potiuk opened a new pull request, #71736:
URL: https://github.com/apache/airflow/pull/71736
The three asset queued-events `DELETE` endpoints authorize the Dag axis with
`requires_access_dag(method="GET")` — a read-level check — while deleting rows
from `AssetDagRunQueue`, which cancels a Dag's pending asset-triggered
scheduling.
Every other Dag-scheduling mutation in the API requires Dag edit:
* Dag run clear / patch / delete — `method="PUT"`/`"DELETE"` with
`access_entity=RUN`
* task-instance state changes — `method="PUT"`
These three deletes were the only Dag-scheduling-state writes gated on read.
A caller holding `can_delete` on the global `Assets` resource plus only
`can_read` on a Dag could therefore suppress that Dag's asset-triggered runs.
### Change
The Dag-axis gate on the three routes moves to `method="PUT"`. The paired
`requires_access_asset(method="DELETE")` and the `ReadableDagsFilterDep` row
filter are unchanged — only the Dag axis moves from read to edit.
The `GET` queued-events routes keep `method="GET"`; reading queued events is
a read.
The generated REST API permission reference picked the change up
automatically:
```diff
* - ``DELETE``
- ``/api/v2/dags/{dag_id}/assets/queuedEvents``
- ``DAG``
- - ``GET``
+ - ``PUT``
```
### Compatibility
This is a tightening, so a caller who previously succeeded with only Dag
read on these three endpoints will now get a 403. That is the intent, but it is
worth a second opinion on whether it needs a release-note callout beyond the
permission-reference diff.
### Testing
Added `TestQueuedEventsDagAxisAuthorization`, which introspects the
registered routes and asserts the `method` each `requires_access_dag` was built
with — `PUT` on the three deletes, `GET` on the two reads. Verified it is not
vacuous: reverting the source change makes exactly the three delete assertions
fail while the two read assertions still pass.
All 185 tests in `test_assets.py` pass.
`dependant` is added to `docs/spelling_wordlist.txt` — it is FastAPI's own
attribute name on a route object, which codespell otherwise flags.
---
Generated-by: Claude Opus 5 (1M context) following the guidelines at
https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
