henry3260 commented on PR #72682:
URL: https://github.com/apache/airflow/pull/72682#issuecomment-5587548484
This scopes the asset collection endpoints to the assets the caller may read,
and gives auth managers the `name` and `uri` they need to make that decision:
- `GET /assets` and `GET /ui/assets` — filtered rows and `total_entries`
- `GET /assets/events` — filtered by the event's asset
- every `/assets/{asset_id}/...` route — `requires_access_asset` now resolves
the asset's name and uri, so an auth manager can deny per asset rather
than seeing an opaque id
It does not extend to endpoints that return an asset inside a response which
is not an asset collection. Those still authorize on the coarse
`requires_access_asset` check alone:
| Endpoint | What it would need |
|---|---|
| `POST /assets/events` | the asset id read from the request body —
`requires_access_asset` reads path parameters, so it authorizes on `id=None` |
| `GET /dags/{dag_id}/dagRuns/{dag_run_id}/upstreamAssetEvents` | the event
filter, applied where the run's events are serialized |
| `GET /ui/next_run_assets/{dag_id}` | an asset filter alongside the
existing Dag check |
| `GET /ui/partitioned_dag_runs`, `GET
/ui/pending_partitioned_dag_run/{dag_id}` | same |
| `GET /ui/dependencies?dependency_type=data` | asset-level gating; today it
hides the graph unless the caller can read a connected Dag |
| `GET /assets/aliases` | a decision on whether alias names fall under asset
authorization |
Each needs its own call on where the filter belongs, and I would rather
settle the shared filter and the auth manager interface first. Happy to fold
any of them in if reviewers would prefer this land as one change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
