party-licenses/LICENSES-ui.txt
 License-File: NOTICE
-Requires-Dist: apache-airflow>=3.0.2
-Requires-Dist: apache-airflow-providers-common-compat>=1.2.1
+Requires-Dist: apache-airflow>=3.0.2rc1
+Requires-Dist: apache-airflow-providers-common-compat>=1.2.1rc1
 Requires-Dist: blinker>=1.6.2; python_version < '3.13'
 Requires-Dist: flask>=2.2.1,<2.3; python_version < '3.13'
 Requires-Dist: flask-appbuilder==4.6.3; python_version < '3.13'
@@ -33,10 +33,11 @@ Requires-Dist: connexion[flask]>=2.14.2,<3.0; python_version < '3.13'
 Requires-Dist: jmespath>=0.7.0; python_version < '3.13'
 Requires-Dist: werkzeug>=2.2,<4; python_version < '3.13'
 Requires-Dist: wtforms>=3.0,<4; python_version < '3.13'
+Requires-Dist: flask_limiter>3,<4,!=3.13
 Requires-Dist: kerberos>=1.3.0 ; extra == "kerberos" and ( python_version < '3.13')
 Project-URL: Bug Tracker, https://github.com/apache/airflow/issues
-Project-URL: Changelog, https://airflow.apache.org/docs/apache-airflow-providers-fab/2.4.2/changelog.html
-Project-URL: Documentation, https://airflow.apache.org/docs/apache-airflow-providers-fab/2.4.2
+Project-URL: Changelog, https://airflow.staged.apache.org/docs/apache-airflow-providers-fab/2.4.3/changelog.html
+Project-URL: Documentation, https://airflow.staged.apache.org/docs/apache-airflow-providers-fab/2.4.3
 Project-URL: Mastodon, https://fosstodon.org/@airflow
 Project-URL: Slack Chat, https://s.apache.org/airflow-slack
 Project-URL: Source Code, https://github.com/apache/airflow
@@ -68,7 +69,7 @@ Provides-Extra: kerberos
 
 Package ``apache-airflow-providers-fab``
 
-Release: ``2.4.2``
+Release: ``2.4.3``
 
 
 `Flask App Builder <https://flask-appbuilder.readthedocs.io/>`__
@@ -81,7 +82,7 @@ This is a provider package for ``fab`` provider. All classes for this provider p
 are in ``airflow.providers.fab`` python package.
 
 You can find package information and changelog for the provider
-in the `documentation <https://airflow.apache.org/docs/apache-airflow-providers-fab/2.4.2/>`_.
+in the `documentation <https://airflow.apache.org/docs/apache-airflow-providers-fab/2.4.3/>`_.
 
 Installation
 ------------
@@ -110,6 +111,7 @@ PIP package                                 Version required
 ``jmespath``                                ``>=0.7.0; python_version < "3.13"``
 ``werkzeug``                                ``>=2.2,<4; python_version < "3.13"``
 ``wtforms``                                 ``>=3.0,<4; python_version < "3.13"``
+``flask_limiter``                           ``>3,!=3.13,<4``
 ==========================================  ==========================================
 
 Cross provider package dependencies
@@ -131,6 +133,15 @@ Dependent package
 `apache-airflow-providers-common-compat <https://airflow.apache.org/docs/apache-airflow-providers-common-compat>`_  ``common.compat``
 ==================================================================================================================  =================
 
+Optional dependencies
+----------------------
+
+============  ============================================
+Extra         Dependencies
+============  ============================================
+``kerberos``  ``kerberos>=1.3.0; python_version < '3.13'``
+============  ============================================
+
 The changelog for the provider package can be found in the
-`changelog <https://airflow.apache.org/docs/apache-airflow-providers-fab/2.4.2/changelog.html>`_.
+`changelog <https://airflow.apache.org/docs/apache-airflow-providers-fab/2.4.3/changelog.html>`_.
 

