codeant-ai-for-open-source[bot] commented on code in PR #41309:
URL: https://github.com/apache/superset/pull/41309#discussion_r3456821451


##########
superset/migrations/versions/2026-06-23_03-23_a7d3f1b9c2e4_cleanup_stale_can_import_pvm.py:
##########
@@ -0,0 +1,103 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+"""clean up stale can_import permission on ImportExportRestApi
+
+The role-edit screen shows "can import on ImportExportRestApi" twice. Only one
+of those is real: the live permission is ``can_import_`` (note the trailing
+underscore), derived from the ``import_`` method on ``ImportExportRestApi``.
+The visual duplicate is a stale ``can_import`` (no trailing underscore)
+permission-view-menu (PVM) for the ``ImportExportRestApi`` view menu, left over
+from an older Superset/FAB era and persisted across upgrades. FAB renders
+``can_import_`` as "can import " and ``can_import`` as "can import", which look
+identical in the UI.
+
+Current code can no longer create the stale row, so this migration removes it.
+Before deleting, any role that holds the stale PVM is given the live
+``can_import_`` PVM so no role silently loses import access.
+
+This is scoped to the ``ImportExportRestApi`` view menu ONLY. It does not touch
+the ``can_import`` permission name globally; ``migrate_roles`` only deletes the
+``can_import`` permission row if it has become a true orphan (no remaining
+PVMs reference it).
+
+Revision ID: a7d3f1b9c2e4
+Revises: 78a40c08b4be
+Create Date: 2026-06-23 03:23:55.000000
+
+"""
+
+# revision identifiers, used by Alembic.
+revision = "a7d3f1b9c2e4"
+down_revision = "78a40c08b4be"
+
+from alembic import op  # noqa: E402
+from sqlalchemy.orm import Session  # noqa: E402
+
+from superset.migrations.shared.security_converge import (  # noqa: E402
+    add_pvms,
+    migrate_roles,
+    Pvm,
+)
+
+VIEW_MENU = "ImportExportRestApi"
+
+# The live permission that should exist for the import endpoint. We ensure it 
is
+# present (it normally is, created on startup by FAB) before reassigning roles 
to
+# it, so the lookup in ``migrate_roles`` cannot resolve to ``None``.
+NEW_PVMS = {VIEW_MENU: ("can_import_",)}
+
+# Map the stale PVM (``can_import`` with NO trailing underscore) to the live 
one
+# (``can_import_``). ``migrate_roles`` will, for every role holding the stale
+# PVM: add the live PVM (if missing), remove the stale PVM, then delete the
+# stale PVM row. The stale ``can_import`` permission row and the view menu are
+# only deleted by the helper if they become orphans afterwards.
+PVM_MAP = {
+    Pvm(VIEW_MENU, "can_import"): (Pvm(VIEW_MENU, "can_import_"),),
+}
+
+
+def do_upgrade(session: Session) -> None:
+    # Guarantee the live PVM exists before we point roles at it. ``add_pvms`` 
is
+    # idempotent: it only creates rows that are missing.
+    add_pvms(session, NEW_PVMS)
+    # On a clean install the stale PVM does not exist; ``migrate_roles`` 
resolves
+    # the old PVM to ``None`` and becomes a no-op, so this is safe to run
+    # everywhere.
+    migrate_roles(session, PVM_MAP)
+
+
+def do_downgrade(session: Session) -> None:
+    # No-op by design. Recreating the stale ``can_import`` PVM and moving roles
+    # back onto it would reintroduce the very duplicate permission this
+    # migration removes (and the orphaned row serves no purpose). The live
+    # ``can_import_`` permission is unaffected by the upgrade, so there is
+    # nothing meaningful to restore.
+    pass

Review Comment:
   **Suggestion:** Add a docstring to this new helper function clarifying that 
downgrade is intentionally a no-op and why state is not restored. [custom_rule]
   
   **Severity Level:** Minor ⚠️
   <details>
   <summary><b>Why it matters? 🤔 </b></summary>
   
   This is a newly added Python function and it has no docstring. The custom 
rule requires new functions to be documented inline, so this is a real 
violation.
   </details>
   
