Fix displaying dbt docs as menu item in Astro

[tatiana]

As of Cosmos 1.7.0, Astro customers who have the role of "Organization Member" or "Workspace Operator" are not able to see the menu item "dbt Docs" under "Browser". They could access the /cosmos/dbt_docs view directly, though. This PR solves this issue.

Closes: #1131

About the solution

This PR follows the Astro documentation recommendation:

If you want to use custom menu items in an Airflow environment hosted on Astro, you must give your plugin the necessary permissions. To do this, use the @has_access decorator to give your BaseView method ACTION_CAN_ACCESS_MENU permissions.

By adding:

    @has_access([(permissions.ACTION_CAN_ACCESS_MENU, "Custom Menu")]) 

How the fix was tested

In addition to the unit test that checks if all Cosmos plugin endpoints have the expected permissions, I also validated this change with a user with the "Organization Member" role. I confirmed that they could see the menu item and that it redirects to the correct page:

[netlify]

❌ Deploy Preview for sunny-pastelito-5ecb04 failed.

Name	Link
🔨 Latest commit	48c5f3b
🔍 Latest deploy log	https://app.netlify.com/sites/sunny-pastelito-5ecb04/deploys/671a7da6c3d0ab0008aadb96

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 95.73%. Comparing base (7915fd0) to head (48c5f3b).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1280   +/-   ##
=======================================
  Coverage   95.73%   95.73%           
=======================================
  Files          67       67           
  Lines        3965     3967    +2     
=======================================
+ Hits         3796     3798    +2     
  Misses        169      169           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[pankajkoti]

The Airflow docstring suggests that the has_access decorator is deprecated and we should use alternate has_access_* (probably has_access_view is what we might need) decorators. We might as well need update to the Astro docs(?)

However, since this has been tested with Astro & it seems to be working, I guess we're safe.

Great find though, thanks for fixing this & sharing the Astro docs for reference 👏🏽

[tatiana]

Thanks a lot for the fast review, @pankajkoti!

The Airflow docstring suggests that the has_access decorator is deprecated and we should use alternate has_access_* (probably has_access_view is what we might need) decorators. We might as well need update to the Astro docs(?)

I also noticed this but was slightly worried about refactoring this while trying to fix the current bug.

It was a significant interface change. While has_access receives a list of tuples (permission & resource) as an argument, the new interface (e.g. has_access_view) expects an AccessView item. It is unclear if has_access_view would be enough to grant menu item permissions:
https://github.com/apache/airflow/blob/6070bb6c354908f6b233f3d92086476d0f62ada0/airflow/www/auth.py#L324

Lastly, I wonder how much of this may change with Airflow 3. I know there are intentions of redefining plugins, so I'm not sure if we should spend time on this now or just focus on the future version once AF3 alphas are released. WDYT?

However, since this has been tested with Astro and seems to be working, I guess we're safe.

I also asked the CRE team to confirm it works in their tests so that we can have more confidence it now works as expected in Astro Cloud. I will merge this PR, but I suggest we wait for their confirmation before releasing 1.7.1.

[pankajkoti]

Lastly, I wonder how much of this may change with Airflow 3. I know there are intentions of redefining plugins, so I'm not sure if we should spend time on this now or just focus on the future once AF3 alphas are released. WDYT?

I fully agree. IMO, it would be wise if we invest little into trying to support more in what we may know is likely to change. So the bare minimum and working fixes is what I would also prefer specifically when it comes to plugins ,🙂