Default-deny auth at the API and UI router level by potiuk · Pull Request #66505 · apache/airflow

potiuk · 2026-05-07T02:09:42Z

Add dependencies=[Depends(get_user)] at the authenticated_router (parent of every authenticated /api/v2 route) and ui_router (every /ui route) constructors.

Today every authenticated route already declares its own GetUserDep or a requires_access_* dependency that itself depends on get_user, so this is purely additive — FastAPI deduplicates dependencies via its per-request cache, so each request still resolves get_user exactly once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time.

Also adds a structural regression test that asserts both routers carry the router-level Depends(get_user), so a future refactor that drops the dependency without understanding its purpose fails the test rather than silently widening the unauthenticated surface.

The three explicit no-auth carve-outs (monitor_router for /api/v2/monitor/health, version_router for /api/v2/version, the public auth_router for /api/v2/auth/{login,logout}) are added to public_router directly rather than to authenticated_router, so they remain unaffected.

Was generative AI tooling used to co-author this PR?

Yes — Claude Opus 4.7 (1M context)

Generated-by: Claude Opus 4.7 (1M context) following the guidelines

Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface.

potiuk · 2026-05-17T19:45:11Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

vatsrahul1001 · 2026-05-18T17:01:29Z

@potiuk can you address comments?

@Lee-W

Address review feedback from @Lee-W on PR apache#66505.

github-actions · 2026-05-19T11:22:10Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

potiuk · 2026-05-07T02:09:42Z

Add dependencies=[Depends(get_user)] at the authenticated_router (parent of every authenticated /api/v2 route) and ui_router (every /ui route) constructors.

Today every authenticated route already declares its own GetUserDep or a requires_access_* dependency that itself depends on get_user, so this is purely additive — FastAPI deduplicates dependencies via its per-request cache, so each request still resolves get_user exactly once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time.

Also adds a structural regression test that asserts both routers carry the router-level Depends(get_user), so a future refactor that drops the dependency without understanding its purpose fails the test rather than silently widening the unauthenticated surface.

The three explicit no-auth carve-outs (monitor_router for /api/v2/monitor/health, version_router for /api/v2/version, the public auth_router for /api/v2/auth/{login,logout}) are added to public_router directly rather than to authenticated_router, so they remain unaffected.

Was generative AI tooling used to co-author this PR?

Yes — Claude Opus 4.7 (1M context)

Generated-by: Claude Opus 4.7 (1M context) following the guidelines

Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface.

potiuk · 2026-05-17T19:45:11Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

vatsrahul1001 · 2026-05-18T17:01:29Z

@potiuk can you address comments?

@Lee-W

Address review feedback from @Lee-W on PR apache#66505.

github-actions · 2026-05-19T11:22:10Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

potiuk · 2026-05-07T02:09:42Z

Add dependencies=[Depends(get_user)] at the authenticated_router (parent of every authenticated /api/v2 route) and ui_router (every /ui route) constructors.

Today every authenticated route already declares its own GetUserDep or a requires_access_* dependency that itself depends on get_user, so this is purely additive — FastAPI deduplicates dependencies via its per-request cache, so each request still resolves get_user exactly once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time.

Also adds a structural regression test that asserts both routers carry the router-level Depends(get_user), so a future refactor that drops the dependency without understanding its purpose fails the test rather than silently widening the unauthenticated surface.

The three explicit no-auth carve-outs (monitor_router for /api/v2/monitor/health, version_router for /api/v2/version, the public auth_router for /api/v2/auth/{login,logout}) are added to public_router directly rather than to authenticated_router, so they remain unaffected.

Was generative AI tooling used to co-author this PR?

Yes — Claude Opus 4.7 (1M context)

Generated-by: Claude Opus 4.7 (1M context) following the guidelines

Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface.

potiuk · 2026-05-17T19:45:11Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

vatsrahul1001 · 2026-05-18T17:01:29Z

@potiuk can you address comments?

@Lee-W

Address review feedback from @Lee-W on PR apache#66505.

github-actions · 2026-05-19T11:22:10Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

potiuk · 2026-05-07T02:09:42Z

Add dependencies=[Depends(get_user)] at the authenticated_router (parent of every authenticated /api/v2 route) and ui_router (every /ui route) constructors.

Today every authenticated route already declares its own GetUserDep or a requires_access_* dependency that itself depends on get_user, so this is purely additive — FastAPI deduplicates dependencies via its per-request cache, so each request still resolves get_user exactly once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time.

Also adds a structural regression test that asserts both routers carry the router-level Depends(get_user), so a future refactor that drops the dependency without understanding its purpose fails the test rather than silently widening the unauthenticated surface.

