mikebridge opened a new pull request, #45959: URL: https://github.com/apache/superset/pull/45959
### SUMMARY **TL;DR:** When `SEMANTIC_LAYERS` was off, the semantic-layer APIs returned 404 before checking login or permissions, so callers without access could tell whether the feature was enabled. Check permissions first: callers without access get the usual 401/403 in both states, and permitted callers still get 404 while the feature is off. This follows [#45061](https://github.com/apache/superset/pull/45061), which is not yet in a release. Replace the blueprint `before_request` availability check introduced by #45061 with one decorator immediately beneath each endpoint's existing `protect()` or `protect_read()` decorator. All sixteen exposed handlers are defined in these APIs; the SemanticView inclusion list excludes inherited ModelRestApi routes. API registration, startup configuration, and resource permissions remain unchanged. Remove ten redundant inline checks so each handler relies on the shared guard and evaluates availability once before entering its body. The feature decision still comes from the feature flag manager on each permitted request. Public-role grants continue to work through FAB: anonymous callers with `can_read` on SemanticView can request a view's structure, subject to its datasource permissions. Flask's automatic OPTIONS responses return the same 200 and Allow header in either feature state, without entering a semantic handler. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF No UI changes. Before: an anonymous caller without a Public grant received 401 when enabled and 404 when disabled; a signed-in caller without permission received 403 versus 404. After: those callers receive 401 or 403 respectively in both states. Permitted requests retain 200 when enabled and 404 when disabled, and resource-level refusals remain in place. ### TESTING INSTRUCTIONS Run: ```sh python -m pytest -q tests/unit_tests/semantic_layers/api_guard_order_test.py tests/unit_tests/semantic_layers/test_runtime_flag.py tests/unit_tests/semantic_layers/api_test.py tests/unit_tests/semantic_layers/connections_access_test.py tests/unit_tests/semantic_layers/test_access.py tests/unit_tests/semantic_layers/simple_cache_clear_test.py ``` The tests use registered Flask routes and real FAB permission checks, with in-memory principals and isolated metadata/provider lookups. They cover every exposed route, implicit HEAD, automatic OPTIONS, anonymous/Public-role/signed-in/guest callers, runtime toggle changes through the host callback, object-level refusals, and mixed bulk deletion. Removing the shared guard from each of the sixteen handlers, one at a time, makes the registered-route matrix fail. The tests do not exercise external identity providers or live semantic providers. ### ADDITIONAL INFORMATION - [x] Has associated issue: follow-up to [#45061](https://github.com/apache/superset/pull/45061) - [x] Required feature flags: `SEMANTIC_LAYERS` - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in SIP-59) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
