richardfogaca opened a new pull request, #40532: URL: https://github.com/apache/superset/pull/40532
### SUMMARY `list_dashboards` accepted only scalar dashboard filters in its MCP request schema, so an owner relationship filter such as `owners` + `rel_m_m` failed Pydantic validation before dashboard listing could run. #### What Changed This change: - Adds `owners` and `created_by` to the dashboard MCP filter schema with their relationship operators. - Validates relationship operators against the dashboard DAO custom field/operator contract so scalar filters such as `dashboard_title` still reject relationship-only operators. - Handles owner and creator relationship filters in `superset/daos/dashboard.py` while preserving existing dashboard-specific favorite/current-user handling and generic scalar filter delegation. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF N/A - backend/MCP request validation change with API-level verification. #### Reviewer Focus The main review risk is keeping relationship operators scoped to relationship fields while avoiding a second hard-coded operator table in the MCP schema. The schema checks the dashboard DAO custom field/operator contract, and generic scalar filters continue through the existing base DAO path. ### TESTING INSTRUCTIONS #### Validation - Live MCP/API validation in a local Superset compose runtime: started the MCP streamable HTTP server from the Superset API container and posted JSON-RPC `tools/call` requests to `list_dashboards`. The reproduced `owners` + `rel_m_m` request returned HTTP 200 and reached the authentication boundary instead of `Validation error in list_dashboards`, confirming the reported validation rejection is gone. - Live MCP/API validation in the same local runtime: posted `created_by` + `rel_o_m` to `list_dashboards`; the response also reached the authentication boundary instead of schema rejection, confirming the creator relationship variant is accepted. - Live MCP/API validation in the same local runtime: posted the adversarial scalar filter `dashboard_title` + `rel_m_m`; the response returned `Validation error in list_dashboards` with an unsupported operator/column message, confirming relationship operators were not broadened to scalar fields. - Focused regression check: `pytest -q tests/unit_tests/mcp_service/dashboard/tool/test_dashboard_tools.py tests/unit_tests/dashboards/dao_tests.py` ### ADDITIONAL INFORMATION - [ ] Has associated issue: N/A - tracked internally - [ ] Required feature flags: N/A - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [x] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
