TinyGeek commented on code in PR #74576:
URL: https://github.com/apache/airflow/pull/74576#discussion_r4306781269
##########
airflow-core/src/airflow/api_fastapi/core_api/routes/public/dag_sources.py:
##########
@@ -82,21 +82,25 @@ def get_dag_source(
# ``(relative_fileloc, bundle_name)`` -- the same keying
# ``import_error.py`` uses for its equivalent check -- and redact the
# response when any co-located Dag is not in the caller's readable set.
+ # A stale Dag's stored source may still define stale siblings, so keep
+ # those in the check. Always include the requested Dag to avoid skipping
+ # authorization when no other Dags remain.
content = dag_version.dag_code.source_code
dag_model = dag_version.dag_model
if dag_model is not None and dag_model.relative_fileloc:
- file_dag_ids = set(
+ file_dag_ids = {dag_id}
+ file_dag_ids.update(
session.scalars(
select(DagModel.dag_id).where(
DagModel.relative_fileloc == dag_model.relative_fileloc,
DagModel.bundle_name == dag_model.bundle_name,
+ DagModel.is_stale.in_([False, dag_model.is_stale]),
Review Comment:
Thanks for catching this. I reproduced the regression with two stored source
versions: version 1 contains the now-stale sibling, while version 2 does not.
Before the fix, `?version_number=1` returned the full version 1 source to a
caller allowed to read only the requested Dag.
The follow-up compares the selected `DagVersion` with the latest one. For an
older selected version, stale co-located Dags remain in the authorization
check. An omitted version or an explicitly selected latest version still
excludes stale siblings when the requested Dag is active. The regression test
failed before this change and passes afterward; all 16 tests in
`test_dag_sources.py` pass locally.
This restores the conservative check for the reported historical case.
`DagCode` does not store an immutable per-version list of co-located Dag IDs,
so this does not claim to reconstruct every historical file membership.
---
Drafted-by: Codex (GPT-6) (no human review before posting)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
