alexandrusoare commented on code in PR #45451:
URL: https://github.com/apache/superset/pull/45451#discussion_r4324056115
##########
superset/reports/filters.py:
##########
@@ -88,3 +93,35 @@ def apply(self, query: Query, value: Any) -> Query:
ReportSchedule.sql.ilike(ilike_value, escape="\\"),
)
)
+
+
+class ReportTargetChartFilter(ChartFilter): # pylint:
disable=too-few-public-methods
+ """Charts selectable as the target of a scheduled report.
+
+ A scheduled report is not rendered by the user who creates it: it runs
later,
+ as whichever principal the deployment configures as its executor. So a
+ deployment can hold assets a user may read themselves but may not schedule
a
+ report on, and that is a narrower question than ordinary chart visibility.
+
+ Only the exclusion key differs; every other rule is inherited. The
exclusion
+ is applied before delegating so it survives the parent's short-circuits.
+ """
+
+ def apply(self, query: Query, value: Any) -> Query:
+ query = apply_extra_access_exclusions(query, "report_target_charts",
Slice.id)
Review Comment:
Correct, and the important one — thanks. The filter only shaped the picker;
_check_object_access resolves the target through find_by_id, which applies the
plain key, so a direct POST still went through. Now it asks the same question
where the id is actually resolved, and surfaces the deployment's reason on the
403. Added a test asserting the single-id check agrees with the filter.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
