TinyGeek opened a new pull request, #74576: URL: https://github.com/apache/airflow/pull/74576
When a stale Dag shares a source file and bundle with an active Dag, the source endpoint can redact code even when the caller can read every active Dag in that file. Update the per-file authorization check to: - Exclude stale co-located Dags when the requested Dag is active. - Retain stale co-located Dags when the requested Dag is stale, since its stored source may still contain them. - Always include the requested Dag ID so the authorization check cannot be skipped. Make the existing co-located test fixture explicitly active and add a parametrized regression test for both requested-Dag states. This follows the security boundary raised during review of #73292. ### Tests - RED: The original implementation redacts an active Dag's source when an unreadable stale sibling exists. - RED: An intermediate fix exposes a stale requested Dag's source when an unreadable stale sibling exists. - GREEN: Both regression cases and all 15 tests in `test_dag_sources.py` pass. - Ruff 0.16.8 format and lint checks, `git diff --check`, and applicable manual prek hooks pass. - Tests run locally with Python 3.14.4, SQLite, and uv, without Docker. - Real FAB role-based authorization integration is not tested. The `generate-openapi-spec` and `mypy-airflow-core` prek hooks cannot complete locally because Docker and the C compiler/Kerberos headers are unavailable. GitHub CI is pending. Fixes #73284 --- ##### Was generative AI tooling used to co-author this PR? - [X] Yes (OpenAI Codex, GPT-6) Generated-by: Codex (GPT-6) following [the guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