The three explicit no-auth carve-outs (monitor_router for /api/v2/monitor/health, version_router for /api/v2/version, the public auth_router for /api/v2/auth/{login,logout}) are added to public_router directly rather than to authenticated_router, so they remain unaffected.

Was generative AI tooling used to co-author this PR?

Yes — Claude Opus 4.7 (1M context)

Generated-by: Claude Opus 4.7 (1M context) following the guidelines

Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface.

potiuk · 2026-05-17T19:45:11Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

vatsrahul1001 · 2026-05-18T17:01:29Z

@potiuk can you address comments?

@Lee-W

Address review feedback from @Lee-W on PR apache#66505.

github-actions · 2026-05-19T11:22:10Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

potiuk · 2026-05-07T02:09:42Z

Add dependencies=[Depends(get_user)] at the authenticated_router (parent of every authenticated /api/v2 route) and ui_router (every /ui route) constructors.

Today every authenticated route already declares its own GetUserDep or a requires_access_* dependency that itself depends on get_user, so this is purely additive — FastAPI deduplicates dependencies via its per-request cache, so each request still resolves get_user exactly once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time.

Also adds a structural regression test that asserts both routers carry the router-level Depends(get_user), so a future refactor that drops the dependency without understanding its purpose fails the test rather than silently widening the unauthenticated surface.

The three explicit no-auth carve-outs (monitor_router for /api/v2/monitor/health, version_router for /api/v2/version, the public auth_router for /api/v2/auth/{login,logout}) are added to public_router directly rather than to authenticated_router, so they remain unaffected.

Was generative AI tooling used to co-author this PR?

Yes — Claude Opus 4.7 (1M context)

Generated-by: Claude Opus 4.7 (1M context) following the guidelines

Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface.

potiuk · 2026-05-17T19:45:11Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

vatsrahul1001 · 2026-05-18T17:01:29Z

@potiuk can you address comments?

@Lee-W

Address review feedback from @Lee-W on PR apache#66505.

github-actions · 2026-05-19T11:22:10Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

potiuk · 2026-05-07T02:09:42Z

Add dependencies=[Depends(get_user)] at the authenticated_router (parent of every authenticated /api/v2 route) and ui_router (every /ui route) constructors.

Today every authenticated route already declares its own GetUserDep or a requires_access_* dependency that itself depends on get_user, so this is purely additive — FastAPI deduplicates dependencies via its per-request cache, so each request still resolves get_user exactly once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time.

Also adds a structural regression test that asserts both routers carry the router-level Depends(get_user), so a future refactor that drops the dependency without understanding its purpose fails the test rather than silently widening the unauthenticated surface.

The three explicit no-auth carve-outs (monitor_router for /api/v2/monitor/health, version_router for /api/v2/version, the public auth_router for /api/v2/auth/{login,logout}) are added to public_router directly rather than to authenticated_router, so they remain unaffected.

Was generative AI tooling used to co-author this PR?

Yes — Claude Opus 4.7 (1M context)

Generated-by: Claude Opus 4.7 (1M context) following the guidelines

Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface.

potiuk · 2026-05-17T19:45:11Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

vatsrahul1001 · 2026-05-18T17:01:29Z

@potiuk can you address comments?

@Lee-W

Address review feedback from @Lee-W on PR apache#66505.

github-actions · 2026-05-19T11:22:10Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

potiuk · 2026-05-07T02:09:42Z

Add dependencies=[Depends(get_user)] at the authenticated_router (parent of every authenticated /api/v2 route) and ui_router (every /ui route) constructors.

Today every authenticated route already declares its own GetUserDep or a requires_access_* dependency that itself depends on get_user, so this is purely additive — FastAPI deduplicates dependencies via its per-request cache, so each request still resolves get_user exactly once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time.

Also adds a structural regression test that asserts both routers carry the router-level Depends(get_user), so a future refactor that drops the dependency without understanding its purpose fails the test rather than silently widening the unauthenticated surface.

The three explicit no-auth carve-outs (monitor_router for /api/v2/monitor/health, version_router for /api/v2/version, the public auth_router for /api/v2/auth/{login,logout}) are added to public_router directly rather than to authenticated_router, so they remain unaffected.

Was generative AI tooling used to co-author this PR?

Yes — Claude Opus 4.7 (1M context)

Generated-by: Claude Opus 4.7 (1M context) following the guidelines

Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface.

potiuk · 2026-05-17T19:45:11Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

vatsrahul1001 · 2026-05-18T17:01:29Z

@potiuk can you address comments?

