seanghaeli commented on code in PR #76260: URL: https://github.com/apache/airflow/pull/76260#discussion_r4449446337
########## airflow-core/src/airflow/api_fastapi/core_api/security.py: ########## @@ -1221,6 +1222,52 @@ def depends_permitted_assets_filter( ] +def _triggers_watching(asset_ids: set[int]) -> Select: + # Uncorrelated, as in Trigger.owner_still_refers_expression. + return select(AssetWatcherModel.trigger_id).where(AssetWatcherModel.asset_id.in_(asset_ids)) + + +class PermittedTriggerFilter(OrmClause[None]): + """ + Keep the triggers whose owner the caller can see, by one rule for every kind of trigger. + + A trigger's owner is the Dag recorded on it (the Dag of its task instance or callback) or the assets its + watchers watch. Team access is the auth manager's, through those Dags and assets. + """ + + def __init__(self, *, dag_ids: set[str], asset_ids: set[int]) -> None: + super().__init__() + self.dag_ids = dag_ids + self.asset_ids = asset_ids + + def to_orm(self, select: Select) -> Select: + return select.where( + or_(Trigger.dag_id.in_(self.dag_ids), Trigger.id.in_(_triggers_watching(self.asset_ids))) + ) + + +def get_readable_asset_ids(user: BaseUser, auth_manager: BaseAuthManager) -> set[int]: + """ + Return the ids of the assets the user may read, gated like ``GET /assets`` first. + + ``get_authorized_assets`` may assume that gate has passed: the FAB auth manager, which has no per-asset + permissions, returns every asset there. + """ + if not auth_manager.is_authorized_asset(method="GET", details=AssetDetails(id=None), user=user): + return set() + return auth_manager.get_authorized_assets(user=user, method="GET") + + +def readable_triggers_filter(user: GetUserDep, auth_manager: AuthManagerDep) -> PermittedTriggerFilter: Review Comment: Fair point. Just "Dag read" permissions is a weaker gate than what task instance & deadline routes require. Updating the /triggers path permission requirements for parity, and updated the permission tables in the docs to no longer list `/triggers` as Public -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
