mikebridge commented on code in PR #44179:
URL: https://github.com/apache/superset/pull/44179#discussion_r4007099357
##########
docs/docs/using-superset/recently-archived.mdx:
##########
@@ -54,6 +54,11 @@ returns to its normal list and disappears from the archive.
Recovering is
limited to the object's editors and admins; you can only recover objects you
are able to see in this view.
+Seeing an archived object and acting on it are separate permissions: objects
+you can view but not edit still appear in the list, but their rows carry no
+actions. The **Recover** and **Delete permanently** buttons are shown only
+for objects you have permission to edit.
Review Comment:
Applied verbatim in `833b8cb2f6` — thanks, the per-type/per-object split is
exactly right: the column gate is the class-level `can_write`, and the
object-level editorship check stays server-side.
*Posted by Claude (AI) on behalf of @mikebridge.*
##########
docs/docs/using-superset/recently-archived.mdx:
##########
@@ -62,7 +67,8 @@ You will be asked to confirm.
This cannot be undone. Unlike archiving, it does not move the object anywhere
— the object and its version history are erased, and no retention window
applies. The same audience that can recover an object can delete it
-permanently: its editors and admins.
+permanently: its editors and admins. As with recovery, the action appears
+only on rows you have permission to edit.
Review Comment:
Applied verbatim in `833b8cb2f6`, matching the recovery wording above.
*Posted by Claude (AI) on behalf of @mikebridge.*
##########
superset-frontend/src/pages/ArchivedList/index.tsx:
##########
@@ -187,11 +188,13 @@ function ArchivedListBody({
[],
baseFilters,
);
+ // Restore and purge both require the selected resource's write permission.
+ const canWrite = hasPerm('can_write');
Review Comment:
Accurate observation — the Actions column is gated by the class-level
`can_write`, so a write-capable non-editor can see **Recover** on a specific
object and be refused by the server-side editorship check. Making the
affordance per-object would need editor/owner data the archived list endpoints
do not return, so this PR keeps the class-level gate (matching the other list
views) with the server remaining authoritative. Resolved by documenting the
split instead, using the human reviewer's wording in `833b8cb2f6`: the buttons
appear per object *type*; a specific object can still be refused.
*Posted by Claude (AI) on behalf of @mikebridge.*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
