Skip to content

Conversation

@willyyang
Copy link
Contributor

@willyyang willyyang commented Jun 5, 2025

closes: #51325

fix: authorize users with specific DAG permissions for general DAG operations

Allow users with specific DAG permissions (e.g., "DAG:my_dag") to access
DAG-related endpoints when no specific DAG is requested, instead of denying
access. Users are authorized if they have access to at least one DAG.

  • Updated _is_authorized_dag() and _is_authorized_dag_run()
  • Added comprehensive test coverage
  • Maintains backward compatibility

^ Add meaningful description above
Read the Pull Request Guidelines for more information.
In case of fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
In case of a new dependency, check compliance with the ASF 3rd Party License Policy.
In case of backwards incompatible changes please leave a note in a newsfragment file, named {pr_number}.significant.rst or {issue_number}.significant.rst, in airflow-core/newsfragments.

@boring-cyborg
Copy link

boring-cyborg bot commented Jun 5, 2025

Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our Contributors' Guide (https://github.com/apache/airflow/blob/main/contributing-docs/README.rst)
Here are some useful points:

  • Pay attention to the quality of your code (ruff, mypy and type annotations). Our pre-commits will help you with that.
  • In case of a new feature add useful documentation (in docstrings or in docs/ directory). Adding a new operator? Check this short guide Consider adding an example DAG that shows how users should use it.
  • Consider using Breeze environment for testing locally, it's a heavy docker but it ships with a working Airflow and a lot of integrations.
  • Be patient and persistent. It might take some time to get a review or get the final approval from Committers.
  • Please follow ASF Code of Conduct for all communication including (but not limited to) comments on Pull Requests, Mailing list and Slack.
  • Be sure to read the Airflow Coding style.
  • Always keep your Pull Requests rebased, otherwise your build might fail due to changes not related to your commits.
    Apache Airflow is a community-driven project and together we are making it better 🚀.
    In case of doubts contact the developers at:
    Mailing List: dev@airflow.apache.org
    Slack: https://s.apache.org/airflow-slack

@willyyang
Copy link
Contributor Author

Who is able to merge this in and when can we expect this bug fix to be released? Thanks.

@vincbeck
Copy link
Contributor

vincbeck commented Jun 6, 2025

Who is able to merge this in and when can we expect this bug fix to be released? Thanks.

Tests are failing, can you please take a look and fix them?

@pierrejeambrun
Copy link
Member

pierrejeambrun commented Jun 6, 2025

Who is able to merge this in and when can we expect this bug fix to be released?

Any committer can merge this once approved and the CI is green.

Provider only change -> next fab provider release (every 2 weeks or so)

Copy link
Member

@pierrejeambrun pierrejeambrun left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice thanks.

@willyyang
Copy link
Contributor Author

@pierrejeambrun @vincbeck Updated tests, please approve the workflows to be executed, thanks!

@willyyang willyyang force-pushed the fix-dag-acl branch 2 times, most recently from e519d5a to 5231731 Compare June 10, 2025 14:17
@willyyang
Copy link
Contributor Author

@vincbeck updated again, please approve workflows.

@willyyang
Copy link
Contributor Author

@vincbeck the build passed , https://github.com/apache/airflow/actions/runs/15563154053/job/43821886590?pr=51462 , I clicked update and it seems like I need to re-run the workflow again?

@willyyang
Copy link
Contributor Author

not sure if you're able to merge this in, thanks

@pierrejeambrun pierrejeambrun added the backport-to-v3-1-test Mark PR with this label to backport to v3-1-test branch label Jun 10, 2025
@vincbeck
Copy link
Contributor

All good 👌 Thanks for fixing the tests! Merging

@vincbeck vincbeck merged commit 8da0160 into apache:main Jun 10, 2025
66 checks passed
@vincbeck
Copy link
Contributor

@pierrejeambrun not sure about the backport, it is a provider only change.

github-actions bot pushed a commit that referenced this pull request Jun 10, 2025
…DAGs when no pecific DAG is requested (#51462)

* Fix: allow users with specific DAG permissions to access DAGs when no specific DAG is requested

* Fix: Update unit tests to handle new DAG authorization behavior

---------
(cherry picked from commit 8da0160)

Co-authored-by: Will Yang <willyyang604@gmail.com>
Co-authored-by: Will Yang <will@wcs-northamerica.com>
@github-actions
Copy link

Backport successfully created: v3-0-test

Status Branch Result
v3-0-test PR Link

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:providers backport-to-v3-1-test Mark PR with this label to backport to v3-1-test branch provider:fab

Projects

None yet

Development

Successfully merging this pull request may close these issues.

DAG-level access control requires global "can read on DAGs" permission

3 participants