Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixed Issue #45116 #45253

Closed
wants to merge 1 commit into from
Closed

Conversation

Spaarsh
Copy link

@Spaarsh Spaarsh commented Dec 27, 2024

closes: #45116
related: #40470

The fix adds a "Logout" button to the navbar_menu and uses supporting JavaScript to send a POST request to the /logout endpoint. Additionally, it also fixes a duplicate text of "login" associated with the login button.


^ Add meaningful description above
Read the Pull Request Guidelines for more information.
In case of fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in a newsfragment file, named {pr_number}.significant.rst or {issue_number}.significant.rst, in newsfragments.

@boring-cyborg boring-cyborg bot added area:UI Related to UI/UX. For Frontend Developers. area:webserver Webserver related Issues labels Dec 27, 2024
Copy link

boring-cyborg bot commented Dec 27, 2024

Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our Contributors' Guide (https://github.com/apache/airflow/blob/main/contributing-docs/README.rst)
Here are some useful points:

  • Pay attention to the quality of your code (ruff, mypy and type annotations). Our pre-commits will help you with that.
  • In case of a new feature add useful documentation (in docstrings or in docs/ directory). Adding a new operator? Check this short guide Consider adding an example DAG that shows how users should use it.
  • Consider using Breeze environment for testing locally, it's a heavy docker but it ships with a working Airflow and a lot of integrations.
  • Be patient and persistent. It might take some time to get a review or get the final approval from Committers.
  • Please follow ASF Code of Conduct for all communication including (but not limited to) comments on Pull Requests, Mailing list and Slack.
  • Be sure to read the Airflow Coding style.
  • Always keep your Pull Requests rebased, otherwise your build might fail due to changes not related to your commits.
    Apache Airflow is a community-driven project and together we are making it better 🚀.
    In case of doubts contact the developers at:
    Mailing List: [email protected]
    Slack: https://s.apache.org/airflow-slack

@Spaarsh
Copy link
Author

Spaarsh commented Dec 27, 2024

This how the logout button shall look in the GUI:

GUI with the new Logout button:

Screencast.from.2024-12-28.00-49-18.webm

GUI after removing additional "login" text:

Screencast.from.2024-12-28.00-48-49.webm

@Spaarsh
Copy link
Author

Spaarsh commented Dec 27, 2024

The current fix is not a clean one. I did go through the code to make a cleaner fix which would involve including the "logout" in one of the functions in
base_auth_manager.py:

    def filter_permitted_menu_items(self, menu_items: list[MenuItem]) -> list[MenuItem]:
        """
        Filter menu items based on user permissions.


        :param menu_items: list of all menu items
        """
        items = filter(
            lambda item: self.security_manager.has_access(ACTION_CAN_ACCESS_MENU, item.name), menu_items
        )
        accessible_items = []
        for menu_item in items:
            menu_item_copy = MenuItem(
                **{
                    **menu_item.__dict__,
                    "childs": [],
                }
            )
            if menu_item.childs:
                accessible_children = []
                for child in menu_item.childs:
                    if self.security_manager.has_access(ACTION_CAN_ACCESS_MENU, child.name):
                        accessible_children.append(child)
                menu_item_copy.childs = accessible_children
            accessible_items.append(menu_item_copy)
        return accessible_items

The reason being that this menu list is called in the navbar_menu.html

Enabling these changes further requires changes in the security_manager.py. Is this the correct approach? I did attempt to implement these but that just lead to the need for more changes.

Also, I think that the version checking condition in the override.py can now be removed if it had been implemented solely due to the GET request at /logout endpoint.

@jscheffl
Copy link
Contributor

From the screencast I see that you have not properly compiled www-assets before running the UI. This has side effects of missing scripts.

What I do not understand is the fix you are attempting to contribute. There IS already a logout menu entry behind the profile:
image
Why do you plan to add another in this PR?

Copy link
Contributor

@shahar1 shahar1 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

+1 to Jens' comment - I didn't understand from the original issue that you want to add a new button in addition to the existing one (which Jens captured in the screenshot), but to fix a broken functionality in the existing one.
I've implemented the exact same CSRF protection in #40145, so I might need some more background regarding the problems with it (if you could take a video that demonstrates it - it would be great!).
Apologies for misunderstanding.

@Spaarsh
Copy link
Author

Spaarsh commented Dec 28, 2024

@jscheffl @shahar1 my sincere apologies for this mishap. I have compiled the www-assets (sorry for this mistake). In my previous comment under the issue, I had presumed that the person who opened the issue tried to go to the /logout/ endpoint in the browser to logout. I should have asked them how exactly was the error occurring. The only instance of 405 error I got was when I tried to enter the /logout/ in the browser. Hence my assumption.

Again, my apologies for this bad PR. I will make a comment under the issue to understand how to recreate the error. Should I close my PR until then?

@shahar1
Copy link
Contributor

shahar1 commented Dec 28, 2024

@jscheffl @shahar1 my sincere apologies for this mishap. I have compiled the www-assets (sorry for this mistake). In my previous comment under the issue, I had presumed that the person who opened the issue tried to go to the /logout/ endpoint in the browser to logout. I should have asked them how exactly was the error occurring. The only instance of 405 error I got was when I tried to enter the /logout/ in the browser. Hence my assumption.

Again, my apologies for this bad PR. I will make a comment under the issue to understand how to recreate the error. Should I close my PR until then?

Try to take it easy. Nothing bad happened :)
You could close this PR for now - try to figure out if you can reproduce the issue. If you can, you may create a new PR to fix it - otherwise, there's plenty of other issues that you could tackle.

@Spaarsh Spaarsh closed this Dec 28, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area:UI Related to UI/UX. For Frontend Developers. area:webserver Webserver related Issues
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Logging out from Web UI still raises Airflow 405 error
3 participants