potiuk opened a new pull request, #65329:
URL: https://github.com/apache/airflow/pull/65329
## Summary
The public Import Errors API used to match `ParseImportError.filename`
against `DagModel.fileloc`. In real deployments `fileloc` is an absolute path
while `filename` is relative, so the file-to-DAG resolution often came back
empty and the single endpoint fell through to returning the raw error. The list
endpoint had a related gap: its CTE was pre-filtered by the caller-visible
subset of DAGs, so the per-file authorization check only ever saw the DAGs the
caller could already read — a file containing a mix of readable and unreadable
DAGs passed the check on the readable subset alone.
This PR:
* **Single endpoint** now matches `ParseImportError.filename` against
`DagModel.relative_fileloc` + `DagModel.bundle_name`, which is the same key the
list endpoint already uses for its join. When the resolved DAG set is empty,
the stacktrace is now **redacted** rather than returned verbatim.
* **List endpoint** splits the previous `visible_files_cte` into two CTEs:
1. `readable_files_cte` — the `(relative_fileloc, bundle_name)` pairs
where the caller can read at least one DAG.
2. `file_dags_cte` — the full `(relative_fileloc, dag_id, bundle_name)`
set for those files, **not** filtered by `readable_dag_ids`.
The per-file authorization check in the groupby loop now receives the
complete DAG set per file, so the existing `batch_is_authorized_dag` call
correctly detects co-located DAGs outside the caller's scope.
* **Same fall-through** in the list endpoint (file has no matching DAGs in
`DagModel`) now **redacts** the stacktrace before appending.
## Test plan
- [x] New `TestImportErrorFileAuthorization` class with four tests. All
fixtures use **distinct `fileloc` (absolute) and `relative_fileloc`
(relative)** strings so the previously-silent absolute-vs-relative gap is
actually exercised:
- single endpoint resolves via `relative_fileloc` and enforces
authorization (no 200 fall-through when `fileloc` is absolute);
- single endpoint redacts when the file has no matching `DagModel` rows;
- list endpoint redacts a mixed file where the caller can read one DAG but
not a co-located DAG, via a `side_effect` that only permits strict subsets of
the caller's readable set;
- list endpoint redacts when the file has no matching `DagModel` rows.
- [x] Pre-existing `test_get_import_error__no_dag_in_dagmodel` is updated to
assert the new redaction; all other pre-existing tests in
`test_import_error.py` pass unchanged. **31/31** in total.
- [x] `prek run --from-ref main --stage pre-commit` clean.
- [x] `mypy
airflow-core/src/airflow/api_fastapi/core_api/routes/public/import_error.py`
clean.
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Opus 4.6 (1M context)
Generated-by: Claude Opus 4.6 (1M context) following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
