sha174n opened a new pull request, #45936: URL: https://github.com/apache/superset/pull/45936
### SUMMARY Adds a write and DDL target access check, `SupersetSecurityManager.raise_for_write_target_access`, that the query execution paths call alongside the existing per-table check: SQL Lab execution, MCP `execute_sql`, the alert query run, and alert create/update query validation. The existing per-table check builds its table set from a statement's read sources (the `FROM` / `JOIN` references). The target a statement writes to, alters or drops is modelled elsewhere in the AST and is not part of that set. The new check covers that target when it is a registered physical dataset outside all of the user's grants (no `datasource_access` on it, no `schema_access` on its schema, no `catalog_access` on its catalog) and not owned by them. Behaviour is unchanged for: - unregistered tables, temporary and session objects, and tables created earlier in the same script - new-object creation (`CREATE TABLE`, CTAS, rename to a new name) and structure-copy sources - tables covered by schema or catalog access, dataset owners, and users with database access - deployments that override `raise_for_access` or configure `EXTRA_RAISE_FOR_ACCESS_BYPASS` `raise_for_access` (signature and body) and result/export re-validation are unchanged. ### TESTING INSTRUCTIONS - `tests/unit_tests/sql/parse_tests.py`: write/DDL target extraction across dialects (multi-table `UPDATE`/`DELETE`, T-SQL target aliases, `MERGE`, `INSERT ALL`, `COPY INTO`, `SWAP WITH`, `CREATE INDEX ... ON`, CTE-nested DML, temporary objects, script-created tables). - `tests/unit_tests/security/manager_test.py`: allow/deny matrix for the new check, including a corpus of statements that must keep working unchanged, custom security manager subclasses, the access hook, and result re-validation of an executed script. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration - [ ] Introduces new feature or API - [ ] Removes existing feature or API 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
