rjgoyln opened a new pull request, #71507: URL: https://github.com/apache/airflow/pull/71507
## Summary Every request that lists Dags narrows its statements to the set of Dag ids the user may read. On a deployment with thousands of Dags that set is spliced in as a literal four times over per Dag-list request — the main query, the latest-run subquery, the paginated filters and the count — and the Dag list page fires two or three such requests. When the user is authorized on every Dag the set excludes nothing, so the cost grows with the deployment while changing no result. Auth managers can now declare that their Dag decisions don't depend on the Dag id, and Airflow stops narrowing those queries. The hook defaults to denying, so an auth manager that ignores it behaves as before. FAB was already computing this and discarding it; `SimpleAuthManager` declares it for admins, the only role whose access doesn't also depend on the Dag's team. It does not fix the latency reported in #71499: there the per-Dag authorization is one HTTP call per Dag in the Keycloak auth manager, whose batch fix is blocked upstream, and Keycloak keeps denying the new hook. Streaming the list as that issue proposes cannot help on its own either, since authorization runs in a dependency that must complete before the first byte. ## Change Only `PermittedDagFilter` drops its predicate. Its subclasses keep theirs because `dag_run`, `backfill`, `dag_warning` and `log` have no cascading foreign key to `dag.dag_id` — rows there can outlive the Dag they name, and the predicate is what hides those leftovers. A parametrized test pins that invariant. The filter still exposes the full permitted set, so the call sites reading it are untouched and cannot fail open; skipping the enumeration itself is separate work. `GET /ui/dags/timetable_types` and `PATCH /dags` reach the same short-circuit through the shared dependency, and both query `dag` itself, so their results are unchanged too. ## Behavior change None: the predicate is dropped only when the permitted set already covers every Dag. related: #71499 --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 5) Generated-by: Claude Code (Opus 5) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