   [![Fix in 
Cursor](https://new-codeant-butcket.s3.us-west-1.amazonaws.com/badges/fix-in-cursor-flat.svg)](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=570c2c672d264824b2710cd9e76ff804&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
 [![Fix in VSCode 
Claude](https://new-codeant-butcket.s3.us-west-1.amazonaws.com/badges/fix-in-vscode-claude-flat.svg)](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=570c2c672d264824b2710cd9e76ff804&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
   
   *(Use Cmd/Ctrl + Click for best experience)*
   <details>
   <summary><b>Prompt for AI Agent 🤖 </b></summary>
   
   ```mdx
   This is a comment left during a code review.
   
   **Path:** 
superset/migrations/versions/2026-06-23_03-23_a7d3f1b9c2e4_cleanup_stale_can_import_pvm.py
   **Line:** 83:89
   **Comment:**
        *Custom Rule: Add a docstring to this new helper function clarifying 
that downgrade is intentionally a no-op and why state is not restored.
   
   Validate the correctness of the flagged issue. If correct, How can I resolve 
this? If you propose a fix, implement it and please make it concise.
   Once fix is implemented, also check other comments on the same PR, and ask 
user if the user wants to fix the rest of the comments as well. if said yes, 
then fetch all the comments validate the correctness and implement a minimal fix
   ```
   </details>
   <a 
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F41309&comment_hash=360237954996665c589c82f06b03c21ede06553ad7bfe832fd69c3f9e905047b&reaction=like'>👍</a>
 | <a 
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F41309&comment_hash=360237954996665c589c82f06b03c21ede06553ad7bfe832fd69c3f9e905047b&reaction=dislike'>👎</a>



##########
superset/migrations/versions/2026-06-23_03-23_a7d3f1b9c2e4_cleanup_stale_can_import_pvm.py:
##########
@@ -0,0 +1,103 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+"""clean up stale can_import permission on ImportExportRestApi
+
+The role-edit screen shows "can import on ImportExportRestApi" twice. Only one
+of those is real: the live permission is ``can_import_`` (note the trailing
+underscore), derived from the ``import_`` method on ``ImportExportRestApi``.
+The visual duplicate is a stale ``can_import`` (no trailing underscore)
+permission-view-menu (PVM) for the ``ImportExportRestApi`` view menu, left over
+from an older Superset/FAB era and persisted across upgrades. FAB renders
+``can_import_`` as "can import " and ``can_import`` as "can import", which look
+identical in the UI.
+
+Current code can no longer create the stale row, so this migration removes it.
+Before deleting, any role that holds the stale PVM is given the live
+``can_import_`` PVM so no role silently loses import access.
+
+This is scoped to the ``ImportExportRestApi`` view menu ONLY. It does not touch
+the ``can_import`` permission name globally; ``migrate_roles`` only deletes the
+``can_import`` permission row if it has become a true orphan (no remaining
+PVMs reference it).
+
+Revision ID: a7d3f1b9c2e4
+Revises: 78a40c08b4be
+Create Date: 2026-06-23 03:23:55.000000
+
+"""
+
+# revision identifiers, used by Alembic.
+revision = "a7d3f1b9c2e4"
+down_revision = "78a40c08b4be"
+
+from alembic import op  # noqa: E402
+from sqlalchemy.orm import Session  # noqa: E402
+
+from superset.migrations.shared.security_converge import (  # noqa: E402
+    add_pvms,
+    migrate_roles,
+    Pvm,
+)
+
+VIEW_MENU = "ImportExportRestApi"
+
+# The live permission that should exist for the import endpoint. We ensure it 
is
+# present (it normally is, created on startup by FAB) before reassigning roles 
to
+# it, so the lookup in ``migrate_roles`` cannot resolve to ``None``.
+NEW_PVMS = {VIEW_MENU: ("can_import_",)}
+
+# Map the stale PVM (``can_import`` with NO trailing underscore) to the live 
one
+# (``can_import_``). ``migrate_roles`` will, for every role holding the stale
+# PVM: add the live PVM (if missing), remove the stale PVM, then delete the
+# stale PVM row. The stale ``can_import`` permission row and the view menu are
+# only deleted by the helper if they become orphans afterwards.
+PVM_MAP = {
+    Pvm(VIEW_MENU, "can_import"): (Pvm(VIEW_MENU, "can_import_"),),
+}
+
+
+def do_upgrade(session: Session) -> None:
+    # Guarantee the live PVM exists before we point roles at it. ``add_pvms`` 
is
+    # idempotent: it only creates rows that are missing.
+    add_pvms(session, NEW_PVMS)
+    # On a clean install the stale PVM does not exist; ``migrate_roles`` 
resolves
+    # the old PVM to ``None`` and becomes a no-op, so this is safe to run
+    # everywhere.
+    migrate_roles(session, PVM_MAP)

