mikebridge commented on PR #45550: URL: https://github.com/apache/superset/pull/45550#issuecomment-6349505433
@fitzee Thanks for the careful pass, and for the mutation checks. Most of this no longer applies, because the per-request gating was dropped after the #44426 discussion in Antonio's thread: the extensions APIs are registered at startup only when the flag is on, as on master, so there is no guard to extend to the runtime-schema, views and semantic-view paths, and no `extensions.`-type filtering on `/types`. - The three un-gated paths you listed are a fair catch against the previous revision, and they are the kind of thing per-request gating would have to cover if it comes back. - Extension-contributed APIs inheriting FAB's `csrf_exempt = True` through `superset_core.rest_api.api.RestApi` is a good find and predates this PR. It's a behaviour change for extension authors, so I'd rather do it as its own PR with its own `UPDATING.md` line than fold it in here. - The duplicated guard mixin and the N+1 flag lookups are gone with the gating. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
