UI - Home screen does not filter based on logged in user's role's access to dags

[devgonvarun]

Apache Airflow version

3.0.3

If "Other Airflow 2 version" selected, which one?

No response

What happened?

Case: Custom airflow role with access to only some dags.

The "Home" screen shows the Stats and History for all dags running on the airflow instance which includes the dags that the logged in user does even not have access to.

For example: here i see 6 Dag runs but this airflow user role just has access to 2 of those dag runs as the other dags runs are from dags that this user does not have permissions to view.

If this screen is only intended for users who need insights for the entire instance then a permission like "menu access on Home" should exist.

What you think should happen instead?

The Home screen should show information only for the dags that the logged in user role has access for. And/Or a permission like "menu access on Home" should exist.

How to reproduce

Create a new airflow user with access to only some dags:
remove "can read on DAGs" permission and instead add "can read on DAG:X" permission where dag_id=X for your newly created role to limit dag access.

Then using this new role, navigate to "Home" screen.

Operating System

Debian GNU/Linux 12 (bookworm)

Versions of Apache Airflow Providers

No response

Deployment

Official Apache Airflow Helm Chart

Deployment details

No response

Anything else?

No response

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[suhail-zemoso]

working on this issue.

[suhail-zemoso]

✅ Workaround to Resolve the Issue
I implemented the following solution to restrict the /dag_stats endpoint to only return data for DAGs that a user has access to:

✅ Attach the Filter to Endpoint Dependencies
I added the permission filter as a dependency to the FastAPI route using readable_dags_filter: ReadableDagsFilterDep. This ensures that only permitted DAGs are considered during the request lifecycle.

✅ Apply DAG Filter to All Queries
I updated the queries inside the endpoint to filter by permitted DAG IDs using SQLAlchemy’s .where(DagRun.dag_id.in_(permitted_dag_ids)). This includes filters on DAGs, DAG runs, and aggregated stats.

After these changes, the /dag_stats endpoint now correctly returns results scoped to the user's DAG-level permissions.