@Lee-W

Address review feedback from @Lee-W on PR apache#66505.

github-actions · 2026-05-19T11:22:10Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

potiuk · 2026-05-07T02:09:42Z

Add dependencies=[Depends(get_user)] at the authenticated_router (parent of every authenticated /api/v2 route) and ui_router (every /ui route) constructors.

Today every authenticated route already declares its own GetUserDep or a requires_access_* dependency that itself depends on get_user, so this is purely additive — FastAPI deduplicates dependencies via its per-request cache, so each request still resolves get_user exactly once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time.

Also adds a structural regression test that asserts both routers carry the router-level Depends(get_user), so a future refactor that drops the dependency without understanding its purpose fails the test rather than silently widening the unauthenticated surface.

The three explicit no-auth carve-outs (monitor_router for /api/v2/monitor/health, version_router for /api/v2/version, the public auth_router for /api/v2/auth/{login,logout}) are added to public_router directly rather than to authenticated_router, so they remain unaffected.

Was generative AI tooling used to co-author this PR?

Yes — Claude Opus 4.7 (1M context)

Generated-by: Claude Opus 4.7 (1M context) following the guidelines

Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface.

potiuk · 2026-05-17T19:45:11Z

I'd love to get this one merged — and would love it in 3.2.2 if it's not too late. cc @vatsrahul1001 (3.2.2 RM)

Drafted-by: Claude Code (Opus 4.7); reviewed by @potiuk before posting

vatsrahul1001 · 2026-05-18T17:01:29Z

@potiuk can you address comments?

@Lee-W

Address review feedback from @Lee-W on PR apache#66505.

github-actions · 2026-05-19T11:22:10Z

Backport successfully created: v3-2-test

Note: As of Merging PRs targeted for Airflow 3.X
the committer who merges the PR is responsible for backporting the PRs that are bug fixes (generally speaking) to the maintenance branches.

In matter of doubt please ask in #release-management Slack channel.

Status	Branch	Result
✅	v3-2-test

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

@Lee-W

…#67171) * Default-deny auth at the API and UI router level Add `dependencies=[Depends(get_user)]` to `authenticated_router` (parent of every route under `/api/v2` except the explicit no-auth carve-outs `monitor_router`, `version_router`, and the public `auth_router`) and to `ui_router` (every route under `/ui`). Today every authenticated route already declares `GetUserDep` or a `requires_access_*` dependency that itself depends on `get_user`, so this is purely additive — FastAPI deduplicates the dependency via its per-request cache, so each request still resolves `get_user` once. The value is preventing a future route from being added under either router without an auth check: the router-level dependency catches the regression at registration time rather than at audit time. Add a structural test that asserts both routers carry the router-level `Depends(get_user)`, so a future refactor that drops the dependency without considering its purpose fails the test rather than silently widening the unauthenticated surface. * Move test imports to top of file Address review feedback from @Lee-W on PR #66505. (cherry picked from commit aa8542f) Co-authored-by: Jarek Potiuk <jarek@potiuk.com>

potiuk requested review from bugraoz93, choo121600, ephraimbuddy, jason810496, pierrejeambrun, rawwar and shubhamraj-git as code owners May 7, 2026 02:09

boring-cyborgBot added the area:API Airflow's REST/HTTP API label May 7, 2026

potiuk force-pushed the f-007-default-deny-auth branch from f63b2bf to 38b7827Compare May 17, 2026 19:40

potiuk added this to the Airflow 3.2.2 milestone May 17, 2026

potiuk added the backport-to-v3-2-test label May 17, 2026

Lee-W reviewed May 18, 2026
View reviewed changes

Comment threadairflow-core/tests/unit/api_fastapi/core_api/test_app.py Outdated

jason810496 approved these changes May 18, 2026
View reviewed changes

Move test imports to top of file
f2d2590
Address review feedback from @Lee-W on PR apache#66505.

vatsrahul1001 approved these changes May 19, 2026
View reviewed changes

vatsrahul1001 merged commit aa8542f into apache:mainMay 19, 2026
274 of 275 checks passed

github-actionsBot mentioned this pull request May 19, 2026
[v3-2-test] Default-deny auth at the API and UI router level (#66505) #67171
Merged

vatsrahul1001 mentioned this pull request May 21, 2026
Status of testing of Apache Airflow 3.2.2rc3 #67282
Closed

potiuk mentioned this pull request May 24, 2026
Docs: refresh JWT and security model for v3.2 with mermaid diagrams #67435
Merged
1 task