aminghadersohi commented on PR #42297: URL: https://github.com/apache/superset/pull/42297#issuecomment-5320188705
### Scope drift and regression guardrails Leaving this maintenance note for future MCP/API-key work: - `superset/security/api_key_scopes.py` is the canonical backend source for resource slugs, FAB method-to-`read`/`write` mapping, inverse issuance checks, and scope construction. New MCP code should consume it rather than recreate mappings. - The UI catalog in `superset-frontend/src/features/apiKeys/apiKeyScopes.ts` necessarily mirrors that backend vocabulary. `test_frontend_scope_catalog_matches_backend_contract` fails if the two catalogs diverge; update both together. - MCP tool permission metadata is security-sensitive. New or changed tools need the correct `class_permission_name` and `method_permission_name`; mutations must map to write, and unknown mappings must remain fail-closed. Permission-less protected tools require a flat scope. - Invocation, `tools/list`, tool search/proxy, and dynamic schema discovery must enforce the same scope/RBAC intersection. A new dispatch/discovery path needs matching regression coverage. - RBAC and credential scopes are independent restrictions. `MCP_RBAC_ENABLED=False` must not erase token scopes, and token-context errors must fail closed. - These are **MCP scopes**. They do not restrict ordinary REST API requests; comprehensive REST scope enforcement is a separate project. - Unscoped keys intentionally retain legacy RBAC-only behavior. Flat `superset:read`/`superset:write` remain supported, with flat self-issuance restricted to Admins. Checklist when adding a resource/action: update the canonical mapping, UI picker, tool metadata, issuance tests, runtime authorization tests, visibility/discovery tests, and operator documentation. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
