rjgoyln opened a new pull request, #71113: URL: https://github.com/apache/airflow/pull/71113
## Summary The five backfill routes that name a backfill in their path fell back to the `dag_id` supplied on the request — body or query string — whenever the id matched no row, so an unknown id and a backfill on a Dag the caller cannot see answered differently, 404 against 403. That difference enumerates backfill ids across Dags. The path names the backfill, so its row is now the only thing those routes authorize against, and an id the caller may not see answers exactly as a missing one does. A caller who may read the Dag keeps the Forbidden answer on a write they are not allowed: they can already list that Dag's backfills, so hiding it would only cost them the reason their request was refused. The list, create and dry-run routes name no backfill in their path and keep authorizing off the body. ## Behavior change On those five routes a Dag the caller cannot read now answers 404 rather than 403. closes: #71080 --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 5) Generated-by: Claude Code (Opus 5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
