pierrejeambrun commented on code in PR #72655:
URL: https://github.com/apache/airflow/pull/72655#discussion_r3987827103
##########
airflow-core/docs/administration-and-deployment/plugins.rst:
##########
@@ -225,6 +225,53 @@ definitions in Airflow.
app_with_metadata = {"app": app, "url_prefix": "/some_prefix", "name":
"Name of the App"}
+.. warning::
+
+ **Airflow does not authenticate plugin FastAPI apps. Authenticating them
is the
+ plugin author's responsibility.**
+
+ Airflow authenticates the core API with a router-level dependency. A
plugin app is
Review Comment:
I'll do that in a follow up
##########
airflow-core/docs/administration-and-deployment/plugins.rst:
##########
@@ -225,6 +225,53 @@ definitions in Airflow.
app_with_metadata = {"app": app, "url_prefix": "/some_prefix", "name":
"Name of the App"}
+.. warning::
+
+ **Airflow does not authenticate plugin FastAPI apps. Authenticating them
is the
+ plugin author's responsibility.**
+
+ Airflow authenticates the core API with a router-level dependency. A
plugin app is
+ attached with ``app.mount()``, and a Starlette mount has its own route
table and
+ inherits none of the parent's dependencies, so that dependency never
reaches a
+ plugin's routes. No middleware in the API server authenticates them either.
+
+ Every route a plugin exposes is therefore reachable by **anonymous
callers** unless
+ the plugin authenticates it itself. The minimal ``app`` above is a
structural
+ illustration, not a template to deploy as-is.
+
+ Depend on ``GetUserDep`` to require a caller Airflow has authenticated:
+
+ .. code-block:: python
+
+ from fastapi import FastAPI
+
+ from airflow.api_fastapi.core_api.security import GetUserDep
+
+ app = FastAPI()
+
+
+ @app.get("/dashboard")
+ def dashboard(user: GetUserDep):
+ return {"user": user.get_name()}
+
+ Prefer attaching the dependency once, at the application or router level,
so that a
+ route added later does not silently ship unauthenticated:
+
+ .. code-block:: python
+
+ from fastapi import Depends, FastAPI
+
+ from airflow.api_fastapi.core_api.security import get_user
+
+ app = FastAPI(dependencies=[Depends(get_user)])
+
+ Authentication is not authorization. ``GetUserDep`` establishes *who* is
calling;
+ whether that user may perform a given action remains the plugin's own
decision. This
+ applies to team scoping too — in a multi-team deployment, a plugin that
does not check
+ the caller's team serves every team's users the same data.
+
+.. code-block:: python
Review Comment:
same
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
