fitzee opened a new pull request, #44191: URL: https://github.com/apache/superset/pull/44191
## TL;DR - Prevents scheduled PDF/PNG delivery after any terminal capture validation rejection. - Covers standard, tiled, and combined captures for both reports and alerts with rendered attachments. - Keeps successful in-budget recapture and text-only failure notifications working; thumbnail behavior remains permissive but uses distinct log event names. ## Why A tiled report could classify its final combined image as perceptually blank, log `report_capture_blank_combined_retained`, and still return the image for PDF/PNG delivery. Capture exceptions normally stopped delivery, but there was no durable execution-level rejection state or independent notification-boundary guard. This meant a permissive or accidentally swallowed capture path could violate the intended fail-closed behavior. The required invariant is: once a scheduled rendered capture is terminally rejected, no PDF or PNG from that execution may be delivered through any recipient path. Individual retry attempts remain recoverable; rejection becomes terminal only after capture retries are exhausted or the final combined image is invalid. ## What Terminal blank classifications are recorded as sticky rejection reasons on the report execution context. Persistently blank standard captures, individual tiles, and final combined images record the rejection and raise. Both the multi-recipient dispatcher and the individual notification sender enforce the same delivery gate, and rendered artifacts without a capture context fail closed. Text-only failure notifications remain deliverable. Thumbnail-only retained-tile logging is renamed to `thumbnail_capture_*` to distinguish it from scheduled delivery. ## Blast radius This affects scheduled PDF and PNG attachments generated by Alerts & Reports, including alerts using `ALERTS_ATTACH_REPORTS`. It does not change CSV/XLSX delivery, text alerts, UI/API PDF export, thumbnail permissiveness, schemas, authentication, RLS, or tenant isolation. ## How to test Regression coverage proves: - persistently blank standard captures record terminal rejection and raise; - persistently blank report tiles record terminal rejection and never combine; - perceptually blank combined report images raise instead of being retained; - report and alert PNG/PDF delivery is blocked after rejection; - rendered delivery without a capture context is blocked; - a direct notification call cannot bypass the gate; - text-only failure notifications remain allowed; - permissive thumbnail events use a thumbnail-specific name. Local verification: ```text 327 passed, 1 skipped pre-commit: all applicable hooks passed, including MyPy, Ruff, Ruff format, and Pylint ``` ## Risk & rollback The deliberate risk is additional failed report executions when final output is suspicious or capture provenance is missing. This is preferable to silently delivering a known-invalid artifact. Legitimate terminal empty-state tiles retain their existing state-aware exemption. There are no migrations or persistent-format changes; rollback is a normal commit revert. ## Screenshots No UI changes. ## Review guidance Please start with the final combined-image rejection in `superset/utils/screenshot_utils.py`, then the sticky context state in `superset/utils/report_execution.py`, and finally the two notification-boundary checks in `superset/commands/report/execute.py`. The most important review question is whether any scheduled rendered delivery path can construct or send an attachment without passing these gates. ## SUMMARY Enforces a fail-closed invariant for scheduled rendered reports: terminally rejected capture output cannot be delivered as PDF or PNG through report or attached-alert paths. ## BEFORE/AFTER Before: a perceptually blank final combined tiled image could be logged and returned for delivery. A swallowed capture rejection had no durable state checked at notification time. Magnified thumbnail logs could also be mistaken for report delivery events. After: terminal rejection is sticky for the execution; blank combined report output raises; notification dispatch refuses rejected or context-free rendered artifacts; thumbnail retained-tile events are clearly separated. ## TESTING INSTRUCTIONS Run: ```bash pytest -q tests/unit_tests/utils/test_report_execution.py tests/unit_tests/utils/test_screenshot_utils.py tests/unit_tests/utils/webdriver_test.py tests/unit_tests/commands/report/execute_test.py uvx pre-commit run --files UPDATING.md docs/admin_docs/configuration/alerts-reports.mdx superset/commands/report/execute.py superset/utils/report_execution.py superset/utils/screenshot_utils.py superset/utils/webdriver.py tests/unit_tests/commands/report/execute_test.py tests/unit_tests/utils/test_report_execution.py tests/unit_tests/utils/test_screenshot_utils.py tests/unit_tests/utils/webdriver_test.py ``` ## ADDITIONAL INFORMATION - [ ] Relevant busets आयोज YenSED? - [ ] Bug fix: user-facing issue - [ ] New feature - [ ] UI change - [ ] Documentation change - [ ] Database migration - [ ] Dependency update -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
