TinyGeek commented on code in PR #74576:
URL: https://github.com/apache/airflow/pull/74576#discussion_r4306781269
##########
airflow-core/src/airflow/api_fastapi/core_api/routes/public/dag_sources.py:
##########
@@ -82,21 +82,25 @@ def get_dag_source(
# ``(relative_fileloc, bundle_name)`` -- the same keying
# ``import_error.py`` uses for its equivalent check -- and redact the
# response when any co-located Dag is not in the caller's readable set.
+ # A stale Dag's stored source may still define stale siblings, so keep
+ # those in the check. Always include the requested Dag to avoid skipping
+ # authorization when no other Dags remain.
content = dag_version.dag_code.source_code
dag_model = dag_version.dag_model
if dag_model is not None and dag_model.relative_fileloc:
- file_dag_ids = set(
+ file_dag_ids = {dag_id}
+ file_dag_ids.update(
session.scalars(
select(DagModel.dag_id).where(
DagModel.relative_fileloc == dag_model.relative_fileloc,
DagModel.bundle_name == dag_model.bundle_name,
+ DagModel.is_stale.in_([False, dag_model.is_stale]),
Review Comment:
Thanks for catching this. The follow-up compares the selected `DagVersion`
with the latest one. When the selected version is older, stale co-located Dags
stay in the file authorization check because the stored source may still define
them. An omitted version or an explicitly selected latest version keeps the
active Dag behavior: stale siblings are excluded when the requested Dag is
active. The requested Dag ID remains in the authorization set in every case.
`DagCode` has no immutable per-version list of co-located Dag IDs, so this
change restores the conservative check for the historical case without claiming
to reconstruct every historical file membership.
---
Drafted-by: Codex (GPT-6) (no human review before posting)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
