SameerMesiah97 commented on code in PR #70893:
URL: https://github.com/apache/airflow/pull/70893#discussion_r3695619051
##########
airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_assets.py:
##########
@@ -2141,6 +2141,32 @@ def
test_should_respond_200_with_partition_date_for_partitioned_dag(
assert dag_run.partition_key == "2025-06-01T00:00:00"
assert dag_run.partition_date == timezone.datetime(2025, 6, 1)
+ @pytest.mark.parametrize("team_name", ["team_b", None])
+ def test_authorizes_against_the_dags_team(self, test_client, session,
team_name):
+ """The Dag is resolved from the asset, so its team must be resolved
and passed too.
+
+ A team-aware auth manager distinguishes a team-scoped Dag from a
global one by this field,
+ so leaving it ``None`` asks about a differently-scoped resource than
the one being acted on.
+ """
+ recorded = []
+
+ auth_manager = mock.Mock()
+ auth_manager.is_authorized_dag.side_effect = lambda **kw:
recorded.append(kw) or True
+
+ with (
+ mock.patch(
+
"airflow.api_fastapi.core_api.routes.public.assets.get_auth_manager",
+ return_value=auth_manager,
+ ),
+ mock.patch.object(DagModel, "get_team_name",
return_value=team_name),
+ ):
+ test_client.post("/assets/1/materialize")
+
+ assert recorded, "the authorization check did not run"
+ details = recorded[0]["details"]
+ assert details.id == self.DAG_ASSET1_ID
+ assert details.team_name == team_name
Review Comment:
I think this test could be more thorough. Please see the below:
```
@pytest.mark.parametrize("team_name", ["team_b", None])
def test_authorizes_against_the_dags_team(self, test_client, session,
team_name):
"""The Dag is resolved from the asset, so its team must be resolved
and passed too.
A team-aware auth manager distinguishes a team-scoped Dag from a
global one by this field,
so leaving it ``None`` asks about a differently-scoped resource than
the one being acted on.
"""
recorded = []
auth_manager = mock.Mock()
auth_manager.is_authorized_dag.side_effect = lambda **kw:
recorded.append(kw) or True
with (
mock.patch(
"airflow.api_fastapi.core_api.routes.public.assets.get_auth_manager",
return_value=auth_manager,
),
mock.patch.object(
DagModel,
"get_team_name",
return_value=team_name,
) as mock_get_team_name,
):
response = test_client.post("/assets/1/materialize")
assert response.status_code == 200
mock_get_team_name.assert_called_once_with(
self.DAG_ASSET1_ID,
session=session,
)
assert len(recorded) == 1, "expected exactly one authorization check"
details = recorded[0]["details"]
assert details.id == self.DAG_ASSET1_ID
assert details.team_name == team_name
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
