[v3-3-test] Resolve the Dag's team when authorizing a Dag found by lookup (#70893) - #71107
Merged
Conversation
* Resolve the Dag's team when authorizing a Dag found by lookup Two authorization checks build DagDetails(id=dag_id) without team_name: materialize_asset, where the Dag is resolved from the asset, and the XCom-specific check in wait_dag_run_until_finished. Every other call site passes the team, resolved with DagModel.get_team_name. A team-aware auth manager distinguishes a team-scoped Dag from a global one by that field, so omitting it asks about a differently-scoped resource than the one being acted on. In wait_dag_run_until_finished the route dependency already resolves the team for its RUN check, so the two checks in the same handler disagreed. Resolve the team at both sites, reusing the request session. * Cover the XCom authorization check with a team-scoped Dag The existing wait-endpoint test uses a Dag with no team, where the resolved and unresolved forms are indistinguishable, so nothing caught the second check asking about a differently-scoped resource than the route dependency did. * Update airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_dag_run.py Co-authored-by: Amogh Desai <amoghrajesh1999@gmail.com> * Update airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_assets.py Co-authored-by: Amogh Desai <amoghrajesh1999@gmail.com> * Fix docstring indentation from the applied review suggestions --------- Co-authored-by: Amogh Desai <amoghrajesh1999@gmail.com> (cherry picked from commit f814598)
vatsrahul1001
requested review from
ephraimbuddy and
pierrejeambrun
as code owners
August 4, 2026 14:47
vatsrahul1001
requested review from
bugraoz93,
choo121600,
henry3260,
jason810496 and
shubhamraj-git
as code owners
August 4, 2026 14:47
eladkal
approved these changes
Aug 4, 2026
vatsrahul1001
added a commit
that referenced
this pull request
Aug 5, 2026
#71107) * Resolve the Dag's team when authorizing a Dag found by lookup Two authorization checks build DagDetails(id=dag_id) without team_name: materialize_asset, where the Dag is resolved from the asset, and the XCom-specific check in wait_dag_run_until_finished. Every other call site passes the team, resolved with DagModel.get_team_name. A team-aware auth manager distinguishes a team-scoped Dag from a global one by that field, so omitting it asks about a differently-scoped resource than the one being acted on. In wait_dag_run_until_finished the route dependency already resolves the team for its RUN check, so the two checks in the same handler disagreed. Resolve the team at both sites, reusing the request session. * Cover the XCom authorization check with a team-scoped Dag The existing wait-endpoint test uses a Dag with no team, where the resolved and unresolved forms are indistinguishable, so nothing caught the second check asking about a differently-scoped resource than the route dependency did. * Update airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_dag_run.py * Update airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_assets.py * Fix docstring indentation from the applied review suggestions --------- (cherry picked from commit f814598) Co-authored-by: Jarek Potiuk <jarek@potiuk.com> Co-authored-by: Amogh Desai <amoghrajesh1999@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #70893 to
v3-3-test. When a Dag is resolved by lookup (asset materialize, wait-dag-run XCom check) rather than named by the caller, itsteam_nameis now resolved viaDagModel.get_team_name()and passed to the auth check — otherwise a team-aware auth manager is asked about a differently-scoped resource. The required infra is present on the branch (DagModel.get_team_name,DagDetails.team_name).One conflict in
assets.pyimports: main also importsDagVersionthere (from an unrelated main-only change), which #70893 does not use — resolved by adding onlyfrom airflow.models.dag import DagModeland dropping the unusedDagVersionimport (would otherwise be a ruff F401 on this branch).dag_run.pyand tests applied cleanly.Was generative AI tooling used to co-author this PR?
Generated-by: Claude Code (Opus 4.8) following the guidelines — cherry-pick backport with one import-conflict resolution (documented above).