Review Comment:
   **Suggestion:** Add a docstring to this new helper function describing that 
it ensures the live permission-view-menu exists and migrates stale role 
mappings. [custom_rule]
   
   **Severity Level:** Minor ⚠️
   <details>
   <summary><b>Why it matters? 🤔 </b></summary>
   
   This is a newly added Python function and it has no docstring. The custom 
rule requires new functions to be documented inline, so this is a real 
violation.
   </details>
   
   [![Fix in 
Cursor](https://new-codeant-butcket.s3.us-west-1.amazonaws.com/badges/fix-in-cursor-flat.svg)](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=c91be239181644468bee44f2e0b2b0b1&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
 [![Fix in VSCode 
Claude](https://new-codeant-butcket.s3.us-west-1.amazonaws.com/badges/fix-in-vscode-claude-flat.svg)](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=c91be239181644468bee44f2e0b2b0b1&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
   
   *(Use Cmd/Ctrl + Click for best experience)*
   <details>
   <summary><b>Prompt for AI Agent 🤖 </b></summary>
   
   ```mdx
   This is a comment left during a code review.
   
   **Path:** 
superset/migrations/versions/2026-06-23_03-23_a7d3f1b9c2e4_cleanup_stale_can_import_pvm.py
   **Line:** 73:80
   **Comment:**
        *Custom Rule: Add a docstring to this new helper function describing 
that it ensures the live permission-view-menu exists and migrates stale role 
mappings.
   
   Validate the correctness of the flagged issue. If correct, How can I resolve 
this? If you propose a fix, implement it and please make it concise.
   Once fix is implemented, also check other comments on the same PR, and ask 
user if the user wants to fix the rest of the comments as well. if said yes, 
then fetch all the comments validate the correctness and implement a minimal fix
   ```
   </details>
   <a 
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F41309&comment_hash=bf172315653dab5206dfeb84e0d649b754695df1bcfb984f4a90faf8fb7369ce&reaction=like'>👍</a>
 | <a 
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F41309&comment_hash=bf172315653dab5206dfeb84e0d649b754695df1bcfb984f4a90faf8fb7369ce&reaction=dislike'>👎</a>



