Mock the simple auth manager in the upstream asset events permission test by potiuk · Pull Request #75126 · apache/airflow

potiuk · 2026-10-19T16:43:43Z

TestGetDagRunAssetTriggerEvents::test_returns_only_events_of_assets_the_caller_may_read, added in #72924, fails on main: the endpoint returns all three events instead of the one on the readable asset.

The test patches BaseAuthManager.get_authorized_assets, but since #72934 SimpleAuthManager (the auth manager the API test client uses) overrides that method, so the patch never takes effect and every asset stays readable. #72924's CI ran on a base without #72934. The production filter is fine; this patches SimpleAuthManager.get_authorized_assets, as the other asset permission tests in routes/public/test_assets.py and routes/ui/test_assets.py do.

TestGetDagRunAssetTriggerEvents: 13 passed (previously 1 failed on main).

Was generative AI tooling used to co-author this PR?

Yes — Claude Code (Opus 5)

Generated-by: Claude Code (Opus 5) following the guidelines

…test SimpleAuthManager overrides get_authorized_assets since apache#72934, so patching the BaseAuthManager method left the real one in place, every asset stayed readable, and the test added in apache#72924 failed on main. Generated-by: Claude Opus 5

Eason09053360

Thanks for the quick fix! LGTM.

kacpermuda · 2026-10-19T17:30:56Z

Failing my CI at #74752, thanks for the fix !

aaron-y-chen

Thanks, LGTM 😄

github-actions · 2026-10-19T19:21:23Z

Backport failed to create: v3-4-test. View the failure log Run details

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
❌	v3-4-test

You can attempt to backport this manually by running:

cherry_picker 33e6b5f v3-4-test

This should apply the commit to the v3-4-test branch and leave the commit in conflict state marking
the files that need manual conflict resolution.

After you have resolved the conflicts, you can continue the backport process by running:

cherry_picker --continue

If you don't have cherry-picker installed, see the installation guide.

…test (#75126) SimpleAuthManager overrides get_authorized_assets since #72934, so patching the BaseAuthManager method left the real one in place, every asset stayed readable, and the test added in #72924 failed on main. Generated-by: Claude Opus 5 (cherry picked from commit 33e6b5f)

potiuk · 2026-10-19T20:20:23Z

The automatic backport to v3-4-test conflicted because the test this fixes only exists there once #72924 is backported. I cherry-picked it onto that backport instead: it's included in #75108, so no separate backport of this PR is needed.

Drafted-by: Claude Code (Opus 5.5); reviewed by @potiuk before posting

…gs the caller may read (#72924) (#75108) * [v3-4-test] Scope upstream asset events of a Dag run to assets and Dags the caller may read (#72924) GET /dags/{dag_id}/dagRuns/{dag_run_id}/upstreamAssetEvents returned every asset event a run consumed as long as the caller could read the consuming Dag. Events of assets, or produced by source Dags, the caller is not allowed to read were exposed, including their name, uri, extra and source Dag/task ids, even though GET /assets/events hides the same events. Query the consumed events through the dagrun_asset_event table and apply the same per-asset and per-source-Dag readability filters as GET /assets/events, so hidden events are excluded from both the response and total_entries. (cherry picked from commit 6f408e1) Co-authored-by: Henry Chen <henrychen@apache.org> * Mock the simple auth manager in the upstream asset events permission test (#75126) SimpleAuthManager overrides get_authorized_assets since #72934, so patching the BaseAuthManager method left the real one in place, every asset stayed readable, and the test added in #72924 failed on main. Generated-by: Claude Opus 5 (cherry picked from commit 33e6b5f) --------- Co-authored-by: Henry Chen <henrychen@apache.org> Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

vatsrahul1001 · 2026-10-20T03:44:47Z

Already present on v3-4-test via #75108 (#72924 backport) cherry-pick is an empty no-op, so the auto-backport reported a false failure. No separate backport needed.

…gs the caller may read (#72924) (#75108) * [v3-4-test] Scope upstream asset events of a Dag run to assets and Dags the caller may read (#72924) GET /dags/{dag_id}/dagRuns/{dag_run_id}/upstreamAssetEvents returned every asset event a run consumed as long as the caller could read the consuming Dag. Events of assets, or produced by source Dags, the caller is not allowed to read were exposed, including their name, uri, extra and source Dag/task ids, even though GET /assets/events hides the same events. Query the consumed events through the dagrun_asset_event table and apply the same per-asset and per-source-Dag readability filters as GET /assets/events, so hidden events are excluded from both the response and total_entries. (cherry picked from commit 6f408e1) Co-authored-by: Henry Chen <henrychen@apache.org> * Mock the simple auth manager in the upstream asset events permission test (#75126) SimpleAuthManager overrides get_authorized_assets since #72934, so patching the BaseAuthManager method left the real one in place, every asset stayed readable, and the test added in #72924 failed on main. Generated-by: Claude Opus 5 (cherry picked from commit 33e6b5f) --------- Co-authored-by: Henry Chen <henrychen@apache.org> Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

boring-cyborg Bot added the area:API Airflow's REST/HTTP API label Oct 19, 2026

Eason09053360 approved these changes Oct 19, 2026

View reviewed changes

kacpermuda approved these changes Oct 19, 2026

View reviewed changes

potiuk requested review from Lee-W, henry3260 and kaxil October 19, 2026 18:28

potiuk added this to the Airflow 3.4.0 milestone Oct 19, 2026

potiuk added the backport-to-v3-4-test Backport to v3-4-test label Oct 19, 2026

aaron-y-chen approved these changes Oct 19, 2026

View reviewed changes

shahar1 approved these changes Oct 19, 2026

View reviewed changes

shahar1 merged commit 33e6b5f into apache:main Oct 19, 2026
66 of 67 checks passed

potiuk mentioned this pull request Oct 19, 2026

Mock the simple auth manager in permission tests and guard against the base-class patch #75138

Merged

1 task done

zozo123 mentioned this pull request Oct 19, 2026

Reuse locked CI dependencies across workspace source changes #74466

Open

1 task done

luc-pimentel mentioned this pull request Oct 19, 2026

Honor wait_for_past_depends_before_skipping when an upstream skips #75028

Open

1 task done

Navigation Menu

Repository navigation

Mock the simple auth manager in the upstream asset events permission test - #75126

Mock the simple auth manager in the upstream asset events permission test#75126
shahar1 merged 1 commit into
apache:mainfrom
potiuk:fix-asset-events-test-mock

potiuk commented Oct 19, 2026

Uh oh!

Eason09053360 left a comment

Uh oh!

kacpermuda commented Oct 19, 2026

Uh oh!

aaron-y-chen left a comment

Uh oh!

Uh oh!

github-actions Bot commented Oct 19, 2026

Uh oh!

potiuk commented Oct 19, 2026

Uh oh!

vatsrahul1001 commented Oct 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

potiuk commented Oct 19, 2026

Was generative AI tooling used to co-author this PR?

Uh oh!

Eason09053360 left a comment

Choose a reason for hiding this comment

Uh oh!

kacpermuda commented Oct 19, 2026

Uh oh!

aaron-y-chen left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions Bot commented Oct 19, 2026

Backport failed to create: v3-4-test. View the failure log Run details

Uh oh!

potiuk commented Oct 19, 2026

Uh oh!

vatsrahul1001 commented Oct 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants