The GitHub Actions job "Tests (ARM)" on airflow.git/v3-3-test has failed. Run started by GitHub user potiuk (triggered by potiuk).
Head commit for run: e26a4cfe458def722555d38568c97bbe7b7442d7 / github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> [v3-3-test] Scope /assets/events to the Dags the caller may read (#71741) (#71785) GET /api/v2/assets/events returned AssetEvent rows for every Dag. It is gated on requires_access_asset(method="GET"), which under the FAB auth manager checks the global "Assets" resource and does not consider which Dag produced the event, and the query applied no per-Dag row filter. A caller with read on a single Dag plus the global "Assets" resource could therefore read the source Dag, task and run identifiers, the created dag runs, and the task-authored "extra" payload of events belonging to every other Dag, and could target a specific one with ?source_dag_id=. The six sibling queued-events routes in the same file already apply ReadableDagsFilterDep; only this one did not. Add PermittedAssetEventFilter and apply it to the query. Events produced by a Dag's task are scoped to that Dag's readability. Events with no source Dag — created through the API, or emitted by a watcher — carry no per-Dag key to authorize on and stay visible to any caller who may read assets. The filter is applied inside paginated_select rather than after the fact, so total_entries and pagination are scoped too and the existence of hidden events does not leak either. Test fixtures that create events with a source_dag_id now register the corresponding Dag, since the scoping resolves against DagModel and the fixtures previously referenced Dags that did not exist. The query-count assertion moves from 4 to 5: resolving the caller's readable Dags costs one query, the same cost the queued-events routes already pay. (cherry picked from commit f01520cbd1b20ac6beef80e244452adfa39566c9) Generated-by: Claude Opus 5 (1M context) following the guidelines at https: //github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions Co-authored-by: Jarek Potiuk <[email protected]> Report URL: https://github.com/apache/airflow/actions/runs/32173959470 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
