aminghadersohi commented on PR #45816: URL: https://github.com/apache/superset/pull/45816#issuecomment-6480162270
@gabotorresruiz I folded the form-data exception mapping into c0eb8d8cc35f5b04948dbaf46b1ff5833ced3c6b: `SupersetSecurityException` becomes the same forbidden outcome as dataset/chart denials. Regression tests: `test_form_data_refuses_guest_query_like_denied_dataset` and `test_check_access_maps_exceptions`. With the mapper restored to `9fe7a0ca`, the guest query POST returns 500 instead of the expected 403 and the mapper test fails; both pass with this commit. The denied-dataset control returns 403 throughout. `test_form_data_gamma_with_table_access_still_creates_query_state` confirms a Gamma user with access to the query's tables retains 201 before and after (no authorization change). The mapping also normalizes denied query exceptions for non-guests to 403. All four form-data commands use this shared mapper; I found no other two-exception mapping under `superset/commands` (AST search for exception handlers containing both `ChartAccessDeniedError` and `DatasetAccessDeniedError`). Validation: 686 unit tests and 35 Explore form-data integration tests passed; changed-file pre-commit and mypy passed. Siblings checked: - superset/commands/explore/form_data/utils.py:45 — fixed in c0eb8d8cc35f5b04948dbaf46b1ff5833ced3c6b - superset/commands/explore/form_data/create.py:52 — fixed in c0eb8d8cc35f5b04948dbaf46b1ff5833ced3c6b - superset/commands/explore/form_data/update.py:56 — fixed in c0eb8d8cc35f5b04948dbaf46b1ff5833ced3c6b - superset/commands/explore/form_data/get.py:49 — fixed in c0eb8d8cc35f5b04948dbaf46b1ff5833ced3c6b - superset/commands/explore/form_data/delete.py:53 — fixed in c0eb8d8cc35f5b04948dbaf46b1ff5833ced3c6b - superset/commands/dashboard/filter_state/utils.py:29 — not affected: checks only dashboards and maps DashboardAccessDeniedError, never query authorization. - superset/explore/utils.py:117 — not affected: this shared access checker deliberately propagates authorization exceptions to its transport-specific callers. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
