github-actions[bot] opened a new pull request, #71785: URL: https://github.com/apache/airflow/pull/71785
GET /api/v2/assets/events returned AssetEvent rows for every Dag. It is gated on requires_access_asset(method="GET"), which under the FAB auth manager checks the global "Assets" resource and does not consider which Dag produced the event, and the query applied no per-Dag row filter. A caller with read on a single Dag plus the global "Assets" resource could therefore read the source Dag, task and run identifiers, the created dag runs, and the task-authored "extra" payload of events belonging to every other Dag, and could target a specific one with ?source_dag_id=. The six sibling queued-events routes in the same file already apply ReadableDagsFilterDep; only this one did not. Add PermittedAssetEventFilter and apply it to the query. Events produced by a Dag's task are scoped to that Dag's readability. Events with no source Dag — created through the API, or emitted by a watcher — carry no per-Dag key to authorize on and stay visible to any caller who may read assets. The filter is applied inside paginated_select rather than after the fact, so total_entries and pagination are scoped too and the existence of hidden events does not leak either. Test fixtures that create events with a source_dag_id now register the corresponding Dag, since the scoping resolves against DagModel and the fixtures previously referenced Dags that did not exist. The query-count assertion moves from 4 to 5: resolving the caller's readable Dags costs one query, the same cost the queued-events routes already pay. (cherry picked from commit f01520cbd1b20ac6beef80e244452adfa39566c9) Co-authored-by: Jarek Potiuk <[email protected]> Generated-by: Claude Opus 5 (1M context) following the guidelines at https: //github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
