Skip to content

fix(dashboard): gate bundle chart reassignment on per-object write permission - #46142

Open
sha174n wants to merge 1 commit into
apache:masterfrom
sha174n:harden/import-dashboard-slices-writecheck
Open

sha174n wants to merge 1 commit into
apache:masterfrom
sha174n:harden/import-dashboard-slices-writecheck

Conversation

@sha174n

@sha174n sha174n commented Nov 10, 2026

Copy link
Copy Markdown
Contributor

Summary

Make ImportAssetsCommand's dashboard chart-association handling consistent with import_dashboard. import_dashboard applies a per-object write check and returns an existing dashboard unchanged when the caller is not permitted to write it; the bulk-assets path reassigns dashboard.slices from the bundle position and should honor the same check.

This adds a module helper _can_write_dashboard that mirrors import_dashboard's permission model (the can_write grant on Dashboard, plus editor/admin on an already-persisted dashboard, with the request-less background / example-loader path allowed), and guards the slice reassignment with it.

Scope / notes

  • Newly created dashboards are unaffected: import_dashboard registers the caller as their editor before this block runs, so the check passes and slices are assigned as before.
  • Dashboards the caller may edit are unchanged.
  • The migrate_dashboard() and tag-import blocks are separate concerns and remain as-is.

Testing

Added test_import_without_write_permission_keeps_existing_dashboard_charts. Full assets_test.py unit suite passes locally.

@codeant-ai-for-open-source

codeant-ai-for-open-source Bot commented Nov 10, 2026 •

Copy link
Copy Markdown
Contributor

CodeAnt  CodeAnt PR Risk

🟡  Medium Risk

  • The PR needs attention before merging.
  • With overwrite=False, an authorized editor can still pass _can_write_dashboard and replace the existing dashboard’s chart associations.

Assessed commit: 4a3e3575cc0c

@codecov

codecov Bot commented Nov 10, 2026 •

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 56.25000% with 7 lines in your changes missing coverage. Please review.
✅ Project coverage is 65.35%. Comparing base (a131fcb) to head (51708ee).
⚠️ Report is 5 commits behind head on master.

Files with missing lines Patch % Lines
superset/commands/importers/v1/assets.py 56.25% 3 Missing and 4 partials ⚠️
Additional details and impacted files
@@           Coverage Diff           @@
##           master   #46142   +/-   ##
=======================================
  Coverage   65.35%   65.35%           
=======================================
  Files        3083     3083           
  Lines      211224   211286   +62     
  Branches    49803    49814   +11     
=======================================
+ Hits       138054   138095   +41     
- Misses      69992    70006   +14     
- Partials     3178     3185    +7     
Flag Coverage Δ
hive 34.05% <18.75%> (-0.01%) ⬇️
mysql 51.82% <56.25%> (+<0.01%) ⬆️
postgres 51.84% <56.25%> (+<0.01%) ⬆️
presto 35.70% <18.75%> (+<0.01%) ⬆️
python 52.14% <56.25%> (+<0.01%) ⬆️
sqlite 51.53% <56.25%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@sadpandajoe
sadpandajoe requested a review from rusackas November 10, 2026 18:18
…rmission

Align ImportAssetsCommand with import_dashboard: only reassign an existing
dashboard's chart associations from the bundle position when the caller may
write that dashboard (can_write grant plus editor/admin, or a request-less
background path). Newly created dashboards are unaffected because the caller
is registered as their editor, and dashboards the caller may edit behave as
before.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@sha174n
sha174n force-pushed the harden/import-dashboard-slices-writecheck branch from 51708ee to 4a3e357 Compare November 11, 2026 11:49

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant