hussein-awala opened a new pull request, #74495:
URL: https://github.com/apache/airflow/pull/74495
## Summary
Add `DELETE /api/v2/assets/{asset_id}/events` to permanently remove one
asset's historical events strictly before a required `before` timestamp.
This provides a per-asset retention operation through the public API. The
existing queued-event endpoints remove scheduling queue entries, not event
history, while `airflow db clean --tables asset_event` is table-level
maintenance.
### Behavior
- Return **204** for an existing asset, including when no events match;
**404** for an unknown asset.
- Default `delete_queued_events` to **false**. If matching events still have
queue references, return **409** without deleting any events.
- With `delete_queued_events=true`, allow the existing database cascades to
remove dependent queue, Dag-run/event, and alias/event references. Asset, Dag,
Dag-run, and alias parent records remain intact.
- Require asset DELETE and Dag PUT permission, plus read/edit access to
every affected queued Dag. Reject unauthorized requests entirely with **403**.
An unrelated `dag_id` query cannot narrow authorization.
- Lock the selected events and dependent queue rows through
validation/deletion. SQLite takes a real writer lock. Internal 500-ID chunks
bound SQL parameters without committing between chunks or allowing partial
deletion.
The change is limited to the route, a backward-compatible
authorization-helper option, focused tests, and generated
OpenAPI/client/permission documentation. It adds no migration, dependency,
automatic retention job, SDK helper, or CLI change.
## Validation
- Asset API and security suites: **370 passed on SQLite**; deletion cases:
**31 passed on PostgreSQL**. An earlier full PostgreSQL asset/security run also
passed 370 tests.
- Tests cover scope/cutoff boundaries, timezone handling, default queue
refusal, authorized opt-in, permission denial and query-parameter bypass, real
cascades/parent preservation, multi-chunk atomicity, and independent-connection
scheduling races.
- Regular and manual prek checks passed, including full core mypy,
API/schema checks, UI checks, and generated permission references.
- Completed the checks selected by `breeze verify`: core API/Always and
common.compat/FAB database and non-database suites; both UI suites; generated
Python API client tests (**360 passed**); and Airflow/common.compat/FAB
documentation builds.
- The Simple Auth UI test needed `NODE_OPTIONS=--no-experimental-webstorage`
with the local Node 26 runtime. No project-code workaround was added.
- Independent review identified an authorization gap; it was fixed and a
fresh review found no remaining blockers. After rebasing onto current `main`,
the patch was unchanged and the 370-test asset/security suite passed again.
MySQL execution remains unverified. All eligible IDs and locks are retained
for one transaction; the internal chunks limit bind parameters, not memory or
lock duration. Deletion is permanent and does not create archive tables.
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Pi 0.84.3
Generated-by: Pi 0.84.3 following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
---
Drafted-by: Pi 0.84.3 (no human review before posting)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
