[PR] [v3-3-test] Document that plugin FastAPI apps are not authenticated by Airflow (#72655) [airflow]

["github-actions[bot] (via GitHub)" <gi...@apache.org>]

github-actions[bot] opened a new pull request, #72932:
URL: https://github.com/apache/airflow/pull/72932

   * Document that plugin FastAPI apps are not authenticated by Airflow
   
   Airflow authenticates the core API with a router-level dependency. A plugin app is
   attached with app.mount(), and a Starlette mount has its own route table and inherits
   none of the parent's dependencies, so that dependency never reaches a plugin's routes;
   no middleware in the API server authenticates them either.
   
   The consequence is that every route a plugin exposes is reachable by anonymous callers
   unless the plugin authenticates it itself -- and the documented example is exactly that
   shape: a plain route, with no authentication and no note saying one is needed. A
   deployment that follows the docs ships plugin endpoints pre-auth without being told.
   
   Enforcing authentication in core was the alternative and was rejected: it breaks plugins
   that legitimately serve anonymous callers, and access control for a plugin's own routes
   belongs to the plugin author rather than to core.
   
   So document the gap where it is read. The plugins page now states plainly that Airflow
   does not authenticate plugin apps, shows GetUserDep on a route, shows the
   application-level form that keeps a later-added route from silently shipping
   unauthenticated, and separates authentication from authorization -- including team
   scoping, which a plugin must check for itself.
   
   Documentation only; no behaviour change.
   
   * Add Starlette to the docs spelling wordlist
   
   The plugin authentication warning names Starlette when explaining why a
   mounted app inherits none of the parent's dependencies, and the docs
   spellcheck has no entry for it.
   (cherry picked from commit 6e749f72c2e2689d4f5dfe4ce8a293fa131ef37b)
   
   Co-authored-by: Jarek Potiuk <ja...@potiuk.com>
   Generated-by: Claude Code (Opus 5)
   Claude-Session: https://claude.ai/code/session_01XS3bodTDYYGrPmorhtLsjP


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] [v3-3-test] Document that plugin FastAPI apps are not authenticated by Airflow (#72655) [airflow]

["pierrejeambrun (via GitHub)" <gi...@apache.org>]

pierrejeambrun merged PR #72932:
URL: https://github.com/apache/airflow/pull/72932


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org