Can't remove permission from a role using the API

[szczeles]

Apache Airflow version

2.3.3

What happened

There is an API PATCH /api/v1/roles/[role] that is supposed to be able to update existing role. When I call it, providing list of permissions to attach in actions field (in JSON body), the new permissions are added to the role, but removed permissions are not removed. It is related to the fact that API implementation calls security_manager.bulk_sync_roles and the method never removes any permissions, only adds new ones by calling self.add_permission_to_role.

What you think should happen instead

API call to PATCH /api/v1/roles/[role] should remove the dropped permissions. UI form works that way.

How to reproduce

1. Setup a fresh airflow (webserver is enough) and login as admin to the UI
2. Create new role with permissions: can read on Website, menu access on Browse
3. Use PATCH /api/v1/roles/[role] to update permissions to can read on Website, can read on DAGs
4. Verify in UI that role has 3 permissions -> menu access on Browse is not removed

Operating System

Debian 10

Versions of Apache Airflow Providers

No response

Deployment

Official Apache Airflow Helm Chart

Deployment details

No response

Anything else

No response

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[boring-cyborg]

Thanks for opening your first issue here! Be sure to follow the issue template!

[juliusdelta]

@szczeles Are you planning to take this? I'd be willing to submit a PR if not.

[potiuk]

I think you can start working on it @juliusdelta if there is no response soon -> @szczeles, if you have not looked at it yet you could do a review as well :) . This might be super-helpful.

[szczeles]

Hey, @juliusdelta! I didn't start working on this yet, so feel free to submit PR for this. I'm happy to review and test in my lab when it's done. Good luck!

[eladkal]

@juliusdelta are you still working on this issue?

[wilsonhooi86]

Hi There, is there any update on this issue? Currently not able to remove any permissions from roles using API PATCH /api/v1/roles/[role]. Is there alternative ways to remove permissions from role? Thank you