rusackas opened a new pull request, #40136: URL: https://github.com/apache/superset/pull/40136
### SUMMARY This is a **test-only PR** opened as a TDD-style validation of issue #21000. #21000 (filed 2022-08) reports that dashboards configured with role restrictions via `DASHBOARD_RBAC` lose those role assignments when exported — `roles` is silently dropped from the YAML, so a re-import recreates the dashboard with no access restriction. This is a security regression: a "least privilege" dashboard becomes "all roles can access" on round-trip. This PR adds two regression tests on `ExportDashboardsCommand._file_content`: 1. **`test_file_content_includes_roles_for_dashboard_with_role_restrictions`** — mocks a dashboard with two roles (`Finance`, `Executives`) and asserts the exported YAML includes `roles: [Finance, Executives]`. 2. **`test_file_content_omits_roles_field_when_dashboard_has_no_roles`** — pins backward compatibility: a dashboard with no role restrictions must not emit an empty `roles: []` (older bundles in the wild rely on the field being absent for "no restriction"). ### How to interpret CI - **CI green** → roles are now included in exports; merging closes #21000 and locks in the regression guards. - **CI red** → bug is still live. Likely fix: add `roles` to `Dashboard.export_fields` (currently `superset/models/dashboard.py:182`) and have `_file_content` serialize role *names* (not IDs, since IDs are environment-local). ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF N/A — test-only. ### TESTING INSTRUCTIONS ```bash pytest tests/unit_tests/commands/dashboard/export_test.py::test_file_content_includes_roles_for_dashboard_with_role_restrictions -v pytest tests/unit_tests/commands/dashboard/export_test.py::test_file_content_omits_roles_field_when_dashboard_has_no_roles -v ``` ### ADDITIONAL INFORMATION - [ ] Has associated issue: closes #21000 - [ ] Required feature flags: `DASHBOARD_RBAC` (for the bug to manifest in practice; tests don't require it) - [ ] Changes UI - [ ] Includes DB Migration - [ ] Introduces new feature or API - [ ] Removes existing feature or API 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
