Repository: apache/airflow
File: airflow-core/src/airflow/api_fastapi/auth/managers/simple/simple_auth_manager.py (Python)

Code before:
        *,
        method: ResourceMethod,
        user: SimpleAuthManagerUser,
        details: PoolDetails | None = None,
    ) -> bool:
        return self._is_authorized(
            method=method,
            allow_get_role=SimpleAuthManagerRole.VIEWER,
            allow_role=SimpleAuthManagerRole.OP,
            user=user,
            team_name=details.team_name if details else None,
        )

    def is_authorized_team(
        self,
        *,
        method: ResourceMethod,
        user: SimpleAuthManagerUser,
        details: TeamDetails | None = None,
    ) -> bool:
        if not details:
            return False
        if user.role:
            role_str = user.role.upper()
            role = SimpleAuthManagerRole[role_str]
            if role == SimpleAuthManagerRole.ADMIN:
                return True
        return details.name in user.teams

    def is_authorized_variable(
        self,
        *,
        method: ResourceMethod,
        user: SimpleAuthManagerUser,
        details: VariableDetails | None = None,
    ) -> bool:
        return self._is_authorized(
            method=method,
            allow_role=SimpleAuthManagerRole.OP,
            user=user,
            team_name=details.team_name if details else None,
        )

    def is_authorized_view(self, *, access_view: AccessView, user: SimpleAuthManagerUser) -> bool:
        return self._is_authorized(method="GET", allow_role=SimpleAuthManagerRole.VIEWER, user=user)

    def is_authorized_custom_view(
        self, *, method: ResourceMethod, resource_name: str, user: SimpleAuthManagerUser
    ):
        return self._is_authorized(method="GET", allow_role=SimpleAuthManagerRole.VIEWER, user=user)


Review comment (security):
Since this code is already used somewhere else in simple auth manager, could you create a private method `_is_admin(user: SimpleAuthManagerUser)` which returns whether the user is an admin and uses it please

Code after:
        *,
        method: ResourceMethod,
        user: SimpleAuthManagerUser,
        details: PoolDetails | None = None,
    ) -> bool:
        return self._is_authorized(
            method=method,
            allow_get_role=SimpleAuthManagerRole.VIEWER,
            allow_role=SimpleAuthManagerRole.OP,
            user=user,
            team_name=details.team_name if details else None,
        )

    def is_authorized_team(
        self,
        *,
        method: ResourceMethod,
        user: SimpleAuthManagerUser,
        details: TeamDetails | None = None,
    ) -> bool:
        if not details:
            return False
        if self._is_admin(user):
            return True
        return details.name in user.teams

    def is_authorized_variable(
        self,
        *,
        method: ResourceMethod,
        user: SimpleAuthManagerUser,
        details: VariableDetails | None = None,
    ) -> bool:
        return self._is_authorized(
            method=method,
            allow_role=SimpleAuthManagerRole.OP,
            user=user,
            team_name=details.team_name if details else None,
        )

    def is_authorized_view(self, *, access_view: AccessView, user: SimpleAuthManagerUser) -> bool:
        return self._is_authorized(method="GET", allow_role=SimpleAuthManagerRole.VIEWER, user=user)

    def is_authorized_custom_view(
        self, *, method: ResourceMethod, resource_name: str, user: SimpleAuthManagerUser
    ):
        return self._is_authorized(method="GET", allow_role=SimpleAuthManagerRole.VIEWER, user=user)

    def filter_authorized_menu_items(
        self, menu_items: list[MenuItem], *, user: SimpleAuthManagerUser
    ) -> list[MenuItem]: