Repository: apache/airflow
File: airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_dag_versions.py (Python)

Code before:
    @mock.patch("airflow.api_fastapi.core_api.datamodels.dag_versions.hasattr")
    def test_get_dag_versions(
        self, mock_hasattr, test_client, dag_id, expected_response, expected_query_count
    ):
        mock_hasattr.return_value = False
        with assert_queries_count(expected_query_count):
            response = test_client.get(f"/dags/{dag_id}/dagVersions")
        assert response.status_code == 200
        assert response.json() == expected_response

    @pytest.mark.usefixtures("make_dag_with_multiple_versions")
    @mock.patch(
        "airflow.api_fastapi.auth.managers.base_auth_manager.BaseAuthManager.get_authorized_dag_ids",
        return_value=[("dag_with_multiple_versions")],
    )
    def test_get_dag_versions_permission_filtering(self, _, test_client):
        """
        Test that the endpoint correctly filters DAG versions based on user permissions.

        Here the user do not have permission on the ANOTHER_DAG_ID dag.
        """
        with assert_queries_count(4):
            response = test_client.get("/dags/~/dagVersions")

        assert response.status_code == 200
        assert response.json()["total_entries"] == 3

    @pytest.mark.parametrize(
        ("dag_id", "expected_response", "expected_query_count"),
        [
            [
                "~",
                {
                    "dag_versions": [
                        {
                            "bundle_name": "another_bundle_name",
                            "bundle_version": "some_commit_hash",
                            "bundle_url": "http://test_host.github.com/tree/some_commit_hash/dags",
                            "created_at": mock.ANY,
                            "dag_id": "ANOTHER_DAG_ID",
                            "id": mock.ANY,
                            "version_number": 1,
                            "dag_display_name": "ANOTHER_DAG_ID",
                        },
                        {
                            "bundle_name": "dag_maker",
                            "bundle_version": "some_commit_hash1",
                            "bundle_url": "http://test_host.github.com/tree/some_commit_hash1/dags",
                            "created_at": mock.ANY,
                            "dag_id": "dag_with_multiple_versions",
                            "id": mock.ANY,

Review comment (security):
wdyt of the following test instead?
```suggestion
    @pytest.mark.usefixtures("make_dag_with_multiple_versions")
    @mock.patch(
        "airflow.api_fastapi.auth.managers.base_auth_manager.BaseAuthManager.get_authorized_dag_ids",
        return_value={"dag_with_multiple_versions"},
    )
    def test_get_dag_versions_permission_filtering(self, mock_get_authorized_dag_ids, test_client):
        """Test that listing all DAG versions with ~ only returns versions for permitted DAGs."""
        response = test_client.get("/dags/~/dagVersions")

        assert response.status_code == 200
        body = response.json()
        assert body["total_entries"] == 3
        dag_ids = {v["dag_id"] for v in body["dag_versions"]}
        assert dag_ids == {"dag_with_multiple_versions"}
```

Code after:
    @mock.patch("airflow.api_fastapi.core_api.datamodels.dag_versions.hasattr")
    def test_get_dag_versions(
        self, mock_hasattr, test_client, dag_id, expected_response, expected_query_count
    ):
        mock_hasattr.return_value = False
        with assert_queries_count(expected_query_count):
            response = test_client.get(f"/dags/{dag_id}/dagVersions")
        assert response.status_code == 200
        assert response.json() == expected_response

    @pytest.mark.usefixtures("make_dag_with_multiple_versions")
    @mock.patch(
        "airflow.api_fastapi.auth.managers.base_auth_manager.BaseAuthManager.get_authorized_dag_ids",
        return_value={"dag_with_multiple_versions"},
    )
    def test_get_dag_versions_permission_filtering(self, _, test_client):
        """Test that listing all DAG versions with ~ only returns versions for permitted DAGs."""
        with assert_queries_count(4):
            response = test_client.get("/dags/~/dagVersions")

        assert response.status_code == 200
        body = response.json()
        assert body["total_entries"] == 3
        dag_ids = {v["dag_id"] for v in body["dag_versions"]}
        assert dag_ids == {"dag_with_multiple_versions"}

    @pytest.mark.parametrize(
        ("dag_id", "expected_response", "expected_query_count"),
        [
            [
                "~",
                {
                    "dag_versions": [
                        {
                            "bundle_name": "another_bundle_name",
                            "bundle_version": "some_commit_hash",
                            "bundle_url": "http://test_host.github.com/tree/some_commit_hash/dags",
                            "created_at": mock.ANY,
                            "dag_id": "ANOTHER_DAG_ID",
                            "id": mock.ANY,
                            "version_number": 1,
                            "dag_display_name": "ANOTHER_DAG_ID",
                        },
                        {
                            "bundle_name": "dag_maker",
                            "bundle_version": "some_commit_hash1",
                            "bundle_url": "http://test_host.github.com/tree/some_commit_hash1/dags",
                            "created_at": mock.ANY,
                            "dag_id": "dag_with_multiple_versions",
                            "id": mock.ANY,
                            "version_number": 1,