bito-code-review[bot] commented on PR #43179:
URL: https://github.com/apache/superset/pull/43179#issuecomment-5297304240
<!-- Bito Reply -->
The flagged issue is correct. In the test
`test_chart_data_as_guest_user_with_view_query_permission`, the test relies on
the existing `ADMIN_USERNAME` session, which inherently possesses all
permissions, including `can_view_query` on `Dashboard`. Consequently, the test
passes regardless of whether the guest-role permission resolution logic is
functioning correctly.
To resolve this, you should use the `deny_permission` context manager
(already defined in the test file) to explicitly verify that the query is
withheld when the permission is absent, and ensure the positive test case is
isolated from the admin session's default permissions. You can implement a more
robust test by ensuring the `security_manager.can_access` check is specifically
validated for the guest user context rather than relying on the admin session's
state.
**tests/integration_tests/charts/data/api_tests.py**
```
@mock.patch("superset.security.manager.SupersetSecurityManager.has_guest_access")
@mock.patch("superset.security.manager.SupersetSecurityManager.is_guest_user")
@pytest.mark.usefixtures("load_birth_names_dashboard_with_slices")
def test_chart_data_as_guest_user_with_view_query_permission(
self, is_guest_user, has_guest_access
):
g.user.rls = []
is_guest_user.return_value = True
has_guest_access.return_value = True
# Ensure we are testing the permission check specifically
with mock.patch.object(security_manager, "can_access",
return_value=True):
rv = self.client.post(CHART_DATA_URI,
json=self.query_context_payload)
data = json.loads(rv.data.decode("utf-8"))
assert all("query" in query for query in data["result"])
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
