Skip to content

Restrict asset state store access to registered tasks - #69764

Closed
fat-catTW wants to merge 1 commit into
apache:mainfrom
fat-catTW:enforce-asset-state-store-registration
Closed

fat-catTW wants to merge 1 commit into
apache:mainfrom
fat-catTW:enforce-asset-state-store-registration

Conversation

@fat-catTW

Copy link
Copy Markdown
Contributor

Why:

Asset state store entries are scoped to assets, but execution API task tokens should not be able to access every active asset.

Previously, any task with a valid execution token could read or mutate state for unrelated assets. This made asset state store access broader than the task's declared asset relationships.

Solution:

Restrict the execution API asset state store routes so task tokens can only access assets registered to that task as an inlet or outlet.

The routes now check TaskInletAssetReference and TaskOutletAssetReference before allowing GET, PUT, DELETE, or CLEAR operations. Unregistered task access returns 403 Forbidden.

Watcher writes keep using the existing non-task path because watcher tokens are not backed by task instances.

Tests cover forbidden access for unregistered tasks and allowed access for inlet/outlet-registered tasks.

Was generative AI tooling used to co-author this PR?
  • [X] Yes (please specify the tool below)

Generated-by: [Codex] following the guidelines


  • Read the Pull Request Guidelines for more information. Note: commit author/co-author name and email in commits become permanently public when merged.
  • For fundamental code changes, an Airflow Improvement Proposal (AIP) is needed.
  • When adding dependency, check compliance with the ASF 3rd Party License Policy.
  • For significant user-facing changes create newsfragment: {pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.

@boring-cyborg boring-cyborg Bot added area:API Airflow's REST/HTTP API area:task-sdk labels Jul 11, 2026
@potiuk potiuk added the ready for maintainer review Set by triage when all criteria pass, or by the fork CI reconciler when fork CI is green. label Jul 15, 2026
@fat-catTW
fat-catTW force-pushed the enforce-asset-state-store-registration branch from 29fa162 to 15fe938 Compare July 15, 2026 18:46
@github-actions

Copy link
Copy Markdown
Contributor

This pull request has been automatically marked as stale because it has not had recent activity. It will be closed in 5 days if no further activity occurs. Thank you for your contributions.

@github-actions github-actions Bot added the stale Stale PRs per the .github/workflows/stale.yml policy file label Aug 30, 2026
@fat-catTW

Copy link
Copy Markdown
Contributor Author

Hi @ashb @kaxil @amoghrajesh, just a gentle ping on this PR since it was recently marked as stale.
The previous review feedback has been addressed, and the PR should be ready for another look when you have time.
Thanks!

@potiuk potiuk added the closed because of open PR limit Closed as a one-time step of introducing the open pull request limit label Sep 25, 2026
@potiuk

potiuk commented Sep 25, 2026

Copy link
Copy Markdown
Member

Hello @fat-catTW - thank you for your contributions to Apache Airflow!

The Airflow community has introduced a limit of 5 open pull requests at a time for contributors without write access to the repository. You currently have 17 open pull requests, so - as a one-time step of introducing the limit - we closed the ones where maintainers have not engaged yet:

These pull requests stay open because maintainers are already engaged in them - they count towards your limit:

This is not a judgement of you or of your changes. We never told contributors before that opening many pull requests at once was a problem, so there is nothing to feel bad about - and nothing is lost: your branches, commits and the review history stay where they are.

What we ask you to do is to make your first prioritization decision: choose which of the pull requests above matter most to you, and reopen them (up to 5 open at a time, including the ones still open) with the "Reopen pull request" button or gh pr reopen <PR_NUMBER> --repo apache/airflow. Reopen the ones you are ready to follow through - keep them rebased, respond to review comments and fix failing checks.

While your pull requests are waiting for review, the most valuable thing you can do is help in other ways - reviewing other contributors' pull requests, helping with issues, and taking part in the discussions on the devlist and Slack.

Why we introduced the limit, what it means for you and how to reopen or restore a pull request is explained in https://github.com/apache/airflow/blob/main/contributing-docs/32_open_pull_request_limit.rst.


Drafted-by: Claude Code (Opus 5); reviewed by @potiuk before posting

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area:API Airflow's REST/HTTP API area:task-sdk closed because of open PR limit Closed as a one-time step of introducing the open pull request limit ready for maintainer review Set by triage when all criteria pass, or by the fork CI reconciler when fork CI is green. stale Stale PRs per the .github/workflows/stale.yml policy file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants