Copilot commented on code in PR #44338:
URL: https://github.com/apache/superset/pull/44338#discussion_r4023788843
##########
superset/mcp_service/chart/tool/get_chart_info.py:
##########
@@ -86,6 +91,106 @@ def _build_unsaved_chart_info(form_data_key: str) ->
ChartInfo | ChartError:
)
+def _get_explore_permalink(
+ permalink_key: str,
+) -> ExplorePermalinkValue | ChartError:
+ """Read an Explore permalink, enforcing the same access checks as Explore.
+
+ ``GetExplorePermalinkCommand`` checks access to the permalink's datasource
+ and, when it references a saved chart, to that chart.
+ """
+ from superset.commands.explore.permalink.get import
GetExplorePermalinkCommand
+
+ try:
+ value = GetExplorePermalinkCommand(permalink_key).run()
+ except ForbiddenError:
+ return ChartError(
+ error="You do not have access to the chart or dataset in this
permalink.",
+ error_type="PermalinkAccessDenied",
+ )
+ except (CommandException, SQLAlchemyError, ValidationError, ValueError) as
ex:
Review Comment:
`GetExplorePermalinkCommand` converts malformed query Jinja templates into
`SupersetTemplateException`
(`superset/commands/explore/permalink/get.py:60-62`), which is neither
`CommandException` nor `marshmallow.ValidationError`. Such a stored permalink
will therefore raise out of `get_chart_info` instead of being returned as a
structured `InvalidPermalink` error; handle this exception in the same mapping.
##########
superset/mcp_service/chart/tool/get_chart_info.py:
##########
@@ -86,6 +91,106 @@ def _build_unsaved_chart_info(form_data_key: str) ->
ChartInfo | ChartError:
)
+def _get_explore_permalink(
+ permalink_key: str,
+) -> ExplorePermalinkValue | ChartError:
+ """Read an Explore permalink, enforcing the same access checks as Explore.
+
+ ``GetExplorePermalinkCommand`` checks access to the permalink's datasource
+ and, when it references a saved chart, to that chart.
+ """
+ from superset.commands.explore.permalink.get import
GetExplorePermalinkCommand
+
+ try:
+ value = GetExplorePermalinkCommand(permalink_key).run()
+ except ForbiddenError:
+ return ChartError(
+ error="You do not have access to the chart or dataset in this
permalink.",
+ error_type="PermalinkAccessDenied",
+ )
+ except (CommandException, SQLAlchemyError, ValidationError, ValueError) as
ex:
Review Comment:
Query datasources use `check_query_access`, which raises
`SupersetSecurityException` when the caller lacks access
(`superset/explore/utils.py:92-109`); that exception is not a
`CommandException` and is not caught here. A query permalink therefore escapes
the tool instead of returning the documented `PermalinkAccessDenied` error. Add
a dedicated `SupersetSecurityException` branch before the generic
invalid-permalink handler.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
