aminghadersohi commented on code in PR #40957:
URL: https://github.com/apache/superset/pull/40957#discussion_r3416978807
##########
superset/mcp_service/dashboard/schemas.py:
##########
@@ -708,6 +708,146 @@ class GenerateDashboardResponse(BaseModel):
)
+class UpdateDashboardRequest(BaseModel):
+ """Request schema for partially updating dashboard metadata.
+
+ All fields except ``dashboard_id`` are optional — only the fields that
+ are provided are changed. ``None`` means "leave unchanged"; to clear a
+ text field (e.g. ``certified_by``) pass an empty string.
+ """
+
+ model_config = ConfigDict(populate_by_name=True)
+
+ dashboard_id: int = Field(..., description="ID of the dashboard to update")
+
+ # Direct dashboard fields (match DashboardPutSchema)
+ dashboard_title: str | None = Field(
+ None,
+ description="New dashboard title.",
+ validation_alias=AliasChoices("dashboard_title", "title", "name"),
+ )
+ slug: str | None = Field(
+ None, description="New URL slug for the dashboard (must be unique)."
+ )
+ published: bool | None = Field(
+ None,
+ description=(
+ "Set to true to publish the dashboard (visible to other users), "
+ "false to unpublish it (draft)."
+ ),
+ )
+ css: str | None = Field(None, description="Custom CSS applied to the
dashboard.")
+ theme_id: int | None = Field(None, description="Theme ID for the
dashboard.")
+ certified_by: str | None = Field(
+ None,
+ description=(
+ "Person or group that certified this dashboard. "
+ "Pass an empty string to clear."
+ ),
+ )
+ certification_details: str | None = Field(
+ None,
+ description=("Details of the certification. Pass an empty string to
clear."),
+ )
+ owners: list[int] | None = Field(
Review Comment:
Good question — worth reconsidering. Two data points:
- **Precedent:** the sibling `update_chart` MCP tool deliberately omits
`owners`; the MCP update tools have so far been scoped to config/content, not
ownership/access management.
- **Risk:** this is full-replacement, and `UpdateDashboardCommand` has no
"keep ≥1 owner" guard. For an **admin** caller, `owners=[]` (or an LLM passing
a partial list intending to *add* someone) can orphan the dashboard. For
non-admins the command re-adds the caller, so the blast radius is mainly
admin/automation.
My lean: **drop `owners` from this tool** for consistency with
`update_chart`, and add a dedicated owner-management tool later with explicit
add/remove semantics if we want it. `roles`/`tags` are lower-risk replacement
fields and can stay. If you'd rather keep `owners`, the minimal safety net is
to reject an empty list to prevent orphaning.
Holding the code as-is until you pick a direction — happy to implement
either.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
