henry3260 opened a new pull request, #72682:
URL: https://github.com/apache/airflow/pull/72682
## Why
`GET /api/v2/assets`, `GET /ui/assets` and `GET /api/v2/assets/events` run a
single coarse `is_authorized_asset` check and then return every row. In a
multi-team deployment every caller therefore sees every other team's asset
names and URIs, which commonly encode bucket, table or dataset names. Dags,
connections, pools and variables already scope their list endpoints to what the
caller may read; assets had no equivalent.
Auth managers also had no way to express such a rule. `AssetDetails` only
carried the numeric `id`, so a manager that wants to authorize by URI prefix or
by name had nothing to decide on, on list and single-asset endpoints alike.
## What
- `AssetDetails` gains `name` and `uri`.
- `BaseAuthManager` gains `get_authorized_assets` and
`filter_authorized_assets`, following the existing connection pattern. The
default implementation calls `is_authorized_asset` per asset, so a deployment
whose manager ignores asset details keeps today's behaviour.
- `security.py` gains `PermittedAssetFilter`,
`PermittedAssetEventByAssetFilter`, `permitted_asset_filter_factory` and the
two `Readable*FilterDep` aliases. The public and UI asset list endpoints and
the asset events endpoint are scoped with them, so both the returned rows and
`total_entries` reflect only readable assets. Events whose asset row is gone
stay visible, like events with no source Dag, since there is nothing left to
authorize on.
- `requires_access_asset` resolves the asset's name and uri before calling
`is_authorized_asset`, so single-asset routes such as `/assets/{asset_id}` and
`/assets/{asset_id}/queuedEvents` can be authorized by URI or name too. Backed
by a new `AssetModel.get_name_and_uri`.
- Auth manager docs list `filter_authorized_assets` among the methods
recommended to override.
- Tests cover the new auth manager methods, the filters and factory, the
enriched `requires_access_asset`, and the three endpoints end to end.
Query-count assertions on the touched endpoints go up by one for the extra
authorization query.
Provider auth managers (Keycloak, AWS) may want to override
`filter_authorized_assets` for batching, as they already do for connections.
Left for a follow-up on the provider side.
closes: #72333
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Code (Opus 5)
Generated-by: Claude Code (Opus 5) following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
