When a DAG Viewer tries to trigger a DAG, the action fails with 403

[chobberoni]

Apache Airflow version

3.1.7

If "Other Airflow 3 version" selected, which one?

No response

What happened?

When a DAG Viewer tries to trigger a DAG, the action fails with 403, and the Home → View History also shows 403 without clearly indicating it’s an authorization issue.
From a user experience perspective, it might be clearer if permission-related failures explicitly mention insufficient permissions / role restrictions

What you think should happen instead?

it might be clearer if permission-related failures explicitly mention insufficient permissions / role restrictions

How to reproduce

Testing during DAG level roles implementation on the Astronomer Astro client -- requires internal Astro access

Operating System

macOS sequoia 15.7.3

Versions of Apache Airflow Providers

No response

Deployment

Astronomer

Deployment details

No response

Anything else?

No response

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[Abhishekmishra2808]

Hi @pierrejeambrun @chobberoni ,
I’d like to work on this issue.

From my understanding, the problem occurs when users with restricted roles receive a generic 403 error without clear permission feedback in the UI. I plan to improve how permission-related failures are handled and displayed.

Plan:

1. Reproduce the issue locally using a DAG Viewer role.
2. Identify where 403 responses are handled in DAG trigger/history UI flows.
3. Add explicit handling to show a clear permission message.
4. Add tests to validate unauthorized scenarios.
5. Verify consistency across similar UI actions.

Please let me know if this approach looks good - I’d be happy to proceed.

[pierrejeambrun]

Sounds good, you're assigned :)

[jscheffl]

Can we also make it possible to hide the trigger button if only viewer permissions? Or can this be only detected post-trigger attempt?