NoiceHax opened a new pull request, #43151:
URL: https://github.com/apache/superset/pull/43151
The chart data API stripped the `query` key from every JSON response as
soon as the requester was a guest user, so "View query" on an embedded
dashboard always returned `{"result": [{"language": "sql"}]}` no matter
which permissions the guest role had been granted. Gate the removal on
the "can view query on Dashboard" permission the frontend already uses to
expose the action; stacktraces and driver errors stay redacted for guests
either way.
## Testing
Two new unit tests in tests/unit_tests/charts/test_chart_data_api.py:
`test_send_chart_response_keeps_guest_query_when_permitted` (guest with
can_view_query gets the SQL back, and asserts can_access is called with
("can_view_query", "Dashboard")) and
`test_send_chart_response_still_redacts_guest_errors_when_query_permitted` (the
permission unlocks only the SQL — stacktrace/error redaction still applies).
Two existing guest tests were updated to patch can_access -> False so they keep
asserting the deny path. Also updated/added integration tests in
tests/integration_tests/charts/data/api_tests.py (that class is
@pytest.mark.skip in the repo, so those did not execute).
Added tests fail on the current code and pass with this change; the relevant
suite was run locally.
Closes #43100
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
