github-actions[bot] opened a new pull request, #75390: URL: https://github.com/apache/airflow/pull/75390
* Hide assets the caller may not read from the UI dependencies graph The dependencies graph scoped its nodes by which Dags the caller may read, but never by which assets. A caller who can read a Dag saw every asset that Dag produces or consumes, name included, even when the auth manager scopes that asset away from them; the data graph would also expand outward through such an asset. Asset names commonly encode bucket, table or dataset names, so this is the same class of gap the rest of the asset API closed. * Hide an unenriched asset leaf from the data dependencies graph An asset_expression leaf whose id the Dag processor has not filled in yet cannot be authorized, so it must be hidden like any other asset the caller may not read. The data graph instead parsed the id out of the node, which failed the request outright rather than dropping the node. (cherry picked from commit edcd4a50335e87fa6e7a0b3fc1ab72d42c7cbca7) Co-authored-by: Henry Chen <[email protected]> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
