rusackas commented on code in PR #43151:
URL: https://github.com/apache/superset/pull/43151#discussion_r3877992739
##########
tests/integration_tests/charts/data/api_tests.py:
##########
@@ -1573,18 +1573,47 @@ def
test_chart_data_with_incompatible_adhoc_column(self):
def test_chart_data_as_guest_user(self, is_guest_user, has_guest_access):
"""
Chart data API: Test response does not inlcude the SQL query for
embedded
- users.
+ users whose role lacks "can view query on Dashboard".
"""
g.user.rls = []
is_guest_user.return_value = True
has_guest_access.return_value = True
- rv = self.client.post(CHART_DATA_URI, json=self.query_context_payload)
+ with mock.patch(
+ "superset.charts.data.api.security_manager.can_access",
+ side_effect=lambda permission, view: (
+ (permission, view) != ("can_view_query", "Dashboard")
+ ),
+ ):
+ rv = self.client.post(CHART_DATA_URI,
json=self.query_context_payload)
data = json.loads(rv.data.decode("utf-8"))
result = data["result"]
excluded_key = "query"
assert all([excluded_key not in query for query in result]) # noqa:
C419
+
@mock.patch("superset.security.manager.SupersetSecurityManager.has_guest_access")
+
@mock.patch("superset.security.manager.SupersetSecurityManager.is_guest_user")
+ @pytest.mark.usefixtures("load_birth_names_dashboard_with_slices")
+ def test_chart_data_as_guest_user_allowed_to_view_query(
+ self, is_guest_user, has_guest_access
+ ):
+ """
Review Comment:
Fair catch on the class itself, but that skip predates this PR (whole
`TestPostChartDataApi` is marked skip for the DuckDB example-data migration,
unrelated to this fix) so it is not something to chase down here. The actual
regression coverage is real though, `test_chart_data_api.py`'s unit tests
exercise `_send_chart_response` directly with both permission states and do run
in CI.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
