potiuk opened a new pull request, #65344:
URL: https://github.com/apache/airflow/pull/65344
## Summary
The `/ui/partitioned_dag_runs` and
`/ui/pending_partitioned_dag_run/{dag_id}/{partition_key}` endpoints enforced
only asset-level access control (`requires_access_asset`) while returning
per-DAG metadata (target DAG id, DAG run state, partition keys, asset
expressions). They did not call `requires_access_dag` and did not apply the
`ReadableDagsFilterDep` filter used by every other sibling route that returns
DAG data.
This change brings both endpoints in line with the established pattern (used
by `next_run_assets` in `assets.py`, `dependencies.py`, `structure.py`, etc.):
- **Endpoint 1** (`GET /partitioned_dag_runs`): adds `ReadableDagsFilterDep`
parameter; filters the query with
`AssetPartitionDagRun.target_dag_id.in_(readable_dag_ids)`.
- **Endpoint 2** (`GET
/pending_partitioned_dag_run/{dag_id}/{partition_key}`): adds
`Depends(requires_access_dag(method="GET"))` to the dependencies list. Since
`dag_id` is a path parameter, `requires_access_dag` extracts it automatically.
## Test plan
- [x] Existing tests pass (admin user continues to see all partitioned DAG
runs; query counts bumped +1 for the new `get_authorized_dag_ids` call)
- [x] New test: mock `get_authorized_dag_ids` to return a set excluding the
test DAG; call the list endpoint; assert the restricted DAG's partitioned runs
are not returned
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Opus 4.6 (1M context)
Generated-by: Claude Opus 4.6 (1M context) following the guidelines at
https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
