[PR] Check producer/consumer Dag run permissions in create_asset_event [airflow]

["darshil929 (via GitHub)" <gi...@apache.org>]

darshil929 opened a new pull request, #69175:
URL: https://github.com/apache/airflow/pull/69175

   The `create_asset_event` handler behind `POST /assets/events` is only guarded by `requires_access_asset(method="POST")` — the asset-level "create on Assets" permission. The event it creates is passed to `asset_manager.register_asset_change`, which enqueues `AssetDagRunQueue` rows for every consuming Dag scheduled on that asset, so the call effectively triggers downstream Dag runs without ever evaluating the Dag-level `access_control` those Dags define. A principal holding only the Assets "create" permission can therefore enqueue runs for Dags it has no run access to.
   
   This adds the missing check. Before the event is created, the endpoint now confirms the caller can run at least one producing Dag, or every consuming Dag the event would trigger. The consuming Dags are resolved the same way `register_asset_change` does when it queues runs: a Dag counts if it schedules on the asset directly, or by the asset's name or URI and isn't paused. That keeps the permission check aligned with the Dags the event would actually trigger, so it never blocks more or less than it should. Producers aren't pause-filtered, since re-running a producing Dag would re-emit the event anyway.
   
   Tests cover the producer-authorized, all-consumers-authorized, partial-consumer, and name/URI consumer cases.
   
   closes: #42846


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Check producer/consumer Dag run permissions in create_asset_event [airflow]

["darshil929 (via GitHub)" <gi...@apache.org>]

darshil929 closed pull request #69175: Check producer/consumer Dag run permissions in create_asset_event
URL: https://github.com/apache/airflow/pull/69175


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Check producer/consumer Dag run permissions in create_asset_event [airflow]

["darshil929 (via GitHub)" <gi...@apache.org>]

darshil929 commented on PR #69175:
URL: https://github.com/apache/airflow/pull/69175#issuecomment-4846788561

   Yeah, that's fair, and I think you're right about the consumer side. If you schedule a Dag on an asset, you're basically signing up to be triggered whenever that asset updates, so having the consumer's access_control override that doesn't really make sense.
   
   Where I was coming from is more the producer side. Normally, to emit one of these events you'd have to run a producing Dag, which means you need permission on that Dag. The API lets anyone with the global "create on Assets" permission emit the event directly and skip that, and that's the part that felt off to me.
   
   It did come up earlier in the thread as something POST should check (https://github.com/apache/airflow/issues/42846#issuecomment-3489814766), so there might be a couple of different views on this. Happy to go with whatever you all land on.
   
   If the producer side seems worth tightening, I can trim the PR down to just that check and drop the consumer part. And if you'd rather call the whole thing working as intended, I'm fine closing it out. Just let me know which way you'd prefer.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org