EnxDev commented on code in PR #45342:
URL: https://github.com/apache/superset/pull/45342#discussion_r4287438913
##########
superset/commands/dataset/update.py:
##########
@@ -283,6 +283,7 @@ def _validate_sql_access(
sql=sql,
catalog=catalog,
schema=schema,
+ allow_dataset_editorship=False,
Review Comment:
Good catch, confirmed. `query_datasources_by_name` doesn't care whether the
match is virtual, so on conversion the decoy being edited is the dataset that
satisfies `is_editor`.
Fixed in 6d7256e06c. `allow_dataset_editorship=False` is now passed on every
check that binds a dataset to a table or SQL the caller supplies:
- `UpdateDatasetCommand._validate_table_access` (virtual to physical,
table/schema/catalog repoint) and `_apply_database_repoint`
- `CreateDatasetCommand` physical branch. The uniqueness check already
blocks creating a physical twin of the decoy, but there's no legitimate case
where editorship of another dataset should authorize a new binding, so it gets
the same flag.
- legacy `/datasource/save/` (`_authorize_repoint`, both the table and the
SQL check)
- dataset import, on the SQL check. The `datasource=dataset` check there is
fine as it is, since the importer appends the caller as editor only after that
check runs.
I left `/table_metadata/` and `/table_metadata/extra/` on the default on
purpose. Those are the #20382 "explore your own dataset" metadata paths and
don't return rows.
Tests: added a unit test for the virtual to physical conversion of a decoy
and one for physical create, and the database repoint, legacy save and importer
tests now assert the flag. All of them fail without the change.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