{apache_airflow_providers_fab-2.4.2 → apache_airflow_providers_fab-2.4.3rc1}/README.rst

@@ -23,7 +23,7 @@
 
 Package ``apache-airflow-providers-fab``
 
-Release: ``2.4.2``
+Release: ``2.4.3``
 
 
 `Flask App Builder <https://flask-appbuilder.readthedocs.io/>`__
@@ -36,7 +36,7 @@ This is a provider package for ``fab`` provider. All classes for this provider p
 are in ``airflow.providers.fab`` python package.
 
 You can find package information and changelog for the provider
-in the `documentation <https://airflow.apache.org/docs/apache-airflow-providers-fab/2.4.2/>`_.
+in the `documentation <https://airflow.apache.org/docs/apache-airflow-providers-fab/2.4.3/>`_.
 
 Installation
 ------------
@@ -65,6 +65,7 @@ PIP package                                 Version required
 ``jmespath``                                ``>=0.7.0; python_version < "3.13"``
 ``werkzeug``                                ``>=2.2,<4; python_version < "3.13"``
 ``wtforms``                                 ``>=3.0,<4; python_version < "3.13"``
+``flask_limiter``                           ``>3,!=3.13,<4``
 ==========================================  ==========================================
 
 Cross provider package dependencies
@@ -86,5 +87,14 @@ Dependent package
 `apache-airflow-providers-common-compat <https://airflow.apache.org/docs/apache-airflow-providers-common-compat>`_  ``common.compat``
 ==================================================================================================================  =================
 
+Optional dependencies
+----------------------
+
+============  ============================================
+Extra         Dependencies
+============  ============================================
+``kerberos``  ``kerberos>=1.3.0; python_version < '3.13'``
+============  ============================================
+
 The changelog for the provider package can be found in the
-`changelog <https://airflow.apache.org/docs/apache-airflow-providers-fab/2.4.2/changelog.html>`_.
+`changelog <https://airflow.apache.org/docs/apache-airflow-providers-fab/2.4.3/changelog.html>`_.

{apache_airflow_providers_fab-2.4.2 → apache_airflow_providers_fab-2.4.3rc1}/docs/changelog.rst

@@ -20,6 +20,28 @@
 Changelog
 ---------
 
+2.4.3
+.....
+
+
+Release Date: ``|PypiReleaseDate|``
+
+Bug Fixes
+~~~~~~~~~
+
+* ``Fix: Clean up FAB permissions when deleting DAGs (#54528)``
+
+Misc
+~~~~
+
+* ``Bump stylelint from 16.23.1 to 16.24.0 in /providers/fab/src/airflow/providers/fab/www in the fab-ui-package-updates group across 1 directory (#55382)``
+* ``Remove SDK dependency from SerializedDAG (#55538)``
+* ``Set flask_limiter>3,<4,!=3.13 (#55592)``
+* ``Bump the fab-ui-package-updates group across 1 directory with 3 updates (#55302)``
+
+.. Below changes are excluded from the changelog. Move them to
+   appropriate section above if needed. Do not delete the lines(!):
+
 2.4.2
 .....
 

{apache_airflow_providers_fab-2.4.2 → apache_airflow_providers_fab-2.4.3rc1}/docs/index.rst

@@ -84,7 +84,7 @@ apache-airflow-providers-fab package
 `Flask App Builder <https://flask-appbuilder.readthedocs.io/>`__
 
 
-Release: 2.4.2
+Release: 2.4.3
 
 Provider package
 ----------------
@@ -119,6 +119,7 @@ PIP package                                 Version required
 ``jmespath``                                ``>=0.7.0; python_version < "3.13"``
 ``werkzeug``                                ``>=2.2,<4; python_version < "3.13"``
 ``wtforms``                                 ``>=3.0,<4; python_version < "3.13"``
+``flask_limiter``                           ``>3,!=3.13,<4``
 ==========================================  ==========================================
 
 Cross provider package dependencies
@@ -146,5 +147,5 @@ Downloading official packages
 You can download officially released packages and verify their checksums and signatures from the
 `Official Apache Download site <https://downloads.apache.org/airflow/providers/>`_
 
