potiuk opened a new pull request, #70893:
URL: https://github.com/apache/airflow/pull/70893
Two authorization checks build `DagDetails(id=dag_id)` without `team_name`:
- `materialize_asset`, where the Dag is resolved from the asset rather than
named by the caller;
- the XCom-specific check in `wait_dag_run_until_finished`.
Every other call site resolves the team with `DagModel.get_team_name` and
passes
it -- `security.py:194`, `security.py:235`, `security.py:868`,
`import_error.py:314`, `services/public/task_instances.py:405`.
### Why it matters
A team-aware auth manager distinguishes a team-scoped Dag from a global one
by
that field. The Keycloak manager, for instance, selects the resource it asks
about from it -- `DAG:<team>` when set, plain `DAG` when not -- so omitting
it
asks about a differently-scoped resource than the one being acted on.
`wait_dag_run_until_finished` is the clearer illustration: its route
dependency
already resolves the team for the RUN check, so the two checks in the same
handler disagreed about the scope of the same Dag.
### Approach
Resolve the team at both sites with `DagModel.get_team_name(dag_id,
session=session)`,
reusing the request session rather than opening a new one.
After this, `grep -rn "DagDetails(id=" airflow-core/src` returns no call site
without `team_name`.
### Test plan
- [x] `test_authorizes_against_the_dags_team` -- parametrized over a
team-scoped
Dag and a global one; asserts the `DagDetails` reaching the auth
manager
carries the resolved team
- [x] Verified against unmodified code: the team-scoped case **fails**, the
global case passes either way -- so the test pins the resolution, not
the
plumbing
- [x] `test_assets.py` -- 178 passed
- [x] `test_dag_run.py` -- 358 passed; the 2 failures in
`TestBulkClearDagRuns` / `TestBulkDagRuns` (`UNIQUE constraint failed:
team.name`) are **pre-existing** and reproduce identically on
unmodified
`main`
- [x] `ruff check` / `ruff format` clean
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Opus 5 (1M context)
Generated-by: Claude Opus 5 (1M context) following the guidelines at
https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
