Repository navigation
Fix CLI connection display reporting wrong is_extra_encrypted flag - #67561
Merged
potiuk merged 2 commits intoJun 24, 2026
Merged
Conversation
jonathanleek
requested review from
bugraoz93,
dheerajturaga and
potiuk
as code owners
May 26, 2026 15:02
|
Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our Contributors' Guide
|
jonathanleek
force-pushed
the
fix-is-extra-encrypted-cli-mapping
branch
from
May 26, 2026 15:08
71c4113 to
040fe0a
Compare
Pedrinhonitz
suggested changes
May 26, 2026
`airflow connections get` showed the password's encryption status under both `is_encrypted` and `is_extra_encrypted` keys, because the display mapper sourced both from `Connection.is_encrypted`. These flags are independent — the extra field (which usually holds API keys, certs) can be encrypted while the password is not, or vice versa. Operators checking the readout could be misled about whether `extra` is encrypted at rest. Adds a regression test that exercises both `ConnectionDisplayMapper` methods (full_details, masked_sensitive) across the divergent input combinations.
jonathanleek
force-pushed
the
fix-is-extra-encrypted-cli-mapping
branch
from
May 27, 2026 13:58
040fe0a to
ffdc3a5
Compare
Pedrinhonitz
approved these changes
May 27, 2026
Pedrinhonitz
left a comment
Pedrinhonitz
left a comment
Contributor
There was a problem hiding this comment.
Thanks for the adjustment, it looks good to me.
potiuk
added
the
ready for maintainer review
Collaborator
|
@eladkal - can you take a peek at this one? |
potiuk
approved these changes
Jun 6, 2026
potiuk
left a comment
potiuk
left a comment
Member
There was a problem hiding this comment.
LGTM — clear bug: is_extra_encrypted was sourced from conn.is_encrypted, so the two independent flags always reported the same value. Fix is correct and the parametrized test covers both mappers × both flag combinations. (Minor: since this is a user-visible CLI output fix, a bugfix newsfragment would've been fine to keep — but not worth blocking.) Thanks!
Drafted-by: Claude Code (Opus 4.8); reviewed by @potiuk before posting
potiuk
removed
the
ready for maintainer review
Collaborator
|
@potiuk - why was |
Member
My mistake - I thought I already merged that one. |
potiuk
added
the
ready for maintainer review
|
Awesome work, congrats on your first merged pull request! You are invited to check our Issue Tracker for additional contributions. |
karenbraganz
pushed a commit
to karenbraganz/airflow
that referenced
this pull request
Jun 30, 2026
…pache#67561) `airflow connections get` showed the password's encryption status under both `is_encrypted` and `is_extra_encrypted` keys, because the display mapper sourced both from `Connection.is_encrypted`. These flags are independent — the extra field (which usually holds API keys, certs) can be encrypted while the password is not, or vice versa. Operators checking the readout could be misled about whether `extra` is encrypted at rest. Adds a regression test that exercises both `ConnectionDisplayMapper` methods (full_details, masked_sensitive) across the divergent input combinations.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
airflow connections getshowed the password's encryption status under bothis_encryptedandis_extra_encryptedkeys, because the display mapper sourced both fromConnection.is_encrypted. These flags are independent — the extra field (which usually holds API keys, certs, etc.) can be encrypted while the password is not, or vice versa. Operators checking the readout could be misled about whetherextrais encrypted at rest.The fix changes
is_extra_encryptedto source fromConnection.is_extra_encryptedin bothConnectionDisplayMapper.full_detailsandConnectionDisplayMapper.masked_sensitive. A parametrized regression test exercises both methods across the two divergent flag combinations to prevent re-introducing the bug.Was generative AI tooling used to co-author this PR?
Generated-by: Claude Code (Opus 4.7) following the guidelines