-* `The apache-airflow-providers-fab 2.4.2 sdist package <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.4.2.tar.gz>`_ (`asc <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.4.2.tar.gz.asc>`__, `sha512 <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.4.2.tar.gz.sha512>`__)
-* `The apache-airflow-providers-fab 2.4.2 wheel package <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.4.2-py3-none-any.whl>`_ (`asc <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.4.2-py3-none-any.whl.asc>`__, `sha512 <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.4.2-py3-none-any.whl.sha512>`__)
+* `The apache-airflow-providers-fab 2.4.3 sdist package <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.4.3.tar.gz>`_ (`asc <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.4.3.tar.gz.asc>`__, `sha512 <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.4.3.tar.gz.sha512>`__)
+* `The apache-airflow-providers-fab 2.4.3 wheel package <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.4.3-py3-none-any.whl>`_ (`asc <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.4.3-py3-none-any.whl.asc>`__, `sha512 <https://downloads.apache.org/airflow/providers/apache_airflow_providers_fab-2.4.3-py3-none-any.whl.sha512>`__)

{apache_airflow_providers_fab-2.4.2 → apache_airflow_providers_fab-2.4.3rc1}/provider.yaml

@@ -28,13 +28,14 @@ description: |
 # For providers until we think it should be released.
 state: ready
 
-source-date-epoch: 1756876838
+source-date-epoch: 1757950286
 
 # Note that those versions are maintained by release manager - do not update them manually
 # with the exception of case where other provider in sources has >= new provider version.
 # In such case adding >= NEW_VERSION and bumping to NEW_VERSION in a provider have
 # to be done in the same PR
 versions:
+  - 2.4.3
   - 2.4.2
   - 2.4.1
   - 2.4.0

{apache_airflow_providers_fab-2.4.2 → apache_airflow_providers_fab-2.4.3rc1}/pyproject.toml

@@ -25,7 +25,7 @@ build-backend = "flit_core.buildapi"
 
 [project]
 name = "apache-airflow-providers-fab"
-version = "2.4.2"
+version = "2.4.3rc1"
 description = "Provider package apache-airflow-providers-fab for Apache Airflow"
 readme = "README.rst"
 authors = [
@@ -56,8 +56,8 @@ license-files = ["NOTICE", "*/LICENSE*"]
 # Make sure to run ``prek update-providers-dependencies --all-files``
 # After you modify the dependencies, and rebuild your Breeze CI image with ``breeze ci-image build``
 dependencies = [
-    "apache-airflow>=3.0.2",
-    "apache-airflow-providers-common-compat>=1.2.1",
+    "apache-airflow>=3.0.2rc1",
+    "apache-airflow-providers-common-compat>=1.2.1rc1",
     # Blinker use for signals in Flask, this is an optional dependency in Flask 2.2 and lower.
     # In Flask 2.3 it becomes a mandatory dependency, and flask signals are always available.
     "blinker>=1.6.2; python_version < '3.13'",
@@ -80,6 +80,10 @@ dependencies = [
     "jmespath>=0.7.0; python_version < '3.13'",
     "werkzeug>=2.2,<4; python_version < '3.13'",
     "wtforms>=3.0,<4; python_version < '3.13'",
+
+    # https://github.com/dpgaspar/Flask-AppBuilder/blob/release/4.6.3/setup.py#L54C8-L54C26
+    # with an exclusion to account for https://github.com/alisaifee/flask-limiter/issues/479
+    "flask_limiter>3,<4,!=3.13",
 ]
 
 # The optional dependencies should be modified in place in the generated file
@@ -126,8 +130,8 @@ apache-airflow-providers-common-sql = {workspace = true}
 apache-airflow-providers-standard = {workspace = true}
 
 [project.urls]
-"Documentation" = "https://airflow.apache.org/docs/apache-airflow-providers-fab/2.4.2"
-"Changelog" = "https://airflow.apache.org/docs/apache-airflow-providers-fab/2.4.2/changelog.html"
+"Documentation" = "https://airflow.staged.apache.org/docs/apache-airflow-providers-fab/2.4.3"
+"Changelog" = "https://airflow.staged.apache.org/docs/apache-airflow-providers-fab/2.4.3/changelog.html"
 "Bug Tracker" = "https://github.com/apache/airflow/issues"
 "Source Code" = "https://github.com/apache/airflow"
 "Slack Chat" = "https://s.apache.org/airflow-slack"

