Repository navigation
Conversation
29fa162 to
15fe938
Compare
|
This pull request has been automatically marked as stale because it has not had recent activity. It will be closed in 5 days if no further activity occurs. Thank you for your contributions. |
|
Hi @ashb @kaxil @amoghrajesh, just a gentle ping on this PR since it was recently marked as stale. |
|
Hello @fat-catTW - thank you for your contributions to Apache Airflow! The Airflow community has introduced a limit of 5 open pull requests at a time for contributors without write access to the repository. You currently have 17 open pull requests, so - as a one-time step of introducing the limit - we closed the ones where maintainers have not engaged yet:
These pull requests stay open because maintainers are already engaged in them - they count towards your limit:
This is not a judgement of you or of your changes. We never told contributors before that opening many pull requests at once was a problem, so there is nothing to feel bad about - and nothing is lost: your branches, commits and the review history stay where they are. What we ask you to do is to make your first prioritization decision: choose which of the pull requests above matter most to you, and reopen them (up to 5 open at a time, including the ones still open) with the "Reopen pull request" button or While your pull requests are waiting for review, the most valuable thing you can do is help in other ways - reviewing other contributors' pull requests, helping with issues, and taking part in the discussions on the devlist and Slack. Why we introduced the limit, what it means for you and how to reopen or restore a pull request is explained in https://github.com/apache/airflow/blob/main/contributing-docs/32_open_pull_request_limit.rst. Drafted-by: Claude Code (Opus 5); reviewed by @potiuk before posting |
Why:
Asset state store entries are scoped to assets, but execution API task tokens should not be able to access every active asset.
Previously, any task with a valid execution token could read or mutate state for unrelated assets. This made asset state store access broader than the task's declared asset relationships.
Solution:
Restrict the execution API asset state store routes so task tokens can only access assets registered to that task as an inlet or outlet.
The routes now check
TaskInletAssetReferenceandTaskOutletAssetReferencebefore allowing GET, PUT, DELETE, or CLEAR operations. Unregistered task access returns403 Forbidden.Watcher writes keep using the existing non-task path because watcher tokens are not backed by task instances.
Tests cover forbidden access for unregistered tasks and allowed access for inlet/outlet-registered tasks.
Was generative AI tooling used to co-author this PR?
[X]Yes (please specify the tool below)Generated-by: [Codex] following the guidelines
{pr_number}.significant.rst, in airflow-core/newsfragments. You can add this file in a follow-up commit after the PR is created so you know the PR number.