Vamsi-klu opened a new pull request, #70661:
URL: https://github.com/apache/airflow/pull/70661
Users with Dag-specific read access should be able to load the serialized
topology used by graph and task-group views without unrelated Dag-run
permissions.
The task-group route `/dags/{dag_id}/tasks/group/{group_id}` mounts the
group context, which calls `/ui/structure/structure_data`. That endpoint
returns serialized Dag topology: task/group nodes, edges, and optional
dependency nodes. It does not return task-instance runtime state.
The previous authorization required `DagAccessEntity.TASK_INSTANCE`, which
maps to both “Task Instances” and “DAG Runs” in FAB. As a result, a user with
read access to a specific Dag and Task Instances could still be denied topology
data because they lacked the unrelated Dag Runs permission.
This change:
- Keeps the base `requires_access_dag("GET")` check.
- Requires `DagAccessEntity.DEPENDENCIES` only when
`external_dependencies=true`.
- Removes the unrelated task-instance requirement from the topology response.
- Adds regression coverage for Dag-specific access, unreadable Dags,
conditional dependency access, and the absence of task-instance permission.
Validation:
- Full Breeze endpoint test file: `31 passed`.
- Regular prek stage: passed.
- Manual prek stage: passed.
- Selective-check analysis: API/Always scope selected successfully.
- Browser verification with FAB: the actual task-group page loaded for a
user whose Dag access was limited to `can_read` on `DAG:example_task_group`,
without global Dag or Dag-run read permission. The structure request returned
`200`, and an ungranted Dag returned `403`.
This is a fresh PR because GitHub would not reopen #69375 after its branch
was rebased and force-pushed, as permitted by the stale-draft closure note.
closes: #62532
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes - Codex (GPT-5)
Generated-by: Codex (GPT-5) following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
