From a07eb63f9638aec0f29484adf4855cd7a7b49cc1 Mon Sep 17 00:00:00 2001
From: waterWang <waterWang@users.noreply.github.com>
Date: Sat, 8 Aug 2026 09:41:47 +0800
Subject: [PATCH] fix(keycloak): add missing Dag resource to Op-team permission
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Op-{team} permission created by the create-team command was missing
the Dag:{team} resource. This caused users with the Op role to not
receive the expected permission for the team's DAG resource.

The fix adds Dag:{team} to the Op-{team} permission resources in two
places:
1. _get_permissions_to_create() — the initial permission creation
2. _attach_team_permissions() — the policy attachment for create-team

Fixes #71319
---
 .../providers/keycloak/auth_manager/cli/commands.py  |  2 ++
 .../unit/keycloak/auth_manager/cli/test_commands.py  | 12 ++++++++++++
 2 files changed, 14 insertions(+)

diff --git a/providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/commands.py b/providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/commands.py
index 6ead332155b17..3944c64b6c1a5 100644
--- a/providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/commands.py
+++ b/providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/commands.py
@@ -480,6 +480,7 @@ def _get_permissions_to_create(
                         "type": "resource-based",
                         "resources": [
                             f"{KeycloakResource.CONNECTION.value}:{team}",
+                            f"{KeycloakResource.DAG.value}:{team}",
                             f"{KeycloakResource.POOL.value}:{team}",
                             f"{KeycloakResource.VARIABLE.value}:{team}",
                         ],
@@ -828,6 +829,7 @@ def _attach_team_permissions(
         policy_name=_team_role_policy_name(team, "Op"),
         resource_names=[
             f"{KeycloakResource.CONNECTION.value}:{team}",
+            f"{KeycloakResource.DAG.value}:{team}",
             f"{KeycloakResource.POOL.value}:{team}",
             f"{KeycloakResource.VARIABLE.value}:{team}",
         ],
diff --git a/providers/keycloak/tests/unit/keycloak/auth_manager/cli/test_commands.py b/providers/keycloak/tests/unit/keycloak/auth_manager/cli/test_commands.py
index 62c61f95f7249..4c3c92ab827ca 100644
--- a/providers/keycloak/tests/unit/keycloak/auth_manager/cli/test_commands.py
+++ b/providers/keycloak/tests/unit/keycloak/auth_manager/cli/test_commands.py
@@ -426,6 +426,17 @@ def test_create_permissions_with_teams(self, mock_get_client):
             },
             skip_exists=True,
         )
+        client.create_client_authz_resource_based_permission.assert_any_call(
+            client_id="test-id",
+            payload={
+                "name": "Op-team-a",
+                "type": "scope",
+                "logic": "POSITIVE",
+                "decisionStrategy": "UNANIMOUS",
+                "resources": ["r1", "r2", "r3", "r4"],  # Dag:team-a, Connection:team-a, Pool:team-a, Variable:team-a
+            },
+            skip_exists=True,
+        )
 
     @patch("airflow.providers.keycloak.auth_manager.cli.commands._attach_policy_to_resource_permission")
     @patch("airflow.providers.keycloak.auth_manager.cli.commands._attach_policy_to_scope_permission")
@@ -606,6 +617,7 @@ def test_create_team_command(
             policy_name="Allow-Op-team-a",
             resource_names=[
                 "Connection:team-a",
+                "Dag:team-a",
                 "Pool:team-a",
                 "Variable:team-a",
             ],