Separate permissions for Pause/Unpause DAG and trigger DAG

[AVMusorin]

Hi!

I find useful to have separate permissions for a dag to set a dag in pause/unpause and trigger it. For example, in my work pipeline I need to review dags, and by default Airflow can set them paused. Then after a review I want to set them unpaused and allow other users to trigger it, but these users shouldn't set it unpaused by themselves.

What could you advise? To add an action like can_pause seems out of the ordinary.

Related issues:

• Fix read allows dag trigger bug #13922
• Fix inconsitencies in checking edit permissions for a DAG #20346

[potiuk]

I think you are trying to build too much in Airflow - making it "review tool" is not what it is intended for. I think the best approach you might want to do is to write your own UI for that, or plug it in existing CI tool you have where you can use REST API to read/manage state of those DAGs and possibly link to Airlfow UI.

[AVMusorin]

@potiuk thank you for your reply. My pipeline it's only an example and maybe it's not so good.

But I wanted to pay your attention that permissions there aren't flexible.

To trigger dag we need DAG.can_edit + DagRun.can_create and DAG.can_edit is needed to have an ability to grant trigger permission to a certain dag. But in reality we do not need DAG.can_edit to trigger dag, we need something like DagRun.can_create and the same mechanism to grant permissions for a single dag to create DagRun. Correct me if I'm wrong, but to trigger a dag we do not need to modify it's metainformation somehow?

So, I put forward to create the same mechanism as for DAGs to grant DagRun:<dag_id>.can_create and DagRun.can_create for all dags. After these changes it'll become possible to trigger dags without DAG.can_edit and give permission to trigger to single dag with DagRun:<dag_id>.can_create.

[potiuk]

Well If you would like to make PR with it - feel free. I am just pointing out that your use case is outside of the regular "workflow" of Airlfow. But You can always create a PR proposing the change.

[YakshaB]

Hi @AVMusorin Is this changed got merged ?
Im looking for DAG view & trigger permission , but user should not pause/unpause/edit the dags.