sha174n opened a new pull request, #44494: URL: https://github.com/apache/superset/pull/44494
### SUMMARY The chart update command treats a query-context-only update (a payload of just `query_context` + `query_context_generation`) differently from every other update: it validated the caller with a read/access check rather than the editorship check used on the normal update path. As a result a user who could merely read a chart could rewrite its stored `query_context`. This change makes the query-context-only branch require edit rights too, so it is consistent with the normal update path. Only owners, editors, and admins can rewrite a chart's stored query context. The stored query context is the refreshed execution payload that Explore recomputes and saves in the background when a chart is opened. Scheduled reports render the chart under an editor identity (the report executor is an editor of the chart, per the default `ALERT_REPORTS_EXECUTORS = [ExecutorType.EDITOR]`), so that background save keeps succeeding. A viewer without edit rights simply has the background save refused, which Explore ignores. The existing datasource-binding validation on this path is unchanged. ### TESTING INSTRUCTIONS Unit tests in `tests/unit_tests/commands/chart/update_test.py`: - a non-editor (dataset read only) is rejected on a query-context-only update, - an editor still succeeds, - the report-executor (editor) render path still saves query context, - regular updates and datasource-binding checks are unchanged. `pytest tests/unit_tests/commands/chart/ tests/unit_tests/tasks/` passes (602 tests); pre-commit passes. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime consideration reviewed with [profiling results](https://superset.apache.org/docs/contributing/testing-locally#profiling) 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
