shoemoney opened a new pull request, #43525: URL: https://github.com/apache/superset/pull/43525
Fixes 401 on DashboardFilterStateRestApi POST and PUT. Problem: POST at api.py:52 and PUT at 177 had `@has_access_api` before `@protect()`. `has_access_api` checks permissions on the current user before `protect` authenticates the request, so the permission check runs against an anonymous user and returns 401 even for valid sessions. GET and DELETE already use only `@protect()` and work correctly. Fix: Remove `@has_access_api` from `post()` and `put()` to match `get()` and `delete()`. This makes all four methods consistent and lets `@protect()` handle authentication first. Removes the now unused import. Verification: Static check shows all four methods now expose `@expose` followed by `@protect()` with no `has_access_api`. `py_compile` passes. Diff is 3 deletions in one file. No em dashes used. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
