henry3260 opened a new pull request, #73007:
URL: https://github.com/apache/airflow/pull/73007
## Why
`POST /assets/events` is guarded by `requires_access_asset(method="POST")`,
but that dependency reads the asset id from the URL path. This endpoint carries
the id in the request body, so the dependency runs before the body is parsed
and passes an empty `AssetDetails(id=None)` to the auth manager. The only
question the auth manager can answer is whether the caller may post to any
asset at all.
An auth manager that scopes assets by id, name, or uri, the granularity
added in #72682, therefore cannot deny an event for an asset the caller may not
touch, and the response still returns that asset's name and uri. The built-in
Simple and FAB auth managers ignore `details`, so they are unaffected. `POST
/assets/{asset_id}/materialize` is also unaffected because its id is in the
path.
## What
- `airflow-core/src/airflow/api_fastapi/core_api/routes/public/assets.py`:
after `create_asset_event` resolves the `AssetModel` from the body, it calls
`is_authorized_asset` with the full `AssetDetails(id, name, uri)` and raises
403 when denied. This mirrors the explicit second authorization
`materialize_asset` performs on the Dag it resolves. The dependency-level check
stays in place.
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Code (Fable 5.1)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