{apache_airflow_providers_fab-2.4.2 → apache_airflow_providers_fab-2.4.3rc1}/src/airflow/providers/fab/__init__.py

@@ -29,7 +29,7 @@ from airflow import __version__ as airflow_version
 
 __all__ = ["__version__"]
 
-__version__ = "2.4.2"
+__version__ = "2.4.3"
 
 if packaging.version.parse(packaging.version.parse(airflow_version).base_version) < packaging.version.parse(
     "3.0.2"

{apache_airflow_providers_fab-2.4.2 → apache_airflow_providers_fab-2.4.3rc1}/src/airflow/providers/fab/auth_manager/cli_commands/definition.py

@@ -108,6 +108,14 @@ ARG_INCLUDE_DAGS = Arg(
     ("--include-dags",), help="If passed, DAG specific permissions will also be synced.", action="store_true"
 )
 
+# permissions cleanup
+ARG_DRY_RUN = Arg(
+    ("--dry-run",), help="Show what would be cleaned up without making any changes.", action="store_true"
+)
+ARG_DAG_ID_OPTIONAL = Arg(
+    ("-d", "--dag-id"), help="Optional: Clean up permissions for specific DAG ID only", type=str
+)
+
 ################
 # # COMMANDS # #
 ################
@@ -253,6 +261,30 @@ SYNC_PERM_COMMAND = ActionCommand(
     args=(ARG_INCLUDE_DAGS, ARG_VERBOSE),
 )
 
+PERMISSIONS_CLEANUP_COMMAND = ActionCommand(
+    name="permissions-cleanup",
+    help="Clean up DAG permissions in Flask-AppBuilder tables",
+    description=(
+        "Clean up DAG-specific permissions. By default, cleans up orphaned permissions "
+        "for deleted DAGs. Use --dag-id to clean up permissions for a specific DAG."
+    ),
+    func=lazy_load_command(
+        "airflow.providers.fab.auth_manager.cli_commands.permissions_command.permissions_cleanup"
+    ),
+    args=(ARG_DAG_ID_OPTIONAL, ARG_DRY_RUN, ARG_YES, ARG_VERBOSE),
+    epilog=(
+        "examples:\n"
+        "To see what orphaned permissions would be cleaned up:\n"
+        "    $ airflow fab-auth-manager permissions-cleanup --dry-run\n"
+        "To clean up all orphaned permissions:\n"
+        "    $ airflow fab-auth-manager permissions-cleanup\n"
+        "To clean up permissions for specific DAG:\n"
+        "    $ airflow fab-auth-manager permissions-cleanup --dag-id my_dag\n"
+        "To clean up without confirmation:\n"
+        "    $ airflow fab-auth-manager permissions-cleanup --yes"
+    ),
+)
+
 DB_COMMANDS = (
     ActionCommand(
         name="migrate",

apache_airflow_providers_fab-2.4.3rc1/src/airflow/providers/fab/auth_manager/cli_commands/permissions_command.py

