Repository navigation
Scope asset Dag and task references to readable Dags - #74836
Merged
potiuk merged 3 commits intoOct 19, 2026
Merged
Conversation
The asset list and detail endpoints (public and UI) returned every scheduled Dag, producing task and consuming task reference of an asset, including ones that belong to Dags the requesting user cannot read. Those nested references are now narrowed to the user's readable Dags. Generated-by: Claude Opus 5 following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions
potiuk
requested review from
bugraoz93,
choo121600,
ephraimbuddy,
henry3260,
jason810496,
pierrejeambrun,
rawwar and
shubhamraj-git
as code owners
October 16, 2026 04:16
Generated-by: Claude Opus 5 following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions
Member
Author
|
@pierrejeambrun @vincbeck Could one of you take a look? It's targeted at 3.4.0 and needs a review to make the cut on 2026-10-19. |
vatsrahul1001
approved these changes
Oct 18, 2026
vatsrahul1001
left a comment
vatsrahul1001
left a comment
Contributor
There was a problem hiding this comment.
Looks good to me. The references are narrowed in one place, the queries already eager-load all three relationships so there is no extra N+1, and the tests cover the list, detail and UI endpoints.
Contributor
|
Could use reviews from @pierrejeambrun @vincbeck before merging. |
With a None default, a caller that forgot the argument got every Dag and task reference back unfiltered. Without a default, each caller has to say whether the references are narrowed, so a new endpoint fails closed instead of leaking references to Dags the user cannot read. Generated-by: Claude Opus 5
vincbeck
approved these changes
Oct 19, 2026
1 task done
Contributor
Backport successfully created: v3-4-testNote: As of Merging PRs targeted for Airflow 3.X In matter of doubt please ask in #release-management Slack channel.
|
potiuk
added a commit
that referenced
this pull request
Oct 19, 2026
) (#75107) * Scope asset Dag and task references to readable Dags The asset list and detail endpoints (public and UI) returned every scheduled Dag, producing task and consuming task reference of an asset, including ones that belong to Dags the requesting user cannot read. Those nested references are now narrowed to the user's readable Dags. Generated-by: Claude Opus 5 following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Rename newsfragment to the PR number Generated-by: Claude Opus 5 following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Require readable_dag_ids when building an asset response With a None default, a caller that forgot the argument got every Dag and task reference back unfiltered. Without a default, each caller has to say whether the references are narrowed, so a new endpoint fails closed instead of leaking references to Dags the user cannot read. (cherry picked from commit 99f2b86) Generated-by: Claude Opus 5 Co-authored-by: Jarek Potiuk <jarek@potiuk.com>
vatsrahul1001
pushed a commit
that referenced
this pull request
Oct 20, 2026
) (#75107) * Scope asset Dag and task references to readable Dags The asset list and detail endpoints (public and UI) returned every scheduled Dag, producing task and consuming task reference of an asset, including ones that belong to Dags the requesting user cannot read. Those nested references are now narrowed to the user's readable Dags. Generated-by: Claude Opus 5 following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Rename newsfragment to the PR number Generated-by: Claude Opus 5 following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Require readable_dag_ids when building an asset response With a None default, a caller that forgot the argument got every Dag and task reference back unfiltered. Without a default, each caller has to say whether the references are narrowed, so a new endpoint fails closed instead of leaking references to Dags the user cannot read. (cherry picked from commit 99f2b86) Generated-by: Claude Opus 5 Co-authored-by: Jarek Potiuk <jarek@potiuk.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
GET /api/v2/assets,GET /api/v2/assets/{asset_id}and the UIGET /ui/assetsendpoint return, for each asset, thescheduled_dags,producing_tasksandconsuming_tasksreferences. The asset list itself is already scoped to the assets the user can read, but these nested references were returned unfiltered, so a user who can read an asset but only some of the Dags using it would still see the Dag IDs and task IDs of the other Dags.This change narrows those three nested lists to the Dags the user can read, using the same
ReadableDagsFilterDepalready used by the queued-event and dependency-graph endpoints. The filtering lives inAssetResponse.from_asset_row, and the public list and detail endpoints now build their responses through that helper instead of duplicating its body. Users with read access to all Dags see no difference. The asset alias endpoints return no Dag references, and the UI dependency graph already filters by readable Dags, so neither needs a change.Tests: new tests for the public list, public detail and UI list endpoints check that a user who can read only
dag_asees onlydag_areferences, that no references come back when no Dags are readable, and that every reference comes back when all Dags are readable. The pinned query counts go up by one for the readable-Dags lookup.Was generative AI tooling used to co-author this PR?
Generated-by: Claude Opus 5 following the guidelines