github-actions[bot] opened a new pull request, #71828: URL: https://github.com/apache/airflow/pull/71828
The three asset queued-events DELETE endpoints authorized the Dag axis with requires_access_dag(method="GET") — a read-level check — while deleting rows from AssetDagRunQueue, which cancels a Dag's pending asset-triggered scheduling. Every other Dag-scheduling mutation in the API requires Dag edit: Dag run clear, patch and delete use method="PUT"/"DELETE" with access_entity=RUN, and task-instance state changes use method="PUT". These three deletes were the only Dag-scheduling-state writes gated on read, so a caller holding delete on the global "Assets" resource plus only read on a Dag could suppress that Dag's asset-triggered runs. Change the Dag-axis gate on the three routes to method="PUT". The paired requires_access_asset(method="DELETE") and the ReadableDagsFilterDep row filter are unchanged; only the Dag axis moves from read to edit. The generated REST API permission reference is updated to match. The GET queued-events routes keep method="GET" — reading queued events is a read. Added a structural test asserting the Dag-axis method each queued-events route carries, so the read/write asymmetry cannot silently return. "dependant" is added to the spelling wordlist: it is FastAPI's own attribute name on a route. (cherry picked from commit 04145448135cfcc53644e8ca1a15fa188b129851) Co-authored-by: Jarek Potiuk <[email protected]> Generated-by: Claude Opus 5 (1M context) following the guidelines at https: //github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
