github-actions[bot] opened a new pull request, #72932: URL: https://github.com/apache/airflow/pull/72932
* Document that plugin FastAPI apps are not authenticated by Airflow Airflow authenticates the core API with a router-level dependency. A plugin app is attached with app.mount(), and a Starlette mount has its own route table and inherits none of the parent's dependencies, so that dependency never reaches a plugin's routes; no middleware in the API server authenticates them either. The consequence is that every route a plugin exposes is reachable by anonymous callers unless the plugin authenticates it itself -- and the documented example is exactly that shape: a plain route, with no authentication and no note saying one is needed. A deployment that follows the docs ships plugin endpoints pre-auth without being told. Enforcing authentication in core was the alternative and was rejected: it breaks plugins that legitimately serve anonymous callers, and access control for a plugin's own routes belongs to the plugin author rather than to core. So document the gap where it is read. The plugins page now states plainly that Airflow does not authenticate plugin apps, shows GetUserDep on a route, shows the application-level form that keeps a later-added route from silently shipping unauthenticated, and separates authentication from authorization -- including team scoping, which a plugin must check for itself. Documentation only; no behaviour change. * Add Starlette to the docs spelling wordlist The plugin authentication warning names Starlette when explaining why a mounted app inherits none of the parent's dependencies, and the docs spellcheck has no entry for it. (cherry picked from commit 6e749f72c2e2689d4f5dfe4ce8a293fa131ef37b) Co-authored-by: Jarek Potiuk <[email protected]> Generated-by: Claude Code (Opus 5) Claude-Session: https://claude.ai/code/session_01XS3bodTDYYGrPmorhtLsjP -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
