codeant-ai-for-open-source[bot] commented on code in PR #32995:
URL: https://github.com/apache/superset/pull/32995#discussion_r3501045161
##########
superset-frontend/src/pages/DatasetList/index.tsx:
##########
@@ -960,15 +939,21 @@ const DatasetList: FunctionComponent<DatasetListProps> =
({
{canDelete && (
<Tooltip
id="delete-action-tooltip"
- title={t('Delete')}
+ title={
+ allowEdit
+ ? t('Delete')
+ : t(
+ 'You must be a dataset owner in order to delete.
Please reach out to a dataset owner to request modifications or edit access.',
+ )
+ }
placement="bottom"
>
<span
data-test="dataset-row-delete"
role="button"
tabIndex={0}
- className="action-button"
- onClick={handleDelete}
+ className={`action-button ${allowEdit ? '' : 'disabled'}`}
+ onClick={allowEdit ? handleDelete : undefined}
Review Comment:
**Suggestion:** This owner/admin gate is only applied in the regular dataset
action block, but the semantic view action block in the same renderer still
uses only `can_write` and keeps edit/delete clickable for non-owners, so users
can still hit the same Forbidden flow this PR is trying to prevent. Apply the
same ownership/admin disabling logic to semantic view edit/delete actions as
well. [incomplete implementation]
<details>
<summary><b>Severity Level:</b> Critical 🚨</summary>
```mdx
- ❌ Semantic view delete remains clickable for unauthorized dataset users.
- ❌ Semantic view edit triggers backend 403 Forbidden errors.
- ⚠️ DatasetList permission UX inconsistent between dataset and semantic
views.
```
</details>
<details>
<summary><b>Steps of Reproduction ✅ </b></summary>
```mdx
1. Open the datasets list page at route `RoutePaths.DATASET_LIST` defined in
`superset-frontend/src/views/routePaths.ts:32` and wired to the
`DatasetList` component in
`superset-frontend/src/views/routes.tsx:210`, which renders
`superset-frontend/src/pages/DatasetList/index.tsx`.
2. Use a user with `can_write` permission but who is not an owner or admin:
`canEdit` and
`canDelete` are set purely from API permissions via `hasPerm('can_write')` at
`superset-frontend/src/pages/DatasetList/index.tsx:518–520`, while the
ownership/admin
gate for regular datasets is computed separately as `const allowEdit =
original.owners.map((o: Owner) => o.id).includes(Number(user.userId)) ||
isUserAdmin(user);` at `index.tsx:864–867`.
3. Ensure there is at least one row with `kind === 'semantic_view'` so that
the semantic
view branch of the Actions column is used: the Type column renders semantic
views via
`kind === 'semantic_view' ? <span>Semantic View</span>` at
`index.tsx:174–183`, and the
Actions Cell checks `const isSemanticView = original.kind ===
'semantic_view';` and enters
the semantic block at `index.tsx:818–821`. In this block, edit/delete
visibility and
clickability are gated only by `canEdit`/`canDelete` (lines `821–839` and
`842–139`) and
**do not** use `allowEdit`, so a non-owner with `can_write` sees active
edit/delete
buttons for semantic views.
4. Hover the semantic-view row and click the delete or edit icons rendered
in the
semantic-view Actions block: the delete button triggers `onClick={() =>
handleSemanticViewDelete(original)}` at `index.tsx:834–837`, which
eventually calls
`handleSemanticViewDeleteConfirm` at `index.tsx:647–655` and issues
`SupersetClient.delete({ endpoint: `/api/v1/semantic_view/${id}` })` at
`index.tsx:650`;
the edit button calls `setSvCurrentlyEditing(original)` at
`index.tsx:851–853`, opening
the semantic view edit modal (`SemanticViewEditModal` imported at
`index.tsx:89`). For a
non-owner/non-admin user with only `can_write`, the backend delete/edit
permission checks
still reject the operation (403 Forbidden as described in the PR), so the
user can reach
the same Forbidden flow this PR intended to prevent, proving that the
ownership/admin
gating applied to regular datasets (lines `864–889` and `175–181`,
`220–237`, including
the snippet at diff lines `955–956`) has not been applied to the
semantic-view actions.
```
</details>
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=21e513c20bd24ce48ab246ecd34e7f8d&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=21e513c20bd24ce48ab246ecd34e7f8d&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
*(Use Cmd/Ctrl + Click for best experience)*
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** superset-frontend/src/pages/DatasetList/index.tsx
**Line:** 955:956
**Comment:**
*Incomplete Implementation: This owner/admin gate is only applied in
the regular dataset action block, but the semantic view action block in the
same renderer still uses only `can_write` and keeps edit/delete clickable for
non-owners, so users can still hit the same Forbidden flow this PR is trying to
prevent. Apply the same ownership/admin disabling logic to semantic view
edit/delete actions as well.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F32995&comment_hash=75c54781ab5870b56fb45f1f496d580548c9551117fdbd2f84141d51e186f659&reaction=like'>👍</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F32995&comment_hash=75c54781ab5870b56fb45f1f496d580548c9551117fdbd2f84141d51e186f659&reaction=dislike'>👎</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