##########
tests/integration_tests/migrations/a7d3f1b9c2e4_cleanup_stale_can_import_pvm__tests.py:
##########
@@ -0,0 +1,84 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+from importlib import import_module
+
+import pytest
+
+from superset import db
+from superset.migrations.shared.security_converge import (
+    _add_permission,
+    _add_permission_view,
+    _add_view_menu,
+    _find_pvm,
+    Role,
+)
+
+migration_module = import_module(
+    "superset.migrations.versions."
+    "2026-06-23_03-23_a7d3f1b9c2e4_cleanup_stale_can_import_pvm"
+)
+
+upgrade = migration_module.do_upgrade
+
+VIEW = "ImportExportRestApi"
+STALE_PERM = "can_import"  # no trailing underscore
+LIVE_PERM = "can_import_"  # trailing underscore (the real permission)
+
+
[email protected]("app_context")
+def test_migration_reassigns_roles_and_removes_stale_pvm():
+    # Arrange: simulate a metadata DB upgraded from an older era that still has
+    # the stale ``can_import`` PVM on the ImportExportRestApi view menu, held 
by
+    # a role.
+    view_menu = _add_view_menu(db.session, VIEW)
+    stale_permission = _add_permission(db.session, STALE_PERM)
+    stale_pvm = _add_permission_view(db.session, stale_permission, view_menu)
+
+    role = Role(name="stale_import_role")
+    role.permissions.append(stale_pvm)
+    db.session.add(role)
+    db.session.commit()
+
+    assert _find_pvm(db.session, VIEW, STALE_PERM) is not None
+
+    # Act
+    upgrade(db.session)
+
+    # Assert: the live PVM exists, the stale one is gone, and the role kept
+    # import access by being moved onto the live PVM.
+    live_pvm = _find_pvm(db.session, VIEW, LIVE_PERM)
+    assert live_pvm is not None
+    assert _find_pvm(db.session, VIEW, STALE_PERM) is None
+
+    refreshed_role = 
db.session.query(Role).filter_by(name="stale_import_role").one()
+    assert live_pvm in refreshed_role.permissions
+
+    # Cleanup
+    db.session.delete(refreshed_role)
+    db.session.commit()
+
+
[email protected]("app_context")
+def test_migration_is_noop_on_clean_install():

Review Comment:
   **Suggestion:** Add an explicit return type annotation to this new test 
function so it satisfies the typing requirement for modified code. [custom_rule]
   
   **Severity Level:** Minor ⚠️
   <details>
   <summary><b>Why it matters? 🤔 </b></summary>
   
   This is another newly added Python function without a return type annotation.
   That violates the rule requiring new Python code to be fully typed.
   </details>
   
   [![Fix in 
Cursor](https://new-codeant-butcket.s3.us-west-1.amazonaws.com/badges/fix-in-cursor-flat.svg)](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=88669746d1104cd18762b1daab4c93b1&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
 [![Fix in VSCode 
Claude](https://new-codeant-butcket.s3.us-west-1.amazonaws.com/badges/fix-in-vscode-claude-flat.svg)](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=88669746d1104cd18762b1daab4c93b1&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
   
   *(Use Cmd/Ctrl + Click for best experience)*
   <details>
   <summary><b>Prompt for AI Agent 🤖 </b></summary>
   
   ```mdx
   This is a comment left during a code review.
   
   **Path:** 
tests/integration_tests/migrations/a7d3f1b9c2e4_cleanup_stale_can_import_pvm__tests.py
   **Line:** 76:76
   **Comment:**
        *Custom Rule: Add an explicit return type annotation to this new test 
function so it satisfies the typing requirement for modified code.
   
   Validate the correctness of the flagged issue. If correct, How can I resolve 
this? If you propose a fix, implement it and please make it concise.
   Once fix is implemented, also check other comments on the same PR, and ask 
user if the user wants to fix the rest of the comments as well. if said yes, 
then fetch all the comments validate the correctness and implement a minimal fix
   ```
   </details>
   <a 
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F41309&comment_hash=24a1cdcc714d5693932dd7c448b7b95a1dee61c17c0dd2d52db57e8799b5abbc&reaction=like'>👍</a>
 | <a 
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F41309&comment_hash=24a1cdcc714d5693932dd7c448b7b95a1dee61c17c0dd2d52db57e8799b5abbc&reaction=dislike'>👎</a>



