Previous versions (before 2.0) allowed for granular can_edit DAG permissions so that different user groups can trigger different DAGs and access control is more specific. Since 2.0 it seems that this does not work as expected.

How to reproduce:
Create a copy of the VIEWER role, try adding it can dag edit on a specific DAG. **Expected Result:** user can trigger said DAG. **Actual Result:** user access is denied.

It seems to be a new parameter was added: **can create on DAG runs** and without it the user cannot run DAGs, however, with it, the user can run all DAGs without limitations and I believe this is an unintended use.

airflow/migrations/versions/2c6edca13270_resource_based_permissions.py
"""Apply Map Airflow view permissions."""
    appbuilder = create_app(config={'FAB_UPDATE_PERMS': False}).appbuilder
    for old, new in mapping.items():
        (old_view_name, old_perm_name) = old
        old_pvm = appbuilder.sm.find_permission_view_menu(old_perm_name, old_view_name)
        if not old_pvm:
            continue
        for new_perm_name, new_view_name in new:
            new_pvm = appbuilder.sm.add_permission_view_menu(new_perm_name, new_view_name)
            for role in appbuilder.sm.get_all_roles():
                if appbuilder.sm.exist_permission_on_roles(old_view_name, old_perm_name, [role.id]):
                    appbuilder.sm.add_permission_role(role, new_pvm)
                    appbuilder.sm.del_permission_role(role, old_pvm)
        appbuilder.sm.del_permission_view_menu(old_perm_name, old_view_name)
        if not appbuilder.sm.find_permission(old_perm_name):
            continue
        view_menus = appbuilder.sm.get_all_view_menu()
        if not any(appbuilder.sm.find_permission_view_menu(old_perm_name, view.name) for view in view_menus):
            appbuilder.sm.del_permission(old_perm_name)
def upgrade():
    """Apply Resource based permissions."""
    log = logging.getLogger()
    handlers = log.handlers[:]
    remap_permissions()
    log.handlers = handlers
def downgrade():
    """Unapply Resource based permissions."""
    pass