vincbeck commented on PR #72682: URL: https://github.com/apache/airflow/pull/72682#issuecomment-5603585131
> > Assets are global to the environment. They do not belong to any team. > > Thanks for taking a look, and that's a fair point you're right that assets are global and don't belong to any team. I should clarify that this PR doesn't try to change that; it doesn't introduce any team-to-asset ownership. > > What it's really after is authorization granularity. Right now the asset list,events endpoints run a single coarse `is_authorized_asset` check and then return every row, and the auth manager only ever receives an opaque numeric `id`. This PR simply passes the asset's `name` and `uri` along, so an auth manager _can_ decide readability per asset (say, by URI prefix) if it chooses to. Whether a deployment actually restricts anything stays entirely in the auth manager's hands the default still calls `is_authorized_asset` per asset, so nothing changes for managers that don't care about asset identity. > > My thinking was to mirror what connections, pools and variables already do: those are global too, yet their list endpoints are still scoped to what the caller may read, and assets were the one exception with no way to express that. > > That said, I may well be missing context here would you prefer that we not scope global assets at all, or is it more about how the filtering is done? Happy to adjust either way. Oh I see now! Alright, let me take a look :) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
