rusackas opened a new pull request, #41967:
URL: https://github.com/apache/superset/pull/41967
### SUMMARY
Test-only PR for #27900 ("Cannot use drill-by/drill-to without `can explore`
on Superset permission").
The issue reports that Drill By / Drill to Detail appears to require the
broad `can explore on Superset` permission, which also grants the ability to
view the underlying query and edit charts. This PR adds regression coverage
that pins the actual backend behavior of the Drill By access gate.
`superset/explore/utils.py::check_access` is the access check invoked by
`CreateFormDataCommand` when the client stores drill `form_data` through
`ExploreFormDataRestApi` — the endpoint issue commenters specifically
identified as required "for drill-by". The new tests assert:
- **`test_drill_by_access_without_can_explore`** — with `can read on Chart`
granted and `can explore on Superset` *explicitly denied*, access is still
granted. Drill By does not require `can explore`.
- **`test_drill_by_access_can_explore_is_not_the_gate`** — with *only* `can
explore on Superset` granted (and `can read on Chart` denied, not owner/admin),
access is refused. `can explore` is neither necessary nor sufficient; the
granular chart-read permission is the real gate.
No production code is changed.
### How to interpret CI
- **Green** (expected on current master): the backend Drill By gate is
already decoupled from `can explore` — access is governed by the granular `can
read on Chart` permission. This documents/guards the current contract and
matches recent maintainer reports that drilling works with granular permissions
(`can drill on Dashboard`, `can samples on Datasource`, `can write on
ExploreFormDataRestApi`) and no `can explore`.
- **Red**: the gate would still be coupled to `can explore`, meaning the
reported bug is live at the backend layer.
Note: this covers the backend permission path. Any residual `can explore`
coupling in the frontend menu/UI (e.g. the "Edit chart" affordance inside the
drill modal) is out of scope for this backend test.
### TESTING INSTRUCTIONS
```bash
pytest
tests/unit_tests/explore/utils_test.py::test_drill_by_access_without_can_explore
\
tests/unit_tests/explore/utils_test.py::test_drill_by_access_can_explore_is_not_the_gate
-v
```
### ADDITIONAL INFORMATION
- [ ] Has associated issue: Closes #27900
- [x] Required feature flags: none
- [x] Changes UI: no
- [x] Includes DB Migration: no
- [x] Introduces new feature or API: no
- [x] Removes existing feature or API: no
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
