deny unknown backfill_id directly instead of falling back to body dag_id

[bujjibabukatta]

Summary

Fixes an authorization bug in requires_access_backfill where an unknown backfill_id could be distinguished from a forbidden one by response status code, leaking which backfill ids exist.

Root Cause

When backfill_id was present but matched no row, dag_id stayed None — the same as when there was no backfill_id at all — so the check fell through to authorizing against a dag_id from the request body instead of denying outright.

Fix

If backfill_id is given but matches no row, deny immediately with 403 Forbidden (the same response a forbidden-but-existing backfill gets), instead of falling back to the body-supplied dag_id.

Closes: #71080

Was generative AI tooling used ?

• Yes - Claude

Generated-by: Claude following the guidelines

[potiuk]

Hello @bujjibabukatta - thank you for your contributions to Apache Airflow!

The Airflow community has introduced a limit of 5 open pull requests at a time for contributors without write access to the repository. You currently have 16 open pull requests, so - as a one-time step of introducing the limit - we closed the ones where maintainers have not engaged yet:

• Fix airflowctl always using production creds when --env is passed #70584 - Fix airflowctl always using production creds when --env is passed
• Skip redundant dag.exceeds_max_non_backfill writes to reduce scheduler/DAG-processor lock contention #70712 - Skip redundant dag.exceeds_max_non_backfill writes to reduce scheduler/DAG-processor lock contention
• Allow temporal partition mappers to accept already-normalized keys #70781 - Allow temporal partition mappers to accept already-normalized keys
• Skip file-based dag processor logs when dag_processor_log_target=stdout #71052 - Skip file-based dag processor logs when dag_processor_log_target=stdout
• Add opt-in append_blob write mode for WASB task logs #71064 - Add opt-in append_blob write mode for WASB task logs
• deny unknown backfill_id directly instead of falling back to body dag_id #71114 - deny unknown backfill_id directly instead of falling back to body dag_id
• Fix DAG processor treating non-.zip files as DAG bundles (#71125) #71166 - Fix DAG processor treating non-.zip files as DAG bundles (DAG processor treats any zip-format file (.jar, .pptx, .docx, .xlsx, etc.) as a potential DAG bundle, not just .zip #71125)
• Surface hasMappedDependants on ts-sdk TaskContext #71191 - Surface hasMappedDependants on ts-sdk TaskContext
• fix: FAB get_application_builder should use create_metadata_engine hook #71673 - fix: FAB get_application_builder should use create_metadata_engine hook
• Task SDK: Fix executor_config aliasing across tasks sharing default_args #72556 - Task SDK: Fix executor_config aliasing across tasks sharing default_args
• Add job_name support to DataflowJobStatusSensor and DataflowJobStatusTrigger #72879 - Add job_name support to DataflowJobStatusSensor and DataflowJobStatusTrigger

These pull requests stay open because maintainers are already engaged in them - they count towards your limit:

• fix(amazon): include deferred-task trigger logs when reading from Clo… #70635 - fix(amazon): include deferred-task trigger logs when reading from Clo…
• Fix ReDoS in SparkSubmitHook._mask_cmd on adversarial input #70716 - Fix ReDoS in SparkSubmitHook._mask_cmd on adversarial input
• Point mask_secret deprecation warning at the module it actually uses #70883 - Point mask_secret deprecation warning at the module it actually uses
• Build DataprocCreateClusterOperator cluster_config from legacy kwargs after rendering #70922 - Build DataprocCreateClusterOperator cluster_config from legacy kwargs after rendering
• Anchor run_id to logical_date when create_cron_data_intervals is enab… #71480 - Anchor run_id to logical_date when create_cron_data_intervals is enab…

This is not a judgement of you or of your changes. We never told contributors before that opening many pull requests at once was a problem, so there is nothing to feel bad about - and nothing is lost: your branches, commits and the review history stay where they are.

What we ask you to do is to make your first prioritization decision: choose which of the pull requests above matter most to you, and reopen them (up to 5 open at a time, including the ones still open) with the "Reopen pull request" button or gh pr reopen <PR_NUMBER> --repo apache/airflow. Reopen the ones you are ready to follow through - keep them rebased, respond to review comments and fix failing checks.

While your pull requests are waiting for review, the most valuable thing you can do is help in other ways - reviewing other contributors' pull requests, helping with issues, and taking part in the discussions on the devlist and Slack.

Why we introduced the limit, what it means for you and how to reopen or restore a pull request is explained in https://github.com/apache/airflow/blob/main/contributing-docs/32_open_pull_request_limit.rst.

---

Drafted-by: Claude Code (Opus 5); reviewed by @potiuk before posting