henry3260 opened a new pull request, #73008:
URL: https://github.com/apache/airflow/pull/73008
## Why
`GET /ui/dependencies` scopes its graph by which Dags the caller may read,
but never by which assets. Both modes leak asset identity to a caller who can
read a Dag but not one of its assets:
- `dependency_type=scheduling` expands each readable Dag's
`asset_expression` into asset nodes whose label is the asset name.
- `dependency_type=data` guards the root asset only by checking that some
connected Dag is readable. Once that passes, the whole lineage graph is
expanded with asset names, and the traversal keeps walking outward through
assets the caller may not read.
The rest of the asset API already scopes responses with
`ReadableAssetsFilterDep` (#72682), and #72864 applies the same per-asset
readability to asset expressions. Asset names commonly encode bucket, table or
dataset names, so this is the same class of gap.
## What
- `airflow-core/src/airflow/api_fastapi/core_api/routes/ui/dependencies.py`:
inject `ReadableAssetsFilterDep` and pass the readable asset ids to both
service functions.
-
`airflow-core/src/airflow/api_fastapi/core_api/services/ui/dependencies.py`:
- New `hide_unreadable_assets` post-processes the finished graph, dropping
`asset` nodes the caller may not read and every edge touching them. Alias and
ref nodes carry no asset id to authorize on and are left in place, matching
#72864.
- `get_data_dependencies` returns the same empty result as an unrelated
asset when the root asset is unreadable, so the route's existing 404 path
serves it and the endpoint is not an oracle for asset ids. The BFS intersects
each round with the readable set so it does not expand through an unreadable
asset.
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Code (Fable 5.1)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
