codeant-ai-for-open-source[bot] commented on code in PR #40352: URL: https://github.com/apache/superset/pull/40352#discussion_r3326665140
########## superset/mcp_service/annotation_layer/tool/update_annotation_layer.py: ########## @@ -0,0 +1,118 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. + +import logging +from typing import Any + +from fastmcp import Context +from superset_core.mcp.decorators import tool, ToolAnnotations + +from superset.extensions import event_logger +from superset.mcp_service.annotation_layer.schemas import ( + UpdateAnnotationLayerRequest, + UpdateAnnotationLayerResponse, +) + +logger = logging.getLogger(__name__) + + +@tool( + tags=["mutate"], + class_permission_name="Annotation", + method_permission_name="write", + annotations=ToolAnnotations( + title="Update annotation layer", + readOnlyHint=False, + destructiveHint=False, + ), +) +async def update_annotation_layer( + request: UpdateAnnotationLayerRequest, ctx: Context +) -> UpdateAnnotationLayerResponse: + """Update an existing annotation layer's name or description. + + Use this tool to rename an annotation layer or update its description. + At least one of ``name`` or ``descr`` must be provided. + + Workflow: + 1. Call this tool with the layer ``id`` and the fields to change + 2. The updated layer ``id`` and new values are returned on success + """ + await ctx.info( + "Updating annotation layer: id=%s, name=%r" % (request.id, request.name) + ) + + try: + from superset.commands.annotation_layer.exceptions import ( + AnnotationLayerInvalidError, + AnnotationLayerNotFoundError, + AnnotationLayerUpdateFailedError, + ) + from superset.commands.annotation_layer.update import ( + UpdateAnnotationLayerCommand, + ) + + properties: dict[str, Any] = {} + if request.name is not None: + properties["name"] = request.name + if request.descr is not None: + properties["descr"] = request.descr + + with event_logger.log_context(action="mcp.update_annotation_layer.update"): + layer = UpdateAnnotationLayerCommand(request.id, properties).run() Review Comment: **Suggestion:** The tool never enforces the documented requirement that at least one mutable field must be provided. If both `name` and `descr` are omitted, it sends an empty `properties` dict to the command and can return a successful update for a no-op request. Add an explicit pre-check that rejects requests where both fields are `None` and return a validation error response instead. [incomplete implementation] <details> <summary><b>Severity Level:</b> Major ⚠️</summary> ```mdx - ⚠️ MCP update_annotation_layer accepts id-only calls as successful. - ⚠️ LLM clients may assume annotation layer changed when unchanged. ``` </details> <details> <summary><b>Steps of Reproduction ✅ </b></summary> ```mdx 1. Start the MCP service so the FastMCP app from `superset/mcp_service/app.py` is running and tools are available, mirroring the setup used in `tests/unit_tests/mcp_service/annotation_layer/tool/test_update_annotation_layer.py:34-37` where the `mcp` server fixture is created. 2. Ensure there is an existing `AnnotationLayer` row in the database (for example via the Superset UI or fixtures) so that `AnnotationLayerDAO.find_by_id` in `superset/commands/annotation_layer/update.py:53` can successfully load a model for a known `id` (e.g., `id=7`). 3. From an MCP client (as in `test_update_annotation_layer_success` at `tests/unit_tests/mcp_service/annotation_layer/tool/test_update_annotation_layer.py:101-117`), construct an `UpdateAnnotationLayerRequest` with only the `id` field set and both `name` and `descr` omitted: `UpdateAnnotationLayerRequest(id=7)`, which is allowed by the schema in `superset/mcp_service/annotation_layer/schemas.py:51-63` where `name` and `descr` are optional. 4. Call the `update_annotation_layer` tool with that request: the tool implementation at `superset/mcp_service/annotation_layer/tool/update_annotation_layer.py:69-76` builds `properties` as an empty dict, passes it into `UpdateAnnotationLayerCommand(request.id, properties).run()`, whose `validate()` method in `superset/commands/annotation_layer/update.py:50-63` sees `name` as `""` and raises no validation errors; `AnnotationLayerDAO.update` then receives the model plus an empty `attributes` dict and performs a no-op update (see `BaseDAO.update` in `superset/daos/base.py:20-30`), yet the MCP tool logs "Annotation layer updated" and returns a success response with `id`/`name`/`descr` populated and `error=None`, despite no fields having changed and despite the docstring at `update_annotation_layer.py:46-50` promising that at least one of `name` or `descr` must be provided. ``` </details> [Fix in Cursor](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=6ba4323367b04f75bfd34b66d7a9fe84&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) | [Fix in VSCode Claude](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=6ba4323367b04f75bfd34b66d7a9fe84&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) *(Use Cmd/Ctrl + Click for best experience)* <details> <summary><b>Prompt for AI Agent 🤖 </b></summary> ```mdx This is a comment left during a code review. **Path:** superset/mcp_service/annotation_layer/tool/update_annotation_layer.py **Line:** 69:76 **Comment:** *Incomplete Implementation: The tool never enforces the documented requirement that at least one mutable field must be provided. If both `name` and `descr` are omitted, it sends an empty `properties` dict to the command and can return a successful update for a no-op request. Add an explicit pre-check that rejects requests where both fields are `None` and return a validation error response instead. Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise. Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix ``` </details> <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F40352&comment_hash=cd7495a9be9e1577cbbed94ba3f8d9438c01a312e7bacd435905d94f2e66e10b&reaction=like'>👍</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F40352&comment_hash=cd7495a9be9e1577cbbed94ba3f8d9438c01a312e7bacd435905d94f2e66e10b&reaction=dislike'>👎</a> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
