This is an automated email from the ASF dual-hosted git repository. aminghadersohi pushed a commit to branch work-pr-39604 in repository https://gitbox.apache.org/repos/asf/superset.git
commit 11dce414ed7325228b798f21e651fc80fb2a6643 Author: Amin Ghadersohi <[email protected]> AuthorDate: Thu May 28 14:24:25 2026 +0000 fix(security): make ApiKey admin-only view menu conditional on FAB_API_KEY_ENABLED Move the ApiKey view-menu guard from the static ADMIN_ONLY_VIEW_MENUS set into _is_admin_only so it is only enforced when FAB_API_KEY_ENABLED=True, as requested in review. --- superset/security/manager.py | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/superset/security/manager.py b/superset/security/manager.py index 7e4938c2c31..30c3dc41c65 100644 --- a/superset/security/manager.py +++ b/superset/security/manager.py @@ -463,10 +463,6 @@ class SupersetSecurityManager( # pylint: disable=too-many-public-methods "PermissionViewMenu", "ViewMenu", "User", - # FAB ApiKeyApi blueprint (active when FAB_API_KEY_ENABLED=True). - # Listed unconditionally — harmless when the feature is off because - # no PVMs exist under this view menu. - "ApiKey", } | USER_MODEL_VIEWS ALPHA_ONLY_VIEW_MENUS = { @@ -1648,6 +1644,10 @@ class SupersetSecurityManager( # pylint: disable=too-many-public-methods and pvm.permission.name not in self.READ_ONLY_PERMISSION ): return True + if pvm.view_menu.name == "ApiKey" and current_app.config.get( + "FAB_API_KEY_ENABLED", False + ): + return True return ( pvm.view_menu.name in self.ADMIN_ONLY_VIEW_MENUS or pvm.permission.name in self.ADMIN_ONLY_PERMISSIONS
