vincbeck commented on code in PR #73007:
URL: https://github.com/apache/airflow/pull/73007#discussion_r4006115109
##########
airflow-core/src/airflow/api_fastapi/core_api/routes/public/assets.py:
##########
@@ -407,6 +411,18 @@ def create_asset_event(
asset_model = session.scalar(select(AssetModel).where(AssetModel.id ==
body.asset_id).limit(1))
if not asset_model:
raise HTTPException(status.HTTP_404_NOT_FOUND, f"Asset with ID:
`{body.asset_id}` was not found")
+ # The asset is named in the body, which the route dependency cannot read,
so it only checked the
+ # generic asset POST permission. Authorize on the resolved asset here so
an auth manager can scope
+ # by id, name, or uri.
+ if not get_auth_manager().is_authorized_asset(
Review Comment:
It is safe to remove `Depends(requires_access_asset(method="POST"))` then.
One covers the other
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
