This is an automated email from the ASF dual-hosted git repository. amaannawab923 pushed a commit to branch asset-demo in repository https://gitbox.apache.org/repos/asf/superset.git
commit 0600d4b1fcaf0cfb033a075b6d9b55e2f1f6d4e5 Author: amaannawab923 <[email protected]> AuthorDate: Thu Oct 22 16:49:16 2026 +0530 docs(asset-approval): give QA the whole happy flow, with every account The guide named six steps and stopped at the dashboard. A tester starting from a fresh clone could not tell which assets were seeded, who was an editor of what, or what each screen should show, so a wrong screen could not be told apart from a right one. The Logins section now lists all four accounts with their passwords, roles and what each is an editor of, plus the four seeded assets and what each is for. The walkthrough covers every path the recorded demo exercises -- viewer and admin seeing nothing, review on the dashboard, the lock, request changes and return, author submit, approve with its confirmation, version history, charts, datasets submitted from "Submitted by me" and reviewed from Approvals, deletes, the no-approver dialog's editor picker, the Change review page and the 202 API gate -- each with what you should see. Every step was walked on this branch. --- README.md | 164 +++++++++++++++++++++++++++++++++++++++++++++++--------------- 1 file changed, 124 insertions(+), 40 deletions(-) diff --git a/README.md b/README.md index 2919142e12a..f190051d8dd 100644 --- a/README.md +++ b/README.md @@ -96,53 +96,137 @@ reviewer. It prints what it set up, and it is safe to re-run at any time. ## Logins -| user | password | role | use it for | -|---|---|---|---| -| `maker` | `general` | Alpha | making changes | -| `checker` | `general` | Alpha | reviewing them | -| `viewer` | `general` | Gamma + data access | seeing what everyone else sees | -| `admin` | `admin` | Admin | setup only | - -`viewer` is the account that proves the point of the feature: while a change -sits in review it has no bell, nothing in Approvals, and the asset still reads -the way it did before the edit. It is deliberately an editor of nothing. - -Two assets are set up to reach different states. **USA Births Names** has two -editors, so a change made on it can be approved -- that is the walkthrough -below. **Sales Dashboard** has only one, so a change made on it has nobody to -go to, and the request dialog says so instead of offering a reviewer. - -**Test as `maker` and `checker`, not as `admin`.** Admin's blanket access -deliberately does not count as editorship for approval, so admin sees a -more permissive picture than a real user does. Permission and UI bugs only +Every account below is a local QA fixture created by `qa/seed.py` (or by +Superset's own init, for `admin`). None of these passwords are used anywhere +real. + +| user | password | role | editor of | use it for | +|---|---|---|---|---| +| `maker` | `general` | Alpha | USA Births Names, the first chart, the first dataset, Sales Dashboard (sole editor) | making changes | +| `checker` | `general` | Alpha | USA Births Names, the first chart, the first dataset | reviewing them | +| `viewer` | `general` | Gamma + "Viewer (data access)" | nothing | seeing what everyone else sees | +| `admin` | `admin` | Admin | nothing | setup, and checking there is no admin bypass | + +The seeded assets, all from `superset load-examples`: + +| asset | editors | what it is for | +|---|---|---| +| **USA Births Names** (dashboard) | maker, checker | the main walkthrough: a change here can be approved | +| **Sales Dashboard** (dashboard) | maker only | the state where nobody else can approve | +| first chart by id (**Deck.gl Grid** on a fresh load) | maker, checker | the chart walkthrough | +| first dataset by id (**bart_lines** on a fresh load) | maker, checker | the dataset walkthrough | + +**Test as `maker`, `checker` and `viewer`, not as `admin`.** Admin's blanket +access deliberately does not count as editorship for approval, so admin sees +a more permissive picture than a real user does. Permission and UI bugs only show up on the non-admin accounts. -Two accounts exist because an author may never approve their own work: the -gate looks for a *second* editor of the asset, so one account cannot -demonstrate the flow at all. +Two editor accounts exist because an author may never approve their own +work: the gate looks for a *second* editor of the asset, so one account +cannot demonstrate the flow at all. `viewer` is deliberately an editor of +nothing: while a change sits in review its bell has no count, it has nothing +in Approvals, and it sees the asset exactly as it was. + +Use one browser profile (or a private window) per account, so you can switch +between them without signing out each time. --- -## The flow to walk +## The happy flow, step by step + +Run `qa/seed.py` first (see [Starting over](#starting-over)). It leaves one +change already waiting: `maker` renamed **USA Births Names** to +"USA Births Names (Q4)" and asked for review. Steps 1–3 look at that change +from each side; step 4 onwards walks a full round yourself. Each step says +what you should see; anything else is a finding. + +### A. A change waits for review + +1. **As `viewer`** — open **USA Births Names**. + - The title is still "USA Births Names". No banner, no badge, and the bell has no count. + - Settings has no Approvals entry for you. Opening `/approvals/` directly says "Nothing needs you right now". +2. **As `admin`** — open **USA Births Names**. + - No review banner and no Approve button. Admin is not an editor, and there is no admin bypass. +3. **As `checker`** — find the change. + - The bell shows **1**; its popover lists USA Births Names under "Needs your review". + - Home → **Pending reviews** lists it. + - **Settings → Manage → Approvals** (or the bell's "View all approvals") lists it as "Needs your review", with a **Review** button. + +### B. Review it on the dashboard + +4. **As `checker`** — click **Review**. It opens the dashboard itself. + - A banner reads "Reviewing changes from Maker (QA) · N changes", with **Show changes**, **What changed** and **Open live version**. + - The **Review