Repository navigation
Scope asset-wide queued event deletion to editable Dags - #74839
Merged
potiuk merged 3 commits intoOct 19, 2026
Merged
Conversation
DELETE /assets/{asset_id}/queuedEvents filtered the rows it removed by the
Dags the user can read, and checked Dag edit against an optional ?dag_id=
query parameter unrelated to those rows. The delete is now limited to the
queued events of Dags the user may edit, and the route no longer makes a
Dag-level check against a request-supplied dag_id.
Generated-by: Claude Opus 5 following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions
potiuk
requested review from
bugraoz93,
choo121600,
ephraimbuddy,
henry3260,
jason810496,
pierrejeambrun,
rawwar and
shubhamraj-git
as code owners
October 16, 2026 04:39
Generated-by: Claude Opus 5 following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions
Member
Author
|
@pierrejeambrun @vincbeck Could one of you take a look? It's targeted at 3.4.0 and needs a review to make the cut on 2026-10-19. |
Generated-by: Claude Opus 5 following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions
vatsrahul1001
approved these changes
Oct 18, 2026
vatsrahul1001
left a comment
vatsrahul1001
left a comment
Contributor
There was a problem hiding this comment.
Looks good to me. The delete is now scoped per row to the Dags the user may edit, and the tests cover the edit-on-one-Dag, read-only-on-another case with and without ?dag_id=.
Contributor
|
LGTM. Could use reviews from @pierrejeambrun @vincbeck before merging. |
Contributor
Backport successfully created: v3-4-testNote: As of Merging PRs targeted for Airflow 3.X In matter of doubt please ask in #release-management Slack channel.
|
github-actions Bot
pushed a commit
to aws-mwaa/upstream-to-airflow
that referenced
this pull request
Oct 19, 2026
…pache#74839) * Scope asset-wide queued event deletion to editable Dags DELETE /assets/{asset_id}/queuedEvents filtered the rows it removed by the Dags the user can read, and checked Dag edit against an optional ?dag_id= query parameter unrelated to those rows. The delete is now limited to the queued events of Dags the user may edit, and the route no longer makes a Dag-level check against a request-supplied dag_id. Generated-by: Claude Opus 5 following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Rename newsfragment to the PR number Generated-by: Claude Opus 5 following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Regenerate API permission docs (cherry picked from commit 8942dd4) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Generated-by: Claude Opus 5 following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions
aws-airflow-bot
pushed a commit
to aws-mwaa/upstream-to-airflow
that referenced
this pull request
Oct 19, 2026
…pache#74839) * Scope asset-wide queued event deletion to editable Dags DELETE /assets/{asset_id}/queuedEvents filtered the rows it removed by the Dags the user can read, and checked Dag edit against an optional ?dag_id= query parameter unrelated to those rows. The delete is now limited to the queued events of Dags the user may edit, and the route no longer makes a Dag-level check against a request-supplied dag_id. Generated-by: Claude Opus 5 following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Rename newsfragment to the PR number Generated-by: Claude Opus 5 following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Regenerate API permission docs (cherry picked from commit 8942dd4) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Generated-by: Claude Opus 5 following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions
vatsrahul1001
pushed a commit
that referenced
this pull request
Oct 19, 2026
…74839) (#75089) * Scope asset-wide queued event deletion to editable Dags DELETE /assets/{asset_id}/queuedEvents filtered the rows it removed by the Dags the user can read, and checked Dag edit against an optional ?dag_id= query parameter unrelated to those rows. The delete is now limited to the queued events of Dags the user may edit, and the route no longer makes a Dag-level check against a request-supplied dag_id. Generated-by: Claude Opus 5 following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Rename newsfragment to the PR number Generated-by: Claude Opus 5 following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Regenerate API permission docs (cherry picked from commit 8942dd4) Generated-by: Claude Opus 5 following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions Co-authored-by: Jarek Potiuk <jarek@potiuk.com>
vatsrahul1001
pushed a commit
that referenced
this pull request
Oct 20, 2026
…74839) (#75089) * Scope asset-wide queued event deletion to editable Dags DELETE /assets/{asset_id}/queuedEvents filtered the rows it removed by the Dags the user can read, and checked Dag edit against an optional ?dag_id= query parameter unrelated to those rows. The delete is now limited to the queued events of Dags the user may edit, and the route no longer makes a Dag-level check against a request-supplied dag_id. Generated-by: Claude Opus 5 following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Rename newsfragment to the PR number Generated-by: Claude Opus 5 following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions * Regenerate API permission docs (cherry picked from commit 8942dd4) Generated-by: Claude Opus 5 following the guidelines at https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions Co-authored-by: Jarek Potiuk <jarek@potiuk.com>
6 of 7 tasks
28 of 93 tasks
1 task done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
DELETE /assets/{asset_id}/queuedEventsis not tied to a single Dag, but it was guarded by a Dag-edit check that reads the Dag id from the path or, failing that, from a?dag_id=query parameter. The route has no Dag in its path, so the check was made against whatever Dag the caller named in the query string, while the rows actually deleted were filtered by the Dags the user can read. A user with edit on one Dag and read-only on others could therefore clear the pending asset-triggered queue of the read-only Dags.This change scopes the delete to the queued events of Dags the user may edit (
EditableDagsFilterDep) and removes the Dag-level check on this asset-wide route, the same way the asset-wideGET /assets/{asset_id}/queuedEventsroute relies on per-row scoping (readable Dags) rather than a request-supplied Dag id. Rows of Dags the user cannot edit are left in place; if none of the asset's queued events belong to an editable Dag, the route returns 404 as it already does when nothing matches. The per-Dag routes (/dags/{dag_id}/assets/...queuedEvents) are unchanged, since their Dag id comes from the path.Tests: a user with edit on
dag_aand read-only ondag_bdeleting the asset-wide queued events (with and without?dag_id=dag_a) leavesdag_b's row; a request where only read-only Dags have rows returns 404 and deletes nothing; and the route-dependency test now asserts that neither asset-wide queued-events route gates on a request-supplied Dag id (its suffix match previously also picked up the per-Dag route).Was generative AI tooling used to co-author this PR?
Generated-by: Claude Opus 5 following the guidelines