henry3260 opened a new pull request, #72862:
URL: https://github.com/apache/airflow/pull/72862
## Why
`GET /ui/next_run_assets/{dag_id}` is guarded only by the class-level
`requires_access_asset("GET")` check. Because the route has no `asset_id` path
parameter, `_build_asset_details` sends `AssetDetails(id=None)` to the auth
manager, so the check only confirms the caller may read assets in general. The
query then returns every asset the Dag depends on, filtered by `dag_id` alone.
A caller with read access to a Dag and generic asset read permission
therefore receives the `id`, `name`, `uri`, `asset_inactive` flag and, for
partitioned Dags, the `received_keys` / `required_keys` of upstream assets that
a fine-grained auth manager hides from them. The sibling `GET /ui/assets` list
endpoint already scopes its results through `ReadableAssetsFilterDep`; this
endpoint never wired it in.
## What
- `airflow-core/src/airflow/api_fastapi/core_api/routes/ui/assets.py`:
inject `ReadableAssetsFilterDep` into `next_run_assets` and apply it to the
asset query before execution, so the `events` list and the partitioned
enrichment only cover assets the caller may read.
- `airflow-core/tests/unit/api_fastapi/core_api/routes/ui/test_assets.py`:
add a regression test for a non-partitioned Dag and one for a partitioned Dag
(asserting hidden assets and their partition keys are dropped). The query-count
assertion in `test_should_response_200` goes from 4 to 5 for the extra lookup
of readable asset ids, matching the public `/assets` endpoint.
Note: the `asset_expression` field still echoes `dag_model.asset_expression`
unfiltered, as does the public `DagDetailsResponse`. That is a broader,
pre-existing exposure and is out of scope here.
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Code (Claude Fable 5.1)
Generated-by: Claude Code (Claude Fable 5.1) following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