##########
superset/migrations/versions/2026-06-23_03-23_a7d3f1b9c2e4_cleanup_stale_can_import_pvm.py:
##########
@@ -0,0 +1,103 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+"""clean up stale can_import permission on ImportExportRestApi
+
+The role-edit screen shows "can import on ImportExportRestApi" twice. Only one
+of those is real: the live permission is ``can_import_`` (note the trailing
+underscore), derived from the ``import_`` method on ``ImportExportRestApi``.
+The visual duplicate is a stale ``can_import`` (no trailing underscore)
+permission-view-menu (PVM) for the ``ImportExportRestApi`` view menu, left over
+from an older Superset/FAB era and persisted across upgrades. FAB renders
+``can_import_`` as "can import " and ``can_import`` as "can import", which look
+identical in the UI.
+
+Current code can no longer create the stale row, so this migration removes it.
+Before deleting, any role that holds the stale PVM is given the live
+``can_import_`` PVM so no role silently loses import access.
+
+This is scoped to the ``ImportExportRestApi`` view menu ONLY. It does not touch
+the ``can_import`` permission name globally; ``migrate_roles`` only deletes the
+``can_import`` permission row if it has become a true orphan (no remaining
+PVMs reference it).
+
+Revision ID: a7d3f1b9c2e4
+Revises: 78a40c08b4be
+Create Date: 2026-06-23 03:23:55.000000
+
+"""
+
+# revision identifiers, used by Alembic.
+revision = "a7d3f1b9c2e4"
+down_revision = "78a40c08b4be"
+
+from alembic import op  # noqa: E402
+from sqlalchemy.orm import Session  # noqa: E402
+
+from superset.migrations.shared.security_converge import (  # noqa: E402
+    add_pvms,
+    migrate_roles,
+    Pvm,
+)
+
+VIEW_MENU = "ImportExportRestApi"
+
+# The live permission that should exist for the import endpoint. We ensure it 
is
+# present (it normally is, created on startup by FAB) before reassigning roles 
to
+# it, so the lookup in ``migrate_roles`` cannot resolve to ``None``.
+NEW_PVMS = {VIEW_MENU: ("can_import_",)}
+
+# Map the stale PVM (``can_import`` with NO trailing underscore) to the live 
one
+# (``can_import_``). ``migrate_roles`` will, for every role holding the stale
+# PVM: add the live PVM (if missing), remove the stale PVM, then delete the
+# stale PVM row. The stale ``can_import`` permission row and the view menu are
+# only deleted by the helper if they become orphans afterwards.
+PVM_MAP = {
+    Pvm(VIEW_MENU, "can_import"): (Pvm(VIEW_MENU, "can_import_"),),
+}
+
+
+def do_upgrade(session: Session) -> None:
+    # Guarantee the live PVM exists before we point roles at it. ``add_pvms`` 
is
+    # idempotent: it only creates rows that are missing.
+    add_pvms(session, NEW_PVMS)
+    # On a clean install the stale PVM does not exist; ``migrate_roles`` 
resolves
+    # the old PVM to ``None`` and becomes a no-op, so this is safe to run
+    # everywhere.
+    migrate_roles(session, PVM_MAP)
+
+
+def do_downgrade(session: Session) -> None:
+    # No-op by design. Recreating the stale ``can_import`` PVM and moving roles
+    # back onto it would reintroduce the very duplicate permission this
+    # migration removes (and the orphaned row serves no purpose). The live
+    # ``can_import_`` permission is unaffected by the upgrade, so there is
+    # nothing meaningful to restore.
+    pass
+
+
+def upgrade():

Review Comment:
   **Suggestion:** Add an explicit return type annotation to this new migration 
entrypoint function. [custom_rule]
   
   **Severity Level:** Minor ⚠️
   <details>
   <summary><b>Why it matters? 🤔 </b></summary>
   
   The new top-level migration entrypoint is a Python function and it omits a 
return type annotation. The custom rule requires newly added Python functions 
to be fully typed when surrounding code is being changed, so this is a real 
violation.
   </details>
   
   [![Fix in 
Cursor](https://new-codeant-butcket.s3.us-west-1.amazonaws.com/badges/fix-in-cursor-flat.svg)](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=6eea5850612a45e19bbd86d1a42fa8d7&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
 [![Fix in VSCode 
Claude](https://new-codeant-butcket.s3.us-west-1.amazonaws.com/badges/fix-in-vscode-claude-flat.svg)](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=6eea5850612a45e19bbd86d1a42fa8d7&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
   
   *(Use Cmd/Ctrl + Click for best experience)*
   <details>
   <summary><b>Prompt for AI Agent 🤖 </b></summary>
   