changes** panel opens on its own, beside the charts. It shows the field diff (`dashboard_title`: old struck through, new in green), an "Add to the note" box, and **Request changes** / **Approve** pinned to its footer. + - **Show changes** previews the dashboard as it would look approved. +5. **As `checker`** — press **Edit dashboard**. + - A dialog says "Maker (QA) is changing this dashboard", with when it was saved and **View changes**. Only one change per asset can be open. Cancel. +6. **As `checker`** — **Request changes**, type a note, send. +7. **As `maker`** — open **USA Births Names**. + - The banner says checker requested changes and shows the note. + - The bell lists it under "Returned to you". + +### C. Make and send a change yourself + +8. **As `maker`** — **Edit dashboard**, change the title, **Save**. + - The toast says "Changes saved. Viewers still see the live version." + - The banner reads "Viewing your changes … viewers still see the live version", with **Show changes**, **What changed** and **Request review**. + - Check as `viewer` in the other window: still the old title. +9. **As `maker`** — **Request review**. + - The dialog shows "Who can approve: Checker (QA)", an optional "Ask someone specific" picker, and "Your changes lock while they wait. Editing withdraws the request." + - Add a note and send. The banner turns to "Awaiting review … Checker (QA) can approve", and you are never offered an Approve button. + +### D. Approve it + +10. **As `checker`** — open the dashboard again (bell or Approvals) and press **Approve** in the panel. + - It asks first: "Approve and publish? Viewers see these changes right away. The current version moves to version history." + - Confirm. The banner disappears and the new title is live. +11. **As `viewer`** — reload. The new title is there now. +12. **As `checker`** — **⋯ → View version history**. The approval is the newest entry. + +### E. Charts + +13. **As `maker`** — open the seeded chart in Explore, change its name, **Save**. + - The chart shows the "viewers still see the live version" banner. **Charts** lists it with a **Changes pending** tag. As `viewer`, the chart keeps its old name. +14. **As `maker`** — **Request review** from the chart's banner. +15. **As `checker`** — **Settings → Manage → Approvals → Review**, then Approve. The new name goes live. + +### F. Datasets + +16. **As `maker`** — **Datasets → edit** the seeded dataset, change something (for example a metric label on the Metrics tab), **Save**, **Confirm**. + - The toast says the changes are saved and viewers still see the live version, with a **Review changes →** link. +17. **As `maker`** — follow **Review changes →**. It opens Approvals filtered to "Submitted by me". + - The dataset row is a Draft with **Request review**. Send it. The row flips to "Awaiting review". +18. **As `checker`** — **Approvals → Review** on the dataset row. + - The "Review dataset changes" dialog opens on the tab that changed (Source / Metrics / Columns). + - It shows live struck through beside proposed in green, and how many charts and dashboards use the dataset. + - **Approve**. The change goes live. + +### G. Deletes wait too + +19. **As `maker`** — delete the seeded chart from the **Charts** list and confirm. + - The toast says the delete was submitted for review and nothing has been removed. The chart is still listed. + - Approving it as `checker` removes it; request changes to keep it. + +### H. When nobody else can approve + +20. **As `maker`** — on **Sales Dashboard** (maker is its only editor), change the title, **Save**, **Request review**. + - The dialog says "No one else can approve this dashboard. Add another editor to submit.", with an **Editors** picker and "Changing editors doesn't need approval." +21. **As `maker`** — add **Checker (QA)** in that picker. + - The warning clears in place and the dialog switches to "Who can approve: Checker (QA)". Send. + - Run the seed again afterwards to make maker the only editor again. + +### I. The rules, from the outside + +22. **As `admin`** — **Settings → Manage → Change review** opens a read-only page. + - "Require review before changes go live" — "Set in the instance configuration. Changing it needs a restart." + - The four facts below it, including **Admin bypass: Not available**. +23. **Any editor, through the API** — a direct save returns **202** with "Changes saved. Viewers still see the live version.", and the live object does not change: -Seeding leaves one change already waiting, so you can start at step 3 to see -the reviewer's side straight away, or at step 1 to do a full round yourself. + PUT /api/v1/dashboard/<id> → 202 { "message": "Changes saved. Viewers still see the live version.", ... } -1. **As `maker`** — open a dashboard, change something, Save. The toast says - viewers still see the live version. Nothing has gone live. -2. **As `maker`** — Request review. -3. **As `checker`** — the notification bell carries a count, and its popover - lists what is waiting. **Settings → Manage → Approvals** shows the same - as a list. -4. **As `checker`** — open the review. It takes you to the dashboard itself: - a banner across the top, and a panel on the right with the field-by-field - diff, "Show changes", and a link to the live version. -5. **As `checker`** — Approve, which asks for confirmation first. Or Request - changes, to send it back with a note. -6. **As `maker`** — a returned change appears in the bell as "returned". +### J. Turning it off -Datasets are reviewed from the Approvals list rather than from a page of -their own, because a dataset has no page to put a banner on. +With `CHANGE_MANAGEMENT` off (the default outside this branch), Superset behaves exactly as it does upstream: saves apply immediately, and there is no bell, banner or Approvals entry. --- @@ -164,7 +248,7 @@ Understood already — no need to file these: ## Reporting what you find -Say which account you were using, which of the six steps you were on, and +Say which account you were using, which numbered step you were on, and whether the change was new or one the seed created. Where the UI and the data disagree, the API is the tie-breaker:
