Previous versions (before 2.0) allowed for granular can_edit DAG permissions so that different user groups can trigger different DAGs and access control is more specific. Since 2.0 it seems that this does not work as expected.

How to reproduce:
Create a copy of the VIEWER role, try adding it can dag edit on a specific DAG. **Expected Result:** user can trigger said DAG. **Actual Result:** user access is denied.

It seems to be a new parameter was added: **can create on DAG runs** and without it the user cannot run DAGs, however, with it, the user can run all DAGs without limitations and I believe this is an unintended use.

tests/www/test_views.py
self.test.assertNotIn(f'name="base_date" value="{base_date}"', data)
        self.test.assertNotIn('<option selected="" value="{num}">{num}</option>'.format(num=num_runs), data)
    def assert_run_is_not_in_dropdown(self, run, data):
        self.test.assertNotIn(run.execution_date.isoformat(), data)
        self.test.assertNotIn(run.run_id, data)
    def assert_run_is_in_dropdown_not_selected(self, run, data):
        self.test.assertIn(f'<option value="{run.execution_date.isoformat()}">{run.run_id}</option>', data)
    def assert_run_is_selected(self, run, data):
        self.test.assertIn(
            f'<option selected value="{run.execution_date.isoformat()}">{run.run_id}</option>', data
        )
    def test_with_default_parameters(self):
        """
        Tests view with no URL parameter.
        Should show all dag runs in the drop down.
        Should select the latest dag run.
        Should set base date to current date (not asserted)
        """
        response = self.test.client.get(
            self.endpoint, data=dict(username='test', password='test'), follow_redirects=True
        )
        self.test.assertEqual(response.status_code, 200)
        data = response.data.decode('utf-8')
        self.test.assertIn('<label class="sr-only" for="base_date">Base date</label>', data)
        self.test.assertIn('<label class="sr-only" for="num_runs">Number of runs</label>', data)
        self.assert_run_is_selected(self.runs[0], data)
        self.assert_run_is_in_dropdown_not_selected(self.runs[1], data)
        self.assert_run_is_in_dropdown_not_selected(self.runs[2], data)
        self.assert_run_is_in_dropdown_not_selected(self.runs[3], data)
    def test_with_execution_date_parameter_only(self):