sadpandajoe commented on code in PR #45522:
URL: https://github.com/apache/superset/pull/45522#discussion_r4338927187
##########
superset-extensions-cli/src/superset_extensions_cli/templates/frontend/webpack.config.js.j2:
##########
@@ -61,6 +61,15 @@ module.exports = (env, argv) => {
singleton: true,
import: false,
},
+ // Declared here as well as by the host, because Module Federation
+ // only consumes the share scope for modules the remote itself
+ // declares as shared. Without this the extension bundles its own
+ // copy, whose SupersetClient is never configured -- so every call
+ // through it goes out without a CSRF token.
+ "@superset-ui/core": {
+ singleton: true,
+ import: false,
+ },
Review Comment:
Agreed—the template shares `@superset-ui/core` at runtime, but the generated
`package.json` never declares it, so a scaffolded extension that follows the
docs and imports `SupersetClient` can't resolve it at build time. Should the
template add it as a dev/peer dependency alongside the share?
##########
superset/config.py:
##########
@@ -2403,6 +2403,21 @@ def allowed_schemas_for_csv_upload( # pylint:
disable=unused-argument
# configuration. These blueprints will get integrated in the app
BLUEPRINTS: list[Blueprint] = []
+# Whether Superset keeps the permissions that extension pages declare in step
+# with the metadata database as extensions load.
+#
+# On by default, because an extension is installed long after a deployment is
+# initialised and an administrator cannot grant a permission that does not
+# exist. In the steady state this reads a few rows per worker at start and
+# writes nothing; it writes only the first time a page's permission is seen,
+# or when no role holds one.
+#
+# Turn it off where the metadata database must not be written during start --
+# a read-only replica, or a deployment that provisions roles and permissions
+# out of band. Pages still load and are still enforced; the permissions have
+# to exist already, which `superset init` will create.
Review Comment:
With `EXTENSIONS_SYNC_PAGE_PERMISSIONS = False`, `superset init` won't
create the declared permission: init only syncs permissions for FAB-registered
views and the built-in sets, and these pages are plain Flask rules. An operator
following this comment ends up with a permission that doesn't exist, so the
page answers 403 for everyone, Admin included. Is there a provisioning path for
this setting, or should the comment describe one that exists?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
