henry3260 opened a new pull request, #72864:
URL: https://github.com/apache/airflow/pull/72864
## Why
`DagModel.asset_expression` names every upstream asset of a Dag, including
their ids, names and uris. `GET /ui/next_run_assets/{dag_id}` returns it
verbatim, so a caller with read access to a Dag can learn the identity of
assets a fine-grained auth manager hides from them, even after the `events`
list itself is scoped (#72862).
The expression is written by the Dag processor with no notion of a caller,
and the scheduler needs it complete, so it cannot be filtered at write time. It
has to be scoped per request, at the API layer, like the asset list endpoints
already are.
This is the first of a small series: it introduces the shared redaction
helper and the response-shape change, and wires the first endpoint. Follow-ups
will wire the public `GET /dags/{dag_id}/details`, the UI `GET /ui/dags` list,
and the UI rendering of a hidden leaf.
## What
- `airflow-core/src/airflow/api_fastapi/common/asset_expression.py`: new
`redact_asset_expression` helper. It walks the `all` / `any` tree and replaces
every `asset` leaf whose id the caller may not read with `{"uri": null, "name":
null, "id": null, "group": ..., "hidden": true}`. The slot is kept so the shape
of the schedule stays honest instead of silently dropping a condition. A leaf
without an id fails closed. `alias` and `asset_ref` leaves are left as-is (no
batch authorization exists for aliases; refs are unresolved names by design).
The input is never mutated, since it lives on an ORM row whose session commits
on exit.
- `airflow-core/src/airflow/api_fastapi/core_api/datamodels/common.py`:
`AssetExpressionAssetInfo` gains `hidden: bool = False`, and `uri` / `name`
become nullable to carry a redacted leaf.
- `airflow-core/src/airflow/api_fastapi/core_api/routes/ui/assets.py`:
`next_run_assets` injects `ReadableAssetsFilterDep` and serves the redacted
expression on all three return paths.
- Regenerated OpenAPI specs, the UI TypeScript client types, and the
airflow-ctl datamodels for the schema change.
- Tests: unit tests for the helper, datamodel tests for the redacted leaf,
and an endpoint test asserting the hidden asset's name and uri no longer appear
in `asset_expression`. The query-count assertion in `test_should_response_200`
goes from 4 to 5 for the readable-asset lookup.
Note: this PR does not touch the `events` list of the same endpoint; that is
handled in #72862. On this branch the endpoint test therefore asserts on
`asset_expression` only.
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Code (Claude Fable 5.1)
Generated-by: Claude Code (Claude Fable 5.1) following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
