fitzee opened a new pull request, #45752:
URL: https://github.com/apache/superset/pull/45752
### SUMMARY
Asset permission writes currently accept bare Subject IDs. A client
migrating from user IDs can send `{"editors": [50]}` intending User 50, while
Subject 50 identifies a different user, role, or group. The API cannot infer
the intended namespace from that integer.
Add explicit principal references to chart, dashboard, dataset, and report
editor writes, and chart/dashboard viewer writes:
```json
{"editors": [{"type": "user", "id": 50}, {"type": "group", "id": 7}]}
```
`type` selects `user`, `role`, `group`, or `subject`; `id` belongs to that
namespace. Schemas validate the reference shape, and the existing authorized
command resolves it using the corresponding Subject helper. An unknown
principal fails validation without falling back to a same-numbered Subject.
Existing editorship checks and non-admin self-retention remain in place.
**Compatibility boundary:** bare integers continue to mean Subject IDs. This
provides an unambiguous migration path; it does **not** reject incorrect legacy
requests or make existing clients safe without changing their payloads.
Eliminating that ambiguity altogether requires a separate versioned/breaking
contract decision. GET response shapes remain unchanged. Supplied lists retain
their replacement semantics, including role/group grants.
Includes migration guidance and regenerated OpenAPI schemas. No frontend
change or database migration.
### TESTING INSTRUCTIONS
Automated validation:
```sh
SUPERSET_SECRET_KEY=testing python -m pytest \
tests/unit_tests/subjects \
tests/unit_tests/commands/test_utils.py \
tests/unit_tests/commands/dataset/test_create_subjects.py \
tests/unit_tests/commands/dashboard/update_test.py \
tests/unit_tests/reports/schemas_test.py \
tests/unit_tests/datasets/schema_tests.py -q
```
320 tests passed. Coverage includes mismatched user/Subject IDs, preserved
integer semantics, each explicit namespace, malformed and unknown principals,
non-admin lockout protection, authorization before resolution, all eight asset
create/update schemas, and the generated field's OpenAPI shape. Resolver
behavior is tested at the schema/command boundary with mocked lookups; a live
HTTP/database smoke test has not been run.
Changed-file pre-commit checks and direct pylint checks on the seven changed
application modules pass. Regenerated the API specification with `superset
update-api-docs`.
Manual verification:
1. Choose a user whose user ID differs from their Subject ID, with another
Subject occupying the user's numeric ID.
2. As an authorized editor, PUT `{"editors": [{"type": "user", "id":
<user_id>}]}` to an asset. Confirm the intended user receives edit access and
the colliding Subject does not. Include any existing principals that should
retain access; PUT replaces the list.
3. Send an unknown explicit user ID and confirm validation fails without
assigning another Subject. Repeat as an unauthorized caller and confirm the
existing permission denial.
4. Confirm a bare integer still resolves as a Subject ID, and exercise
`viewers` on a chart/dashboard.
### ADDITIONAL INFORMATION
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration
- [x] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
