alexandrusoare commented on code in PR #45090:
URL: https://github.com/apache/superset/pull/45090#discussion_r4283899096
##########
tests/unit_tests/canvas/api_test.py:
##########
@@ -154,6 +192,42 @@ def test_get_definition(client: Any, full_api_access:
None, canvas: Any) -> None
assert response.json["result"]["placements"] == {}
assert response.json["result"]["widgetTypes"] == {}
assert response.json["result"]["gridColumns"] == {}
+ assert response.json["result"]["layoutConstraints"] == {}
+ assert response.json["result"]["canEdit"] is True
+
+
+def test_definition_reports_a_view_only_user_cannot_edit(
+ client: Any, full_api_access: None, canvas: Any, mocker: MockerFixture
+) -> None:
+ """
+ ``canEdit`` answers the same question the write path enforces, so a user
+ who may only read is told not to offer drag and resize.
+ """
+ mocker.patch(
+ "superset.canvas.api.security_manager.raise_for_editorship",
+ side_effect=SupersetSecurityException(MagicMock()),
+ )
+
+ response = client.get(URL)
+
+ assert response.status_code == 200
+ assert response.json["result"]["canEdit"] is False
+
+
+def test_definition_reports_no_edit_without_route_write_permission(
+ client: Any, full_api_access: None, canvas: Any, mocker: MockerFixture
+) -> None:
+ """
+ The write route needs ``can_write`` on Canvas as well as editorship, so an
+ object editor whose role lacks the route permission is told not to offer
+ editing -- otherwise its saves would 403.
+ """
+ mocker.patch("superset.canvas.api.security_manager.can_access",
return_value=False)
Review Comment:
Fixed in both files: each case now allows exactly one permission instead of
returning a blanket value. Verified by swapping production to can_read — both
tests fail, where before they passed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
