florian-meyrueis-al opened a new issue, #73284:
URL: https://github.com/apache/airflow/issues/73284
### Under which category would you file this issue?
Airflow Core
### Apache Airflow version
3.X
### What happened and how to reproduce it?
In Airflow 3, the UI displays:
REDACTED - you do not have read permission on all Dags in the file
when viewing the source code of a Dag.
The affected Python file dynamically creates four Dags. The user has the
required access to all four Dags. However, the metadata database also contains
a fifth Dag using the same relative_fileloc and bundle_name, marked as is_stale
= true.
To reproduce :
Create a Python file that dynamically generates multiple Dags.
Find a way to have one dag marked as stale (not sure how to do this).
Ensure the user has access to all currently active Dags.
Open the source code for one of the active Dags in the UI.
Observe the redaction message.
### What you think should happen instead?
Stale Dags should not be considered when determining whether the user can
view the source file, since they are no longer active/currently produced by the
file.
### Operating System
_No response_
### Deployment
Official Apache Airflow Helm Chart
### Apache Airflow Provider(s)
_No response_
### Versions of Apache Airflow Providers
_No response_
### Official Helm Chart version
Not Applicable
### Kubernetes Version
_No response_
### Helm Chart configuration
_No response_
### Docker Image customizations
_No response_
### Anything else?
Actual behavior
The Dag source endpoint queries all matching DagModel rows by
relative_fileloc and bundle_name, but does not exclude stale rows:
select(DagModel.dag_id).where(
DagModel.relative_fileloc == dag_model.relative_fileloc,
DagModel.bundle_name == dag_model.bundle_name,
)
The endpoint then compares all returned Dag IDs with the user’s authorized
Dag IDs. The stale fifth Dag causes the subset check to fail, so the source is
replaced with the redaction message.
Suggested fix
Exclude stale Dags from the file membership query:
DagModel.is_stale.is_(False)
### Are you willing to submit PR?
- [ ] Yes I am willing to submit a PR!
### Code of Conduct
- [x] I agree to follow this project's [Code of
Conduct](https://github.com/apache/airflow/blob/main/CODE_OF_CONDUCT.md)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