   ```mdx
   This is a comment left during a code review.
   
   **Path:** 
superset/migrations/versions/2026-06-23_03-23_a7d3f1b9c2e4_cleanup_stale_can_import_pvm.py
   **Line:** 92:92
   **Comment:**
        *Custom Rule: Add an explicit return type annotation to this new 
migration entrypoint function.
   
   Validate the correctness of the flagged issue. If correct, How can I resolve 
this? If you propose a fix, implement it and please make it concise.
   Once fix is implemented, also check other comments on the same PR, and ask 
user if the user wants to fix the rest of the comments as well. if said yes, 
then fetch all the comments validate the correctness and implement a minimal fix
   ```
   </details>
   <a 
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F41309&comment_hash=3ee170301a15f5f05cc732f698fb0b3e8dd05da40b4bfae539e112ee7cda11dd&reaction=like'>👍</a>
 | <a 
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F41309&comment_hash=3ee170301a15f5f05cc732f698fb0b3e8dd05da40b4bfae539e112ee7cda11dd&reaction=dislike'>👎</a>



##########
tests/integration_tests/migrations/a7d3f1b9c2e4_cleanup_stale_can_import_pvm__tests.py:
##########
@@ -0,0 +1,84 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+from importlib import import_module
+
+import pytest
+
+from superset import db
+from superset.migrations.shared.security_converge import (
+    _add_permission,
+    _add_permission_view,
+    _add_view_menu,
+    _find_pvm,
+    Role,
+)
+
+migration_module = import_module(
+    "superset.migrations.versions."
+    "2026-06-23_03-23_a7d3f1b9c2e4_cleanup_stale_can_import_pvm"
+)
+
+upgrade = migration_module.do_upgrade
+
+VIEW = "ImportExportRestApi"
+STALE_PERM = "can_import"  # no trailing underscore
+LIVE_PERM = "can_import_"  # trailing underscore (the real permission)
+
+
[email protected]("app_context")
+def test_migration_reassigns_roles_and_removes_stale_pvm():

Review Comment:
   **Suggestion:** Add an explicit return type annotation to this new test 
function so it complies with the full typing rule for new Python code. 
[custom_rule]
   
   **Severity Level:** Minor ⚠️
   <details>
   <summary><b>Why it matters? 🤔 </b></summary>
   
   This is a newly added Python function, and it has no return type annotation.
   The custom rule requires new Python code to be fully typed, so this is a 
real violation.
   </details>
   
   [![Fix in 
Cursor](https://new-codeant-butcket.s3.us-west-1.amazonaws.com/badges/fix-in-cursor-flat.svg)](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=84174a5674dd40619fa35d700b564123&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
 [![Fix in VSCode 
Claude](https://new-codeant-butcket.s3.us-west-1.amazonaws.com/badges/fix-in-vscode-claude-flat.svg)](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=84174a5674dd40619fa35d700b564123&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
   
   *(Use Cmd/Ctrl + Click for best experience)*
   <details>
   <summary><b>Prompt for AI Agent 🤖 </b></summary>
   
   ```mdx
   This is a comment left during a code review.
   
   **Path:** 
tests/integration_tests/migrations/a7d3f1b9c2e4_cleanup_stale_can_import_pvm__tests.py
   **Line:** 43:43
   **Comment:**
        *Custom Rule: Add an explicit return type annotation to this new test 
function so it complies with the full typing rule for new Python code.
   
   Validate the correctness of the flagged issue. If correct, How can I resolve 
this? If you propose a fix, implement it and please make it concise.
   Once fix is implemented, also check other comments on the same PR, and ask 
user if the user wants to fix the rest of the comments as well. if said yes, 
then fetch all the comments validate the correctness and implement a minimal fix
   ```
   </details>
   <a 
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F41309&comment_hash=9f093734052771366f89ddfcffb1592912c19bdf66b7fdb03a3daf53f9772949&reaction=like'>👍</a>
 | <a 
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F41309&comment_hash=9f093734052771366f89ddfcffb1592912c19bdf66b7fdb03a3daf53f9772949&reaction=dislike'>👎</a>



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to