[AIRFLOW-576] Add superuser judgement for password auth

airflow/contrib/auth/backends/password_auth.py

@@ -27,7 +27,7 @@
 from flask_bcrypt import generate_password_hash, check_password_hash
 
 from sqlalchemy import (
-    Column, String, DateTime)
+    Column, String, DateTime, Boolean)
 from sqlalchemy.ext.hybrid import hybrid_property
 
 from airflow import settings
@@ -50,10 +50,19 @@ class AuthenticationError(Exception):
 
 class PasswordUser(models.User):
     _password = Column('password', String(255))
+    _superuser = Column('superuser', Boolean, nullable=False, default=False)
 
     def __init__(self, user):
         self.user = user
 
+    @hybrid_property
+    def superuser(self):
+        return bool(self._superuser)
+
+    @superuser.setter
+    def _set_superuser(self, superuser):
+        self._superuser = bool(superuser)
+
     @hybrid_property
     def password(self):
         return self._password
@@ -88,8 +97,8 @@ def data_profiling(self):
         return True
 
     def is_superuser(self):
-        '''Access all the things'''
-        return True
+        '''Be careful for MySQL '''
+        return bool(self.superuser)
 
 
 @login_manager.user_loader
@@ -99,11 +108,11 @@ def load_user(userid):
         return None
 
     session = settings.Session()
-    user = session.query(models.User).filter(models.User.id == int(userid)).first()
+    user = session.query(PasswordUser).filter(PasswordUser.id == int(userid)).first()
     session.expunge_all()
     session.commit()
     session.close()
-    return PasswordUser(user)
+    return user
 
 
 def login(self, request):

airflow/migrations/versions/938c37a53f1a_add_superuser_column_to_user.py

@@ -0,0 +1,38 @@
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""add superuser column to user
+
+Revision ID: 938c37a53f1a
+Revises: f2ca10b85618
+Create Date: 2016-11-07 11:19:10.388577
+
+"""
+
+# revision identifiers, used by Alembic.
+revision = '938c37a53f1a'
+down_revision = 'f2ca10b85618'
+branch_labels = None
+depends_on = None
+
+from alembic import op
+import sqlalchemy as sa
+
+
+def upgrade():
+    op.add_column('users', sa.Column('superuser', sa.Boolean,
+                                     nullable=False, default=False))
+
+
+def downgrade():
+    op.drop_column('users', 'superuser')