aminghadersohi opened a new pull request, #44107: URL: https://github.com/apache/superset/pull/44107
### SUMMARY `redact_filter_state_data_model_metadata` withholds all `dataMask` from callers failing `user_can_view_data_model_metadata()`, so an assistant acting for a restricted-role user cannot see which filters that user applied. The metadata gate is correct and is retained (see #39632, #41753); filter *values* should not be collateral damage. This adds a narrow `filter_state.native_filter_values` projection for configured select, numeric-range, time-range, and time-grain filters: display names, IDs, types, selected scalar/flat-list values or time ranges, labels, and boolean exclusion flags. IDs and types are matched against dashboard configuration, not trusted from the supplied mask. Unsupported filter types and malformed value structures are omitted rather than guessed; `native_filter_values_incomplete` flags omitted context or predicate semantics the display values cannot represent. **Exposure delta:** a restricted-role caller with access to the dashboard can read selected values/time ranges, display labels, and exclusion flags from a matching permalink snapshot (or supplied filter state), associated with filter IDs, names, and types that were already visible. Previously the entire `dataMask`, including these selections, was removed. For example, the caller can see that the Region filter has selected `EMEA`, but not its target dataset ID or column name. Raw `dataMask`, `chartStates`, filter targets, query columns, SQL predicates, and nested filter-state metadata are not added to this projection. Time-column filters, custom filters, unknown IDs, and chart cross-filters are omitted. Other existing top-level state handling is unchanged; this is not a general filter-state sanitizer. The metadata-access gate and dashboard access checks are unchanged. Privileged callers retain their existing unredacted state path. **Known limitation:** a permalink is a shared snapshot, not proof the requesting user selected those values. The projection is display context, not automatically enforced query predicates or a complete description of filter scope. **Review guidance:** the redaction path in `schemas.py` is the riskiest hunk. Tests cover both restricted and privileged access, through both permalink and caller-supplied state, plus unsupported/malformed inputs and nested metadata exclusion. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF Not applicable: MCP response-only change. ### TESTING INSTRUCTIONS 1. Run `pytest tests/unit_tests/mcp_service/dashboard/test_dashboard_schemas.py tests/unit_tests/mcp_service/dashboard/tool/test_dashboard_tools.py`. 2. On a dashboard with native select/range/time/time-grain filters, save a permalink after choosing values. Call `get_dashboard_info` with its dashboard identifier and `permalink_key` as a dashboard-authorized user without data-model metadata access. 3. Verify `filter_state.native_filter_values` contains display selections, but not raw `dataMask`, `chartStates`, dataset targets, query columns, or nested metadata. Include a time-column or unsupported filter and verify it is omitted and incompleteness is flagged. 4. Repeat with caller-supplied `filter_state`, then repeat both paths as a metadata-privileged user: the original state must remain intact. If using explicit `select_columns`, include `filter_state`. Local validation: all changed-file pre-commit hooks passed (including mypy, ruff, and pylint); the two changed test modules passed **170 tests**, and the permalink test module passed **25 tests**. Live UI verification was not run because the local app health endpoint was unavailable. ### ADDITIONAL INFORMATION Follow-up, outside this PR: end-to-end filter inheritance and enforcement in consuming integrations. No query execution or filter-scope reconstruction is added here. - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [x] Introduces new feature or API (additive MCP response fields) - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
