o-nikolas commented on code in PR #68850:
URL: https://github.com/apache/airflow/pull/68850#discussion_r3456146297
##########
airflow-core/src/airflow/api_fastapi/execution_api/routes/xcoms.py:
##########
@@ -38,31 +38,70 @@
from airflow.utils.db import get_query_count
-async def has_xcom_access(
+def has_xcom_access(
dag_id: str,
run_id: str,
task_id: str,
xcom_key: Annotated[str, Path(alias="key", min_length=1)],
request: Request,
+ session: SessionDep,
token=CurrentTIToken,
) -> bool:
- """Check if the task has access to the XCom."""
+ """
+ Check whether the requesting task may access the XCom for ``dag_id``.
+
+ In multi-team mode, XCom access is scoped by team ownership (resolved via
the
+ ``dag -> bundle -> team`` chain). There is no cross-team XCom sharing:
+
+ * reads (``GET``/``HEAD``) are allowed for the requester's own team or for
+ global (teamless) dags;
+ * writes and deletes are allowed only for the requester's own team; a team
+ task may not mutate a global dag's XCom, mirroring how team-scoped
+ Variables and Connections behave.
+
+ When multi-team mode is disabled this is a no-op and all access is allowed,
+ consistent with Airflow's single-team security model where workers within a
+ deployment trust each other. Note this enforces the boundary at the
Execution
+ API only; it does not constrain code paths with direct database access
(e.g.
+ the Dag File Processor or Triggerer).
+ """
+ from airflow.configuration import conf
Review Comment:
Other usages of `conf` already existing in this module went with local
import, so I copied the same. They could both possibly be moved out, but since
we're close to the 3.3 deadline I don't really want to ruffle any more feathers
than I have to.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
