Copilot commented on code in PR #74726:
URL: https://github.com/apache/airflow/pull/74726#discussion_r4270870541
##########
airflow-core/src/airflow/assets/manager.py:
##########
@@ -450,6 +459,10 @@ def register_asset_change(
)
resolved_consumer_teams = outlet_ref.allow_consumer_teams if
outlet_ref else None
resolved_global_consumers = outlet_ref.allow_global_consumers
if outlet_ref else True
+ elif dag_run is not None:
+ resolved_source_teams = {team_name} if team_name else set()
+ resolved_consumer_teams = None
+ resolved_global_consumers = True
Review Comment:
Immediate emission can bypass producer-side consumer restrictions in
multi-team mode. If the emitting task has no matching
`TaskOutletAssetReference`, the fallback here allows every consumer;
Dag-callback emissions are likewise always unrestricted. A task or callback can
therefore emit an existing restricted asset and queue cross-team/teamless
consumer Dags despite the producer's configured
`allow_consumer_teams`/`allow_global_consumers`. Require trusted emission
authorization metadata (or a matching declared reference) and reject emission
when it is absent, rather than defaulting to unrestricted delivery.
##########
task-sdk/src/airflow/sdk/definitions/asset/__init__.py:
##########
@@ -49,6 +50,7 @@
__all__ = [
"Asset",
"AssetAccessControl",
+ "AssetEventReceipt",
Review Comment:
`AssetEventReceipt` is exposed only from `airflow.sdk.definitions.asset`; it
is missing from the Task SDK's public `airflow.sdk` `__all__`, `TYPE_CHECKING`
imports, and lazy-import map. Because `Asset.emit()` publicly returns this
type, users currently cannot import its annotation from the supported top-level
SDK namespace. Please export it alongside `Asset` and cover the top-level
import.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
