sadpandajoe commented on code in PR #43303:
URL: https://github.com/apache/superset/pull/43303#discussion_r3994500470


##########
superset/commands/chart/importers/v1/utils.py:
##########
@@ -134,6 +141,69 @@ def _prepare_existing_chart_for_import(
     return None
 
 
+def _synthesize_query_context_if_absent(config: dict[str, Any]) -> None:
+    """
+    Synthesize a ``query_context`` for an imported chart that arrives without
+    one, so the first ``GET /api/v1/chart/{pk}/data/`` returns data instead of
+    HTTP 400 "Chart has no query context saved" (issue #33615, ADR-013). 
Guarded
+    on an ABSENT context so an existing/remapped one is never overwritten
+    (FR-006); mutates ``config`` in place.
+
+    Two-tier derivation:
+      1. AUTHORITATIVE — run the chart's real frontend ``buildQuery`` in V8
+         (QueryContextGenerator) for byte-faithful parity with the UI.
+      2. FALLBACK — a pure-Python generic derivation
+         (``build_query_context_config``) when the V8 bundle / py_mini_racer is
+         unavailable or the viz type is not (yet) covered by the bundle.
+    Either way the datasource is taken from the importer-resolved id/type ONLY,
+    never a value carried in params (ADR-014 authz/RLS). A per-chart derivation
+    error must never abort the bundle (RISK-T03 / FR-004).
+    """
+    if config.get("query_context"):
+        return
+    try:
+        params = config.get("params") or {}
+        viz_type = config["viz_type"]
+        datasource_id = config.get("datasource_id")
+        datasource_type = config.get("datasource_type", "table")
+
+        query_context_config = None
+        if datasource_id:
+            # form_data for the JS builder: the datasource is the
+            # importer-resolved id/type only (overwrite any incoming
+            # params.datasource — never trust it; ADR-014).
+            js_params = {

Review Comment:
   Dropping the source ID prevents foreign binding, but the saved-chart 
endpoint reconstructs this context without passing `current_slice`; with no 
local `slice_id`, `get_cache_timeout()` skips the imported chart. A chart 
imported with `cache_timeout: -1` can therefore still enter the async/cache 
path. Could synthesis bind the local chart or make the endpoint pass it 
explicitly?



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to