codeant-ai-for-open-source[bot] commented on code in PR #43179:
URL: https://github.com/apache/superset/pull/43179#discussion_r3786586920
##########
tests/integration_tests/charts/data/api_tests.py:
##########
@@ -1573,18 +1573,58 @@ def
test_chart_data_with_incompatible_adhoc_column(self):
def test_chart_data_as_guest_user(self, is_guest_user, has_guest_access):
"""
Chart data API: Test response does not inlcude the SQL query for
embedded
- users.
+ users without the `can view query on Dashboard` permission.
"""
g.user.rls = []
is_guest_user.return_value = True
has_guest_access.return_value = True
- rv = self.client.post(CHART_DATA_URI, json=self.query_context_payload)
+ with self.deny_permission("can_view_query", "Dashboard"):
+ rv = self.client.post(CHART_DATA_URI,
json=self.query_context_payload)
data = json.loads(rv.data.decode("utf-8"))
result = data["result"]
excluded_key = "query"
assert all([excluded_key not in query for query in result]) # noqa:
C419
+
@mock.patch("superset.security.manager.SupersetSecurityManager.has_guest_access")
+
@mock.patch("superset.security.manager.SupersetSecurityManager.is_guest_user")
+ @pytest.mark.usefixtures("load_birth_names_dashboard_with_slices")
+ def test_chart_data_as_guest_user_with_view_query_permission(
+ self, is_guest_user, has_guest_access
+ ):
+ """
+ Chart data API: Test response includes the SQL query for embedded users
+ whose role was granted `can view query on Dashboard` (issue #43100).
+ """
+ g.user.rls = []
+ is_guest_user.return_value = True
+ has_guest_access.return_value = True
+
+ rv = self.client.post(CHART_DATA_URI, json=self.query_context_payload)
Review Comment:
**Suggestion:** The positive integration test mocks `is_guest_user` while
`setUp` has already logged in `ADMIN_USERNAME`, so `g.user` remains an Admin
and `can_access("can_view_query", "Dashboard")` succeeds because of Admin
permissions. This test therefore passes even if guest-token role resolution or
the guest role's permission is broken. Execute the request with an actual
`GuestUser` carrying the intended role, or explicitly configure the guest
role's permission and verify the real lookup path. [possible bug]
<details>
<summary><b>Severity Level:</b> Major ⚠️</summary>
```mdx
- ⚠️ Positive coverage does not validate embedded guest-role permissions.
- ⚠️ Guest permission-resolution regressions can pass this test.
- ❌ Intended guest SQL exposure behavior may be incorrectly shipped.
```
</details>
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=fdabd3413af649ea8b8bf2e3b49b4749&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=fdabd3413af649ea8b8bf2e3b49b4749&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** tests/integration_tests/charts/data/api_tests.py
**Line:** 1599:1603
**Comment:**
*Possible Bug: The positive integration test mocks `is_guest_user`
while `setUp` has already logged in `ADMIN_USERNAME`, so `g.user` remains an
Admin and `can_access("can_view_query", "Dashboard")` succeeds because of Admin
permissions. This test therefore passes even if guest-token role resolution or
the guest role's permission is broken. Execute the request with an actual
`GuestUser` carrying the intended role, or explicitly configure the guest
role's permission and verify the real lookup path.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43179&comment_hash=66287949e308222a1b2aea02f1b2b33d2158c04727dd31ffae180d63e1438fa3&reaction=like'>👍</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43179&comment_hash=66287949e308222a1b2aea02f1b2b33d2158c04727dd31ffae180d63e1438fa3&reaction=dislike'>👎</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
