aminghadersohi opened a new pull request, #43476: URL: https://github.com/apache/superset/pull/43476
### SUMMARY Reject unsafe full `position_json` replacements in the MCP `update_dashboard` tool before they overwrite a valid saved layout. Superset renders only layout nodes reachable from `ROOT_ID`, but dashboard hydration indexes every `CHART` node in `position_json`. An unreachable chart therefore prevents the normal missing-chart fallback while remaining invisible, which can leave a dashboard blank even though the chart nodes and slice associations still exist. This change validates renderer-required component shape, the v2 marker, graph references, parent/child compatibility, cycles, component IDs, parent paths, reachability, and root/top-level-tab shape. Traversal is iterative, imported decimal-string chart IDs are normalized through a helper shared with chart removal, and `DYNAMIC` nodes are rejected because the backend cannot validate the frontend registry. Reachable chart IDs must exactly match the charts associated with the dashboard. Invalid updates return `InvalidDashboardLayout` before any field mutation or commit, preserving the previous layout. The validator handles Superset's two reserved exceptions: detached `HEADER_ID`, and the empty detached `GRID_ID` retained by top-level tab layouts. The MCP schema now explicitly states that `get_dashboard_layout` is a summary rather than a round-trippable raw tree, so callers are not directed into unsafe incremental full replacements. Tracking: [SC-117987](https://app.shortcut.com/preset/story/117987) `[sc-117987]` Related: #43133 contains generate-only fallback validation as part of native AI authoring. This PR provides the stronger shared validator for that path to reuse after rebase while keeping update rejection separate from generate fallback behavior. (Recreated after the original #43367 was closed automatically when its source fork was deleted; branch and commits are unchanged.) ### TESTING INSTRUCTIONS - `pre-commit run --files superset/mcp_service/dashboard/layout_validation.py superset/mcp_service/dashboard/schemas.py superset/mcp_service/dashboard/tool/update_dashboard.py superset/mcp_service/dashboard/tool/remove_chart_from_dashboard.py tests/unit_tests/mcp_service/dashboard/test_layout_validation.py tests/unit_tests/mcp_service/dashboard/tool/test_update_dashboard.py` - `ruff check` and `ruff format --check` pass for all changed Python files. - `git diff --check` - 19 standalone structural validator regression cases pass locally. - GitHub's Python unit-test matrix passes; the full workflow reruns for the latest commit. ### ADDITIONAL INFORMATION - [x] Has associated issue: [SC-117987](https://app.shortcut.com/preset/story/117987) - [ ] Required feature flags - [ ] Changes UI - [ ] Includes DB Migration - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
