aminghadersohi opened a new pull request, #41924:
URL: https://github.com/apache/superset/pull/41924

   ## SUMMARY
   Closes systematic test-coverage gaps identified in an audit of 
`superset/mcp_service/`:
   
   - Per-tool RBAC-enforcement tests (`MCP_RBAC_ENABLED=True`) proving each of 
the 10 mutating tools (`execute_sql`, `update_chart`, `update_dashboard`, 
`generate_chart`, `generate_dashboard`, `manage_native_filters`, 
`create_dataset`, `create_virtual_dataset`, `create_theme`, `save_sql_query`) 
rejects an unauthorized principal through the real tool-call path, not just the 
isolated RBAC unit tests.
   - Pagination-boundary tests (negative page, page beyond last, page_size 
0/max) for `list_metrics`, `list_tags`, `list_users`, `list_databases`, 
`list_rls_filters`, and `list_themes`.
   - Direct unit tests for previously-untested `utils/retry_utils.py`, 
`utils/oauth2_utils.py`, and `utils/cache_utils.py`.
   - Error-path and param-edge tests for the thin-coverage tail: 
`health_check`, `get_theme_info`/`list_themes`, `open_sql_lab_with_context`, 
and the four `semantic_layer` tools.
   - A smoke test (`test_mcp_e2e_smoke.py`) that builds the real ASGI app the 
way `server.py`'s `run_server()` does and drives `tools/list` + `tools/call` 
over the actual MCP streamable-HTTP JSON-RPC protocol (via 
`httpx.ASGITransport`), exercising the FastMCP middleware stack that every 
other test bypasses via the in-process client transport.
   
   Screenshot-pool tests (`webdriver_pool.py`/`pooled_screenshot.py`) are 
intentionally out of scope — they're webdriver-heavy and tracked as a follow-up.
   
   ## BEFORE/AFTER
   Before: 2,571 tests in `tests/unit_tests/mcp_service/`, RBAC globally 
disabled for tool tests via an autouse fixture, no per-tool RBAC-rejection 
proof, several list tools with no pagination-boundary tests, three utility 
modules with zero direct coverage, and zero integration/e2e tests exercising 
the real ASGI transport.
   
   After: 2,814 tests, all passing. No source files were modified — this PR is 
test-only.
   
   ## TESTING INSTRUCTIONS
   ```
   pytest tests/unit_tests/mcp_service/ -q
   ```
   All 2,814 tests pass.
   
   ## ADDITIONAL INFORMATION
   - [x] Has associated tests
   - [ ] Changes UI
   - [ ] Requires DB Migration
   - [ ] Confirm DB Migration upgrade and downgrade tested
   - [ ] Introduces new feature or API
   - [ ] Removes existing feature


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to