You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "henry3260 (via GitHub)" <gi...@apache.org> on 2026/09/11 07:00:36 UTC
[PR] Scope upstream asset events of a Dag run to readable assets and Dags [airflow]
henry3260 opened a new pull request, #72924:
URL: https://github.com/apache/airflow/pull/72924
## Why
`GET /dags/{dag_id}/dagRuns/{dag_run_id}/upstreamAssetEvents` only checked that the caller may read the consuming Dag run and that they hold a coarse, class-level asset read permission. It then returned every asset event the run consumed, straight from the `DagRun.consumed_asset_events` relationship, without scoping the events themselves.
For auth managers that authorize assets and Dags individually, this exposed events of assets the caller may not read, and events produced by source Dags the caller may not read. Each event carries the asset's `name`, `uri`, `group` and `extra`, plus `source_dag_id`, `source_task_id` and `source_run_id`. The same events are already hidden from `GET /assets/events` by `ReadableAssetEventsFilterDep` and `ReadableAssetEventsByAssetFilterDep`, so reading the consuming run was a way around that filtering.
## What
- `airflow-core/src/airflow/api_fastapi/core_api/routes/public/dag_run.py`: `get_upstream_asset_events` now looks up the run's primary key (still 404 when missing), then selects the consumed events through the `dagrun_asset_event` association table and applies the same per-source-Dag and per-asset readability filters as `GET /assets/events`. `total_entries` is the filtered count, so hidden events do not leak through the total either.
---
##### Was generative AI tooling used to co-author this PR?
- [X] Yes — Claude Code (Claude Fable 5.1)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Scope upstream asset events of a Dag run to readable assets and Dags [airflow]
Posted by "henry3260 (via GitHub)" <gi...@apache.org>.
henry3260 commented on PR #72924:
URL: https://github.com/apache/airflow/pull/72924#issuecomment-6269592480
This is along the same lines as #74836, but for upstream asset events. CC @vincbeck.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Scope upstream asset events of a Dag run to readable assets and Dags [airflow]
Posted by "henry3260 (via GitHub)" <gi...@apache.org>.
henry3260 merged PR #72924:
URL: https://github.com/apache/airflow/pull/72924
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Scope upstream asset events of a Dag run to readable assets and Dags [airflow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #72924:
URL: https://github.com/apache/airflow/pull/72924#issuecomment-6269944114
Hi maintainer, this PR was merged without a milestone set.
We've automatically set the milestone to **[Airflow 3.4.1](https://github.com/apache/airflow/milestone/154)** based on: backport label targeting v3-4-test
If this milestone is not correct, please update it to the appropriate milestone.
> This comment was generated by [Milestone Tag Assistant](https://github.com/apache/airflow/blob/main/.github/workflows/milestone-tag-assistant.yml).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Scope upstream asset events of a Dag run to readable assets and Dags [airflow]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #72924:
URL: https://github.com/apache/airflow/pull/72924#issuecomment-6269939695
### Backport successfully created: v3-4-test
Note: As of [Merging PRs targeted for Airflow 3.X](https://github.com/apache/airflow/blob/main/dev/README_AIRFLOW3_DEV.md#merging-prs-targeted-for-airflow-3x)
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.
In matter of doubt please ask in [#release-management](https://apache-airflow.slack.com/archives/C03G9H97MM2) Slack channel.
<table>
<tr>
<th>Status</th>
<th>Branch</th>
<th>Result</th>
</tr>
<tr>
<td>✅</td>
<td>v3-4-test</td>
<td><a href="https://github.com/apache/airflow/pull/75108"><img src="https://img.shields.io/badge/PR-75108-blue" alt="PR Link"></a></td>
</tr>
</table>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Scope upstream asset events of a Dag run to readable assets and Dags [airflow]
Posted by "fat-catTW (via GitHub)" <gi...@apache.org>.
fat-catTW commented on PR #72924:
URL: https://github.com/apache/airflow/pull/72924#issuecomment-5665901280
Thanks for the contribution!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Scope upstream asset events of a Dag run to readable assets and Dags [airflow]
Posted by "henry3260 (via GitHub)" <gi...@apache.org>.
henry3260 commented on PR #72924:
URL: https://github.com/apache/airflow/pull/72924#issuecomment-6269891893
Thanks for the review!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org