@@ -0,0 +1,196 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+"""Permissions cleanup command."""
+
+from __future__ import annotations
+
+import logging
+from typing import TYPE_CHECKING
+
+from airflow.utils import cli as cli_utils
+from airflow.utils.providers_configuration_loader import providers_configuration_loaded
+from airflow.utils.session import NEW_SESSION, provide_session
+from airflow.utils.strings import to_boolean
+
+if TYPE_CHECKING:
+    from sqlalchemy.orm import Session
+
+log = logging.getLogger(__name__)
+
+
+@provide_session
+def cleanup_dag_permissions(dag_id: str, session: Session = NEW_SESSION) -> None:
+    """
+    Clean up DAG-specific permissions from Flask-AppBuilder tables.
+
+    When a DAG is deleted, we need to clean up the corresponding permissions
+    to prevent orphaned entries in the ab_view_menu table.
+
+    This addresses issue #50905: Deleted DAGs not removed from ab_view_menu table
+    and show up in permissions.
+
+    :param dag_id: Specific DAG ID to clean up.
+    :param session: Database session.
+    """
+    from sqlalchemy import delete, select
+
+    from airflow.providers.fab.auth_manager.models import Permission, Resource, assoc_permission_role
+    from airflow.security.permissions import RESOURCE_DAG_PREFIX, RESOURCE_DAG_RUN, RESOURCE_DETAILS_MAP
+
+    # Clean up specific DAG permissions
+    dag_resources = session.scalars(
+        select(Resource).filter(
+            Resource.name.in_(
+                [
+                    f"{RESOURCE_DAG_PREFIX}{dag_id}",  # DAG:dag_id
+                    f"{RESOURCE_DETAILS_MAP[RESOURCE_DAG_RUN]['prefix']}{dag_id}",  # DAG_RUN:dag_id
+                ]
+            )
+        )
+    ).all()
+    log.info("Cleaning up DAG-specific permissions for dag_id: %s", dag_id)
+
+    if not dag_resources:
+        return
+
+    dag_resource_ids = [resource.id for resource in dag_resources]
+
+    # Find all permissions associated with these resources
+    dag_permissions = session.scalars(
+        select(Permission).filter(Permission.resource_id.in_(dag_resource_ids))
+    ).all()
+
+    if not dag_permissions:
+        # Delete resources even if no permissions exist
+        session.execute(delete(Resource).where(Resource.id.in_(dag_resource_ids)))
+        return
+
+    dag_permission_ids = [permission.id for permission in dag_permissions]
+
+    # Delete permission-role associations first (foreign key constraint)
+    session.execute(
+        delete(assoc_permission_role).where(
+            assoc_permission_role.c.permission_view_id.in_(dag_permission_ids)
+        )
+    )
+
+    # Delete permissions
+    session.execute(delete(Permission).where(Permission.resource_id.in_(dag_resource_ids)))
+
+    # Delete resources (ab_view_menu entries)
+    session.execute(delete(Resource).where(Resource.id.in_(dag_resource_ids)))
+
+    log.info("Cleaned up %d DAG-specific permissions", len(dag_permissions))
+
+
+@cli_utils.action_cli
+@providers_configuration_loaded
+def permissions_cleanup(args):
+    """Clean up DAG permissions in Flask-AppBuilder tables."""
+    from sqlalchemy import select
+
+    from airflow.models import DagModel
+    from airflow.providers.fab.auth_manager.cli_commands.utils import get_application_builder
+    from airflow.providers.fab.auth_manager.models import Resource
+    from airflow.security.permissions import (
+        RESOURCE_DAG_PREFIX,
+        RESOURCE_DAG_RUN,
+        RESOURCE_DETAILS_MAP,
+    )
+    from airflow.utils.session import create_session
+
+    with get_application_builder() as _:
+        with create_session() as session:
+            # Get all existing DAG IDs from DagModel
+            existing_dag_ids = {dag.dag_id for dag in session.scalars(select(DagModel)).all()}
+
+            # Get all DAG-related resources from FAB tables
+            dag_resources = session.scalars(
+                select(Resource).filter(
+                    Resource.name.like(f"{RESOURCE_DAG_PREFIX}%")
+                    | Resource.name.like(f"{RESOURCE_DETAILS_MAP[RESOURCE_DAG_RUN]['prefix']}%")
+                )
+            ).all()
+
+            orphaned_resources = []
+            orphaned_dag_ids = set()
+
+            for resource in dag_resources:
+                # Extract DAG ID from resource name
+                dag_id = None
+                if resource.name.startswith(RESOURCE_DAG_PREFIX):
+                    dag_id = resource.name[len(RESOURCE_DAG_PREFIX) :]
+                elif resource.name.startswith(RESOURCE_DETAILS_MAP[RESOURCE_DAG_RUN]["prefix"]):
+                    dag_id = resource.name[len(RESOURCE_DETAILS_MAP[RESOURCE_DAG_RUN]["prefix"]) :]
+
+                # Check if this DAG ID still exists
+                if dag_id and dag_id not in existing_dag_ids:
+                    orphaned_resources.append(resource)
+                    orphaned_dag_ids.add(dag_id)
+
+            # Filter by specific DAG ID if provided
+            if args.dag_id:
+                if args.dag_id in orphaned_dag_ids:
+                    orphaned_dag_ids = {args.dag_id}
+                    print(f"Filtering to clean up permissions for DAG: {args.dag_id}")
+                else:
+                    print(
+                        f"DAG '{args.dag_id}' not found in orphaned permissions or still exists in database."
+                    )
+                    return
+
+            if not orphaned_dag_ids:
+                if args.dag_id:
+                    print(f"No orphaned permissions found for DAG: {args.dag_id}")
+                else:
+                    print("No orphaned DAG permissions found.")
+                return
+
+            print(f"Found orphaned permissions for {len(orphaned_dag_ids)} deleted DAG(s):")
+            for dag_id in sorted(orphaned_dag_ids):
+                print(f"  - {dag_id}")
+
+            if args.dry_run:
+                print("\nDry run mode: No changes will be made.")
+                print(f"Would clean up permissions for {len(orphaned_dag_ids)} orphaned DAG(s).")
+                return
+
+            # Perform cleanup if not in dry run mode
+            if not args.yes:
+                action = (
+                    f"clean up permissions for {len(orphaned_dag_ids)} DAG(s)"
+                    if not args.dag_id
+                    else f"clean up permissions for DAG '{args.dag_id}'"
+                )
+                confirm = input(f"\nDo you want to {action}? [y/N]: ")
+                if not to_boolean(confirm):
+                    print("Cleanup cancelled.")
+                    return
+
+            # Perform the actual cleanup
+            cleanup_count = 0
+            for dag_id in orphaned_dag_ids:
+                try:
+                    cleanup_dag_permissions(dag_id, session)
+                    cleanup_count += 1
+                    if args.verbose:
+                        print(f"Cleaned up permissions for DAG: {dag_id}")
+                except Exception as e:
+                    print(f"Failed to clean up permissions for DAG {dag_id}: {e}")
+
+            print(f"\nSuccessfully cleaned up permissions for {cleanup_count} DAG(s).")

