You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "mikebridge (via GitHub)" <gi...@apache.org> on 2026/09/09 17:12:26 UTC

[PR] fix(mcp): refuse certification changes on externally managed dashboards [superset]

mikebridge opened a new pull request, #44094:
URL: https://github.com/apache/superset/pull/44094

   ### SUMMARY
   
   The sc-120051 write-surface inventory (which walked every path that mutates chart/dashboard/dataset content outside the gated `UpdateCommand`s) found exactly one live command-layer bypass: the `manage_dashboard_certification` MCP tool writes `certified_by` / `certification_details` — exported governance fields — by direct model-attribute assignment + `db.session.commit()`. It therefore never inherits the server-side `is_managed_externally` gate the ordinary update paths carry, so an MCP caller could badge or un-badge an **externally managed** dashboard, for the next external sync to overwrite (or worse, leave the badge drifting from the certifying system of record).
   
   **Fix**: after the tool's editorship check (mirroring the command-layer ordering — a caller with no edit rights keeps getting the plain editorship denial), an externally managed dashboard is refused through the tool's structured `permission_denied` response, naming the reason. The write path is otherwise unchanged.
   
   Sibling context: the ordinary update/refresh/restore surfaces are gated in #44025/#44013; other MCP writers (`update_chart`, `update_dashboard`, `update_dataset_metric`) route through the gated commands and inherit the refusal; the DeleteCommands' exemption is an explicitly ratified policy (soft delete changes visibility, not content) documented separately.
   
   ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
   
   N/A — MCP tool behavior. Before: badge applied + committed on a managed dashboard. After: structured `permission_denied` response, nothing assigned, nothing committed.
   
   ### TESTING INSTRUCTIONS
   
   `pytest tests/unit_tests/mcp_service/dashboard/tool/test_manage_dashboard_certification.py` — 16 tests. The new `test_refuses_externally_managed_dashboard` pins the refusal (permission_denied + reason), that no attribute is assigned, and that `commit` is never called; reverting the production change flips exactly that test (stash-verified). The fixture change declares `is_managed_externally=False` explicitly — a bare `Mock` attribute is truthy and would otherwise trip the gate across the suite (real dashboards default the flag to `False`).
   
   Manual: flip `is_managed_externally` on a dashboard, call the `manage_dashboard_certification` MCP tool → `permission_denied: true` with the externally-managed reason; flip it back → badge applies.
   
   ### ADDITIONAL INFORMATION
   - [ ] Has associated issue:
   - [ ] Required feature flags:
   - [ ] Changes UI
   - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351))
     - [ ] Migration is atomic, supports rollback & is backwards-compatible
     - [ ] Confirm DB migration upgrade and downgrade tested
     - [ ] Runtime estimates and downtime expectations provided
   - [ ] Introduces new feature or API
   - [ ] Removes existing feature or API
   
   🤖 Generated with [Claude Code](https://claude.com/claude-code)
   
   https://claude.ai/code/session_01JRLEJS4mUqKBoPjSjviKUW
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix(mcp): refuse certification changes on externally managed dashboards [superset]

Posted by "mikebridge (via GitHub)" <gi...@apache.org>.
mikebridge commented on code in PR #44094:
URL: https://github.com/apache/superset/pull/44094#discussion_r4007324458


##########
superset/mcp_service/dashboard/tool/manage_dashboard_certification.py:
##########
@@ -92,6 +92,25 @@ def manage_dashboard_certification(
             warnings=["No fields provided; dashboard unchanged."],
         )
 
+    # Externally managed dashboards refuse certification CHANGES (the
+    # no-field inspect path above still returns current values): their
+    # source of truth lives outside Superset, so a badge set here would be
+    # overwritten (or drift from the certifying system) on the next
+    # external sync. This tool writes by direct attribute assignment +
+    # commit rather than through a command, so no command-layer check can
+    # protect it — the refusal must live in the tool itself, after the
+    # editorship check, where a caller with no edit rights keeps getting
+    # the plain editorship denial.
+    if dashboard.is_managed_externally:

