potiuk opened a new pull request, #74839:
URL: https://github.com/apache/airflow/pull/74839
`DELETE /assets/{asset_id}/queuedEvents` is not tied to a single Dag, but it
was guarded by a Dag-edit check that reads the Dag id from the path or, failing
that, from a `?dag_id=` query parameter. The route has no Dag in its path, so
the check was made against whatever Dag the caller named in the query string,
while the rows actually deleted were filtered by the Dags the user can *read*.
A user with edit on one Dag and read-only on others could therefore clear the
pending asset-triggered queue of the read-only Dags.
This change scopes the delete to the queued events of Dags the user may edit
(`EditableDagsFilterDep`) and removes the Dag-level check on this asset-wide
route, the same way the asset-wide `GET /assets/{asset_id}/queuedEvents` route
relies on per-row scoping (readable Dags) rather than a request-supplied Dag
id. Rows of Dags the user cannot edit are left in place; if none of the asset's
queued events belong to an editable Dag, the route returns 404 as it already
does when nothing matches. The per-Dag routes
(`/dags/{dag_id}/assets/...queuedEvents`) are unchanged, since their Dag id
comes from the path.
Tests: a user with edit on `dag_a` and read-only on `dag_b` deleting the
asset-wide queued events (with and without `?dag_id=dag_a`) leaves `dag_b`'s
row; a request where only read-only Dags have rows returns 404 and deletes
nothing; and the route-dependency test now asserts that neither asset-wide
queued-events route gates on a request-supplied Dag id (its suffix match
previously also picked up the per-Dag route).
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes (please specify the tool below)
Generated-by: Claude Opus 5 following [the
guidelines](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#gen-ai-assisted-contributions)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
