amoghrajesh commented on code in PR #76375:
URL: https://github.com/apache/airflow/pull/76375#discussion_r4463785155
##########
airflow-core/tests/unit/api_fastapi/execution_api/test_security.py:
##########
@@ -1104,13 +1104,27 @@ def
test_archived_attempt_cannot_replace_or_delete_xcom(self, client, caller, se
assert client.delete(path).status_code == 410
assert client.get(path).status_code == 410
- def test_unknown_execution_identity_cannot_write(self, client, caller):
- _, token = caller
+ def test_unknown_execution_identity_cannot_write_xcom(self, client,
caller, session):
+ ti, token = caller
token.id = uuid4()
+ path = f"/execution/xcoms/{ti.dag_id}/{ti.run_id}/{ti.task_id}/result"
+
+ assert client.post(path, json="unowned").status_code == 404
+ assert session.scalar(select(XComModel).where(XComModel.dag_id ==
ti.dag_id)) is None
+
+ @pytest.mark.parametrize("identity", ["unknown", "archived"])
+ def test_non_ti_identity_can_write_variables(self, client, caller,
session, identity):
Review Comment:
Handled in 475c1f56c4b
##########
airflow-core/src/airflow/api_fastapi/execution_api/routes/variables.py:
##########
@@ -147,6 +148,7 @@ def get_variable(
status.HTTP_403_FORBIDDEN: {"description": "The caller does not have
access to the variable"},
},
)
+@allow_non_ti_writer
Review Comment:
Handled in 475c1f56c4b
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
