pierrejeambrun opened a new pull request, #72640: URL: https://github.com/apache/airflow/pull/72640
The empty-results branch of the `/ui/partitioned_dag_runs` listing raised 404 when a Dag did not exist, but returned 200-empty when a Dag existed but was outside the caller's permitted set (the readable-dags row filter had already dropped its rows). A caller could therefore probe by `dag_id` and learn which identifiers exist beyond what they are allowed to read. Scope the existence probe to readable Dags so the two cases collapse to the same 404, matching the "so their existence does not leak either" idiom used by `PermittedEventLogFilter` / `PermittedAssetEventFilter`. Behavior is unchanged for callers with full Dag access. --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes — Claude Code (Opus 4.7) Generated-by: Claude Code (Opus 4.7) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
