aminghadersohi commented on PR #42297: URL: https://github.com/apache/superset/pull/42297#issuecomment-5186264113
Follow-up review improvements are in 169afa3d7f456c542712c939fb92f2481d9d4c2e: - Moved the canonical method/action and class/resource mappings into `superset.security.api_key_scopes`, avoiding the security manager depending on MCP internals and eliminating duplicated mapping logic. - Issuance now rejects unsupported action strings instead of accepting values such as `delete`, `update`, or arbitrary text that runtime enforcement can never match. The supported contract in this PR is explicitly the coarse `read`/`write` action model. - Added regression coverage for unsupported actions. I also audited the concern that mutate tools might inherit read access. That is already handled by `create_tool_decorator`: when `method_permission_name` is omitted, a `mutate` tag sets `_method_permission_name` to `write` (`superset/core/mcp/core_mcp_injection.py`). Therefore the cited delete/update tools require write scope despite omitting the explicit decorator argument. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