{apache_airflow_providers_fab-2.4.2 → apache_airflow_providers_fab-2.4.3rc1}/src/airflow/providers/fab/auth_manager/fab_auth_manager.py

@@ -60,6 +60,7 @@ from airflow.exceptions import AirflowConfigException, AirflowException
 from airflow.models import DagModel
 from airflow.providers.fab.auth_manager.cli_commands.definition import (
     DB_COMMANDS,
+    PERMISSIONS_CLEANUP_COMMAND,
     ROLES_COMMANDS,
     SYNC_PERM_COMMAND,
     USERS_COMMANDS,
@@ -211,6 +212,7 @@ class FabAuthManager(BaseAuthManager[User]):
                 subcommands=ROLES_COMMANDS,
             ),
             SYNC_PERM_COMMAND,  # not in a command group
+            PERMISSIONS_CLEANUP_COMMAND,  # single command for permissions cleanup
         ]
         # If Airflow version is 3.0.0 or higher, add the fab-db command group
         if packaging.version.parse(

{apache_airflow_providers_fab-2.4.2 → apache_airflow_providers_fab-2.4.3rc1}/src/airflow/providers/fab/auth_manager/security_manager/override.py

@@ -112,6 +112,7 @@ if TYPE_CHECKING:
         RESOURCE_ASSET_ALIAS,
     )
     from airflow.sdk import DAG
+    from airflow.serialization.serialized_objects import SerializedDAG
 else:
     from airflow.providers.common.compat.security.permissions import (
         RESOURCE_ASSET,
@@ -122,13 +123,13 @@ if AIRFLOW_V_3_1_PLUS:
     from airflow.models.dagbag import DBDagBag
     from airflow.utils.session import create_session
 
-    def _iter_dags() -> Iterable[DAG]:
+    def _iter_dags() -> Iterable[DAG | SerializedDAG]:
         with create_session() as session:
             yield from DBDagBag().iter_all_latest_version_dags(session=session)
 else:
     from airflow.models.dagbag import DagBag
 
-    def _iter_dags() -> Iterable[DAG]:
+    def _iter_dags() -> Iterable[DAG | SerializedDAG]:
         dagbag = DagBag(read_dags_from_db=True)  # type: ignore[call-arg]
         dagbag.collect_dags_from_db()  # type: ignore[attr-defined]
         return dagbag.dags.values()