RehanAhmad25 commented on code in PR #72499:
URL: https://github.com/apache/airflow/pull/72499#discussion_r4387517271
##########
airflow-core/src/airflow/api_fastapi/core_api/routes/public/dag_run.py:
##########
@@ -149,7 +184,10 @@ def get_dag_run(dag_id: str, dag_run_id: str, session:
SessionDep) -> DAGRunResp
status.HTTP_404_NOT_FOUND,
f"The DagRun with dag_id: `{dag_id}` and run_id: `{dag_run_id}`
was not found",
)
- return dag_run
+ response = DAGRunResponse.model_validate(dag_run)
+ dag = get_dag_for_run(dag_bag, dag_run, session=session)
+ response.conf = _mask_password_conf(dag, response.conf)
Review Comment:
Yes, done. DAGRunResponse now redacts password-format conf keys itself: a
validator on conf uses the run's Dag and raises if no Dag is passed in, so a
new endpoint can't return unmasked conf by accident. Routes build it with
DAGRunResponse.from_dag_run(dag_run, dag), and the route-level helper is gone.
Moving it into the model also turned up an endpoint we'd missed, POST
/assets/{asset_id}/materialize, which returned the raw run. It's covered now,
with a test.
Two internal callers (the deadline callback context and the asset CLI) use
from_dag_run_unmasked on purpose, because they need the real value. Happy to
change those if you'd rather mask them too.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
