nuefis-mkarpisek opened a new issue, #72333:
URL: https://github.com/apache/airflow/issues/72333
### Description
#### Description / Motivation
With AIP-67 (Multi-team) and AIP-56 (Extensible Auth Manager), Airflow 3
empowers multi-tenant platforms by isolating DAGs, Connections, Variables, and
Pools per team.
However, the Assets API (`/public/assets`) currently lacks query-level
filtering:
1. `AssetDetails` only contains `id: str | None`, omitting `uri` and `name`.
2. `BaseAuthManager` has `filter_authorized_dag_ids`,
`filter_authorized_connections`, etc., but no `filter_authorized_assets` or
`get_authorized_assets`.
3. The `GET /public/assets` endpoint only executes a coarse
`requires_access_asset(method="GET", details=AssetDetails(id=None))` and
executes an unfiltered `select(AssetModel)`.
In multi-tenant and enterprise compliance environments, exposing all
internal asset URIs across tenants in the UI/API can lead to data-catalog
leakage and breaks team-level isolation.
#### Proposed Solution
1. **Extend `AssetDetails`**: Add `uri: str | None = None` and `name: str |
None = None`.
2. **Add `filter_authorized_assets` & `get_authorized_assets` to
`BaseAuthManager`**:
- Default behavior: Returns all asset IDs (100% backward compatible for
single-tenant/default setups).
- Custom AuthManagers (e.g. team/URI-based) can override it to restrict
assets based on URI patterns or team ownership.
3. **Add `permitted_asset_filter_factory` in
`airflow.api_fastapi.core_api.security`**:
- Inject SQL `AssetModel.id.in_(permitted_asset_ids)` into `get_assets`.
#### Backward Compatibility
- Fully backward compatible: Default `BaseAuthManager` implementation
returns all assets, ensuring zero impact on standard deployments.
### Use case/motivation
_No response_
### Related issues
_No response_
### Are you willing to submit a PR?
- [ ] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of
Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
