aminghadersohi commented on PR #45816: URL: https://github.com/apache/superset/pull/45816#issuecomment-6480497592
@gabotorresruiz I missed the Explore permalink routes in my earlier sibling search: https://github.com/apache/superset/pull/45816#issuecomment-6480162270 79ac06a2d0d1377df6b423f02de8321bcd1b51a4 fixes POST /api/v1/explore/permalink and GET /api/v1/explore/permalink/<key> by mapping SupersetSecurityException to the same 403 outcome as denied datasets. Authorization policy is unchanged. Regression test: test_permalink_refuses_guest_query_like_denied_dataset. With the API file restored to c0eb8d8cc35f5b04948dbaf46b1ff5833ced3c6b, both guest-query cases fail: 500 "Fatal error" instead of 403; the two denied-dataset controls pass. After the change all four cases pass, with no permalink write or state returned on denial. test_permalink_gamma_with_table_access_still_reads_query_state passes before and after: a Gamma user with an explicit datasource_access grant on the query's table retains POST 201 and GET 200. Denied query exceptions, including non-guest denials, are normalized to 403 rather than changing authorization. I widened the search across all of superset/, including imports of both check_access helpers, rg "check_access\(", their check_chart_access/explore_check_access aliases, and ChartAccessDeniedError/DatasetAccessDeniedError handlers and their callees. Validation: 718 unit tests and 43 permalink/form-data integration tests passed; staged-file and branch-changed-file pre-commit checks passed, including mypy. Siblings checked: - superset/explore/permalink/api.py:106 — fixed in 79ac06a2d0d1377df6b423f02de8321bcd1b51a4: POST maps query authorization failures to 403. - superset/explore/permalink/api.py:167 — fixed in 79ac06a2d0d1377df6b423f02de8321bcd1b51a4: GET maps query authorization failures to 403. - superset/commands/explore/permalink/create.py:64 — not affected: propagates the denial before KeyValueDAO.create_entry; the POST transport mapping is covered by the new test. - superset/commands/explore/permalink/get.py:60 — not affected: propagates the denial before returning cached state; the GET transport mapping is covered by the new test. - superset/explore/utils.py:117 — not affected: shared authorization deliberately propagates to transport-specific handlers; query policy is unchanged. - superset/commands/explore/form_data/utils.py:42 — not affected: already maps SupersetSecurityException to TemporaryCacheAccessDeniedError. - superset/commands/explore/form_data/create.py:52 — not affected: uses that shared form-data mapper. - superset/commands/explore/form_data/update.py:56 — not affected: uses that shared form-data mapper. - superset/commands/explore/form_data/get.py:49 — not affected: uses that shared form-data mapper. - superset/commands/explore/form_data/delete.py:53 — not affected: uses that shared form-data mapper. - superset/explore/form_data/api.py:111 — not affected: POST translates TemporaryCacheAccessDeniedError to 403. - superset/explore/form_data/api.py:186 — not affected: PUT translates TemporaryCacheAccessDeniedError to 403. - superset/explore/form_data/api.py:239 — not affected: GET translates TemporaryCacheAccessDeniedError to 403. - superset/explore/form_data/api.py:298 — not affected: DELETE translates TemporaryCacheAccessDeniedError to 403. - superset/commands/explore/get.py:123 — not affected: permalink command propagates to the Explore API handler. - superset/explore/api.py:127 — not affected: already catches SupersetSecurityException before its separate explore.exceptions.DatasetAccessDeniedError handler at line 132. - superset/views/core.py:194 — not affected: legacy permalink command has no FAB @safe wrapper; the global SupersetErrorException handler in superset/views/error_handling.py:195 preserves its 403 status. - superset/views/explore.py:65 — not affected: permalink HTML route renders the SPA without reading permalink state. - superset/mcp_service/chart/tool/get_chart_info.py:115 — not affected: already maps ForbiddenError and SupersetSecurityException to PermalinkAccessDenied. - superset/charts/api.py:1545 — not affected: AddFavoriteChartCommand translates SupersetSecurityException to ChartAccessDeniedError in superset/commands/chart/fave.py:52. - superset/charts/api.py:1591 — not affected: DelFavoriteChartCommand translates SupersetSecurityException to ChartAccessDeniedError in superset/commands/chart/unfave.py:52. - superset/commands/dataset/duplicate.py:154 — not affected: converts SupersetSecurityException to DatasetAccessDeniedError (also line 217). - superset/commands/dataset/importers/v1/utils.py:736 — not affected: converts SupersetSecurityException to DatasetAccessDeniedError (also line 947). - superset/commands/dataset/warm_up_cache.py:72 — not affected: converts SupersetSecurityException to DatasetAccessDeniedError. - superset/commands/dashboard/filter_state/utils.py:29 — not affected: separate dashboard-only helper, not either Explore check_access. - superset/commands/dashboard/filter_state/create.py:40 — not affected: calls the separate dashboard-only helper. - superset/commands/dashboard/filter_state/get.py:40 — not affected: calls the separate dashboard-only helper. - superset/commands/dashboard/filter_state/update.py:37 — not affected: calls the separate dashboard-only helper. - superset/commands/dashboard/filter_state/delete.py:33 — not affected: calls the separate dashboard-only helper. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
