[api] Add logic redacted sensitive fields via the Public API and UI

[nhuantho]

closes: 59842

What:

• When I checked UI, I saw some sensitive values that were not marked
• 
• 

How:

• Add logic to redact sensitive values

---

^ Add meaningful description above
Read the Pull Request Guidelines for more information.
In case of fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in a newsfragment file, named {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

[potiuk]

That's far too much. There are just a few API calls that return potentially sensitive data: config, variables, connections, related export (should be removed)/import (should mention that export can only be done via local CLI) features in UI. Only those are affected - there is absolutely no need to redact all possible Pydantic models. Just checking that APIs and UI displaying it are handling masked data well and that that proper

[jason810496]

That's far too much. There are just a few API calls that return potentially sensitive data: config, variables, connections, related export (should be removed)/import (should mention that export can only be done via local CLI) features in UI. Only those are affected - there is absolutely no need to redact all possible Pydantic models. Just checking that APIs and UI displaying it are handling masked data well and that that proper

Yes, maybe searching 'connection', 'config' and 'variable' across the api_fastapi directory would be enough. Thanks!

[nhuantho]

@potiuk, @jason810496, I tested connection, config, and variable, so I think I only need to modify logic of API for:

• 
• 
• So, I will commit soon.

[jason810496]

Thanks for your update!

[abhijeets25012-tech]

“I see there is already a PR in progress.
Is there any remaining part or follow-up task I can help with?”

[nhuantho]

@abhijeets25012-tech, I think that it is enough for this task.

[jason810496]

I think that it is enough for this task.

Yes, only the final nit then the PR is good to go.

[nhuantho]

@jason810496, I had two tests for this case:

• input: {"secret_key": "test-secret_key"} -> expected: {"secret_key": "***"} (sensitive data)
• input: {"extra_fields": "test-extra_fields"} -> expected: {"extra_fields": "test-extra_fields"} (normal data)

-> So I think that it is correct to pass.

[jason810496]

input: {"extra_fields": "test-extra_fields"} -> expected: {"extra_fields": "test-extra_fields"} (normal data)

I see, thanks for the clarification.

[nhuantho]

Hi @jason810496, @potiuk, this pr (59880) handles not exposing sensitive fields of config via API. So, it is redundant to redact at ConfigOption model of api. I can remove redact in airflow-core/src/airflow/api_fastapi/core_api/datamodels/config.py. It is the cause of the failed tests

[jason810496]

handles not exposing sensitive fields of config via API. So, it is redundant to redact at ConfigOption model of api. I can remove redact in airflow-core/src/airflow/api_fastapi/core_api/datamodels/config.py. It is the cause of the failed tests

Thanks for sharing the context. If this is the case, then I think the PR is good to go. Thanks!

[potiuk]

I rebased the PR there was an airflowctl failure, let's see if it was intermittent