This is an automated email from the ASF dual-hosted git repository.
vincbeck pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 9762aac0d92 docs: clearer comment on multi-tenancy in the execution
API (#64246)
9762aac0d92 is described below
commit 9762aac0d92d053102bebccf5de3ef12f3650c2d
Author: Arnout Engelen <[email protected]>
AuthorDate: Thu Apr 16 15:32:25 2026 +0200
docs: clearer comment on multi-tenancy in the execution API (#64246)
Without this the invalid security reports will just keep
---
.../src/airflow/api_fastapi/execution_api/routes/connections.py | 9 +++++++--
.../src/airflow/api_fastapi/execution_api/routes/variables.py | 9 ++++++++-
.../src/airflow/api_fastapi/execution_api/routes/xcoms.py | 9 +++++++--
3 files changed, 22 insertions(+), 5 deletions(-)
diff --git
a/airflow-core/src/airflow/api_fastapi/execution_api/routes/connections.py
b/airflow-core/src/airflow/api_fastapi/execution_api/routes/connections.py
index 9182570a01e..8289dcf97fb 100644
--- a/airflow-core/src/airflow/api_fastapi/execution_api/routes/connections.py
+++ b/airflow-core/src/airflow/api_fastapi/execution_api/routes/connections.py
@@ -33,13 +33,18 @@ async def has_connection_access(
token=CurrentTIToken,
) -> bool:
"""Check if the task has access to the connection."""
- # TODO: Placeholder for actual implementation
-
log.debug(
"Checking access for task instance with key '%s' to connection '%s'",
token.id,
connection_id,
)
+
+ # The current version of Airflow does not support true
+ # multi-tenancy yet (this is well-documented at
+ #
https://airflow.apache.org/docs/apache-airflow/stable/security/security_model.html#future-multi-tenancy-isolation),
+ # so for now we always return 'True' here.
+ # When we introduce true multi-tenancy in the future
+ # this would be the place to do add a check.
return True
diff --git
a/airflow-core/src/airflow/api_fastapi/execution_api/routes/variables.py
b/airflow-core/src/airflow/api_fastapi/execution_api/routes/variables.py
index a139ce0c011..a0a7cb56045 100644
--- a/airflow-core/src/airflow/api_fastapi/execution_api/routes/variables.py
+++ b/airflow-core/src/airflow/api_fastapi/execution_api/routes/variables.py
@@ -37,13 +37,20 @@ async def has_variable_access(
):
"""Check if the task has access to the variable."""
write = request.method not in {"GET", "HEAD", "OPTIONS"}
- # TODO: Placeholder for actual implementation
+
log.debug(
"Checking %s access for task instance with key '%s' to variable '%s'",
"write" if write else "read",
token.id,
variable_key,
)
+
+ # The current version of Airflow does not support true
+ # multi-tenancy yet (this is well-documented at
+ #
https://airflow.apache.org/docs/apache-airflow/stable/security/security_model.html#limiting-dag-author-access-to-subset-of-dags),
+ # so for now we always return 'True' here.
+ # When we introduce true multi-tenancy in the future
+ # this would be the place to do add a check.
return True
diff --git a/airflow-core/src/airflow/api_fastapi/execution_api/routes/xcoms.py
b/airflow-core/src/airflow/api_fastapi/execution_api/routes/xcoms.py
index 69c0293b503..a7592e4f0f2 100644
--- a/airflow-core/src/airflow/api_fastapi/execution_api/routes/xcoms.py
+++ b/airflow-core/src/airflow/api_fastapi/execution_api/routes/xcoms.py
@@ -47,8 +47,6 @@ async def has_xcom_access(
token=CurrentTIToken,
) -> bool:
"""Check if the task has access to the XCom."""
- # TODO: Placeholder for actual implementation
-
write = request.method not in {"GET", "HEAD", "OPTIONS"}
log.debug(
@@ -57,6 +55,13 @@ async def has_xcom_access(
token.id,
xcom_key,
)
+
+ # The current version of Airflow does not support true
+ # multi-tenancy yet (this is well-documented at
+ #
https://airflow.apache.org/docs/apache-airflow/stable/security/security_model.html#limiting-dag-author-access-to-subset-of-dags),
+ # so for now we always return 'True' here.
+ # When we introduce true multi-tenancy in the future
+ # this would be the place to do add a check.
return True
