aminghadersohi commented on code in PR #45231:
URL: https://github.com/apache/superset/pull/45231#discussion_r4256792506
##########
superset/mcp_service/dataset_scope.py:
##########
@@ -211,6 +234,79 @@ def get_dataset_scope() -> frozenset[UUID] | None:
)
+def _resolve_callable_scope(
+ resolver: Callable[[Any], Iterable[str | UUID] | None],
+) -> frozenset[UUID]:
+ """Call a configured ``MCP_DATASET_ROLE_ALLOWLIST`` resolver for this
request.
+
+ Fails CLOSED -- denies every dataset for this request -- if the resolver
+ raises, returns ``None``, or returns something that cannot be parsed as
+ dataset UUIDs. This is deliberately different from a bare ``None``
+ *config* at the top level, which disables routing constraints entirely:
+ once an operator has configured dynamic routing, a resolution failure for
+ one request (an unresolvable workspace, a transient lookup error) must
+ deny access rather than silently fall back to the unrestricted tool
+ surface for that caller.
+ """
+ user = getattr(g, "user", None)
+ # Log the numeric id rather than the username so a failing tenant can be
+ # traced without writing identity claims to the log.
+ user_id = getattr(user, "id", None)
+ try:
+ result = resolver(user)
+ if result is None:
Review Comment:
Not intended. Fixed in b407e60cb582b27e5ba7258432f7063cd38d4862: a resolver
can return the new `superset.mcp_service.dataset_scope.UNSCOPED` sentinel. That
exempts the caller completely: full tool surface (including `execute_sql`), no
dataset filter, same as a `None` config. The check is by identity, so `None`,
an empty iterable, errors and look-alikes such as `"unscoped"` or `[UNSCOPED]`
still deny every dataset. Only an explicit opt-out can widen access, and
existing resolvers behave as before. Tests cover full-surface restore,
per-caller isolation (one tenant opting out does not unscope another) and the
identity-only check. The docs and `mcp_config.py` describe the three return
values and say to import the sentinel inside the resolver, because importing it
while the config loads is circular.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
