rjgoyln opened a new pull request, #71507:
URL: https://github.com/apache/airflow/pull/71507

   ## Summary
   
   Every request that lists Dags narrows its statements to the set of Dag ids 
the user may read. On a deployment with thousands of Dags that set is spliced 
in as a literal four times over per Dag-list request — the main query, the 
latest-run subquery, the paginated filters and the count — and the Dag list 
page fires two or three such requests. When the user is authorized on every Dag 
the set excludes nothing, so the cost grows with the deployment while changing 
no result.
   
   Auth managers can now declare that their Dag decisions don't depend on the 
Dag id, and Airflow stops narrowing those queries. The hook defaults to 
denying, so an auth manager that ignores it behaves as before. FAB was already 
computing this and discarding it; `SimpleAuthManager` declares it for admins, 
the only role whose access doesn't also depend on the Dag's team.
   
   It does not fix the latency reported in #71499: there the per-Dag 
authorization is one HTTP call per Dag in the Keycloak auth manager, whose 
batch fix is blocked upstream, and Keycloak keeps denying the new hook. 
Streaming the list as that issue proposes cannot help on its own either, since 
authorization runs in a dependency that must complete before the first byte.
   
   ## Change
   
   Only `PermittedDagFilter` drops its predicate. Its subclasses keep theirs 
because `dag_run`, `backfill`, `dag_warning` and `log` have no cascading 
foreign key to `dag.dag_id` — rows there can outlive the Dag they name, and the 
predicate is what hides those leftovers. A parametrized test pins that 
invariant.
   
   The filter still exposes the full permitted set, so the call sites reading 
it are untouched and cannot fail open; skipping the enumeration itself is 
separate work. `GET /ui/dags/timetable_types` and `PATCH /dags` reach the same 
short-circuit through the shared dependency, and both query `dag` itself, so 
their results are unchanged too.
   
   ## Behavior change
   
   None: the predicate is dropped only when the permitted set already covers 
every Dag.
   
   related: #71499
   
   ---
   
   ##### Was generative AI tooling used to co-author this PR?
   
   - [X] Yes — Claude Code (Opus 5)
   
   Generated-by: Claude Code (Opus 5) following [the 
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to