(airflow) branch v3-0-test updated: [v3-0-test] Fix: Apply DAG permission filter to dashboard (closes #53938) (#54126) (#54215)

[pierrejeambrun]

This is an automated email from the ASF dual-hosted git repository.

pierrejeambrun pushed a commit to branch v3-0-test
in repository https://gitbox.apache.org/repos/asf/airflow.git


The following commit(s) were added to refs/heads/v3-0-test by this push:
     new 68ca65bb5fd [v3-0-test] Fix: Apply DAG permission filter to dashboard 
(closes #53938) (#54126) (#54215)
68ca65bb5fd is described below

commit 68ca65bb5fda74adf9ec7030cfacd6fb0f731404
Author: github-actions[bot] 
<41898282+github-actions[bot]@users.noreply.github.com>
AuthorDate: Thu Aug 7 13:40:04 2025 +0200

    [v3-0-test] Fix: Apply DAG permission filter to dashboard (closes #53938) 
(#54126) (#54215)
    
    (cherry picked from commit 5964ab54ee636628ca90cdeb3cac09e435f54e2b)
    
    Co-authored-by: suhail-zemoso <suhail.g...@zemosolabs.com>
---
 .../src/airflow/api_fastapi/core_api/routes/ui/dashboard.py   | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git 
a/airflow-core/src/airflow/api_fastapi/core_api/routes/ui/dashboard.py 
b/airflow-core/src/airflow/api_fastapi/core_api/routes/ui/dashboard.py
index f3c01983641..faa5e83cd77 100644
--- a/airflow-core/src/airflow/api_fastapi/core_api/routes/ui/dashboard.py
+++ b/airflow-core/src/airflow/api_fastapi/core_api/routes/ui/dashboard.py
@@ -29,7 +29,7 @@ from airflow.api_fastapi.core_api.datamodels.ui.dashboard 
import (
     HistoricalMetricDataResponse,
 )
 from airflow.api_fastapi.core_api.openapi.exceptions import 
create_openapi_http_exception_doc
-from airflow.api_fastapi.core_api.security import requires_access_dag
+from airflow.api_fastapi.core_api.security import ReadableDagsFilterDep, 
requires_access_dag
 from airflow.models.dag import DagModel
 from airflow.models.dagrun import DagRun, DagRunType
 from airflow.models.taskinstance import TaskInstance
@@ -50,10 +50,12 @@ dashboard_router = AirflowRouter(tags=["Dashboard"], 
prefix="/dashboard")
 def historical_metrics(
     session: SessionDep,
     start_date: DateTimeQuery,
+    readable_dags_filter: ReadableDagsFilterDep,
     end_date: OptionalDateTimeQuery = None,
 ) -> HistoricalMetricDataResponse:
     """Return cluster activity historical metrics."""
     current_time = timezone.utcnow()
+    permitted_dag_ids = readable_dags_filter.value
     # DagRuns
     dag_run_types = session.execute(
         select(DagRun.run_type, func.count(DagRun.run_id))
@@ -61,6 +63,7 @@ def historical_metrics(
             func.coalesce(DagRun.start_date, current_time) >= start_date,
             func.coalesce(DagRun.end_date, current_time) <= 
func.coalesce(end_date, current_time),
         )
+        .where(DagRun.dag_id.in_(permitted_dag_ids))
         .group_by(DagRun.run_type)
     ).all()
 
@@ -70,6 +73,7 @@ def historical_metrics(
             func.coalesce(DagRun.start_date, current_time) >= start_date,
             func.coalesce(DagRun.end_date, current_time) <= 
func.coalesce(end_date, current_time),
         )
+        .where(DagRun.dag_id.in_(permitted_dag_ids))
         .group_by(DagRun.state)
     ).all()
 
@@ -81,6 +85,7 @@ def historical_metrics(
             func.coalesce(DagRun.start_date, current_time) >= start_date,
             func.coalesce(DagRun.end_date, current_time) <= 
func.coalesce(end_date, current_time),
         )
+        .where(DagRun.dag_id.in_(permitted_dag_ids))
         .group_by(TaskInstance.state)
     ).all()
 
@@ -110,11 +115,14 @@ def historical_metrics(
 )
 def dag_stats(
     session: SessionDep,
+    readable_dags_filter: ReadableDagsFilterDep,
 ) -> DashboardDagStatsResponse:
     """Return basic DAG stats with counts of DAGs in various states."""
+    permitted_dag_ids = readable_dags_filter.value
     latest_dates_subq = (
         select(DagRun.dag_id, 
func.max(DagRun.logical_date).label("max_logical_date"))
         .where(DagRun.logical_date.is_not(None))
+        .where(DagRun.dag_id.in_(permitted_dag_ids))
         .group_by(DagRun.dag_id)
         .subquery()
     )
@@ -131,6 +139,7 @@ def dag_stats(
             (DagRun.dag_id == latest_dates_subq.c.dag_id)
             & (DagRun.logical_date == latest_dates_subq.c.max_logical_date),
         )
+        .where(DagRun.dag_id.in_(permitted_dag_ids))
         .cte()
     )