Review Comment:
   T2/T3 fixed in 905e68a823 (distinct `managed_externally` flag on the shared base with do-not-retry guidance; `permission_denied` narrowed back to ACL-only; tool docstring now advertises the refusal). On THIS thread — the sibling coverage (owners/roles/update_dashboard) — agreed the write path is identical and unguarded; that's a governance-policy decision already queued with the campaign owner, so I'm leaving this thread open until it's ratified rather than silently extending the gate's scope in a review round. The shared-base flag added here is deliberately sibling-ready for that hoist.



##########
superset/mcp_service/dashboard/tool/manage_dashboard_certification.py:
##########
@@ -92,6 +92,25 @@ def manage_dashboard_certification(
             warnings=["No fields provided; dashboard unchanged."],
         )
 
+    # Externally managed dashboards refuse certification CHANGES (the
+    # no-field inspect path above still returns current values): their
+    # source of truth lives outside Superset, so a badge set here would be
+    # overwritten (or drift from the certifying system) on the next
+    # external sync. This tool writes by direct attribute assignment +
+    # commit rather than through a command, so no command-layer check can
+    # protect it — the refusal must live in the tool itself, after the
+    # editorship check, where a caller with no edit rights keeps getting
+    # the plain editorship denial.
+    if dashboard.is_managed_externally:
+        return ManageDashboardCertificationResponse(
+            permission_denied=True,

Review Comment:
   Fixed in 905e68a823 — distinct `managed_externally: true` on the shared `DashboardMutationErrorFields` base (so a future sibling hoist inherits it), with the description carrying the do-not-retry guidance; `permission_denied` is no longer set for the structural refusal and its description narrows back to ACL-only. Both directions pinned in the tool tests.



##########
superset/mcp_service/dashboard/tool/manage_dashboard_certification.py:
##########
@@ -92,6 +92,25 @@ def manage_dashboard_certification(
             warnings=["No fields provided; dashboard unchanged."],
         )
 
+    # Externally managed dashboards refuse certification CHANGES (the
+    # no-field inspect path above still returns current values): their
+    # source of truth lives outside Superset, so a badge set here would be
+    # overwritten (or drift from the certifying system) on the next
+    # external sync. This tool writes by direct attribute assignment +
+    # commit rather than through a command, so no command-layer check can
+    # protect it — the refusal must live in the tool itself, after the
+    # editorship check, where a caller with no edit rights keeps getting
+    # the plain editorship denial.
+    if dashboard.is_managed_externally:
+        return ManageDashboardCertificationResponse(
+            permission_denied=True,
+            error=(
+                f"Dashboard '{dashboard.dashboard_title}' (ID: {dashboard.id}) "
+                "is managed externally; its certification is owned by the "

Review Comment:
   Fixed in 905e68a823 — the tool docstring now states the refusal (structural, `managed_externally=True`, no retry) and that the no-field inspect call still works on managed dashboards.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix(mcp): refuse certification changes on externally managed dashboards [superset]

Posted by "mikebridge (via GitHub)" <gi...@apache.org>.
mikebridge commented on code in PR #44094:
URL: https://github.com/apache/superset/pull/44094#discussion_r4007507110


##########
superset/mcp_service/dashboard/tool/manage_dashboard_certification.py:
##########
@@ -92,6 +92,25 @@ def manage_dashboard_certification(
             warnings=["No fields provided; dashboard unchanged."],
         )
 
+    # Externally managed dashboards refuse certification CHANGES (the
+    # no-field inspect path above still returns current values): their
+    # source of truth lives outside Superset, so a badge set here would be
+    # overwritten (or drift from the certifying system) on the next
+    # external sync. This tool writes by direct attribute assignment +
+    # commit rather than through a command, so no command-layer check can
+    # protect it — the refusal must live in the tool itself, after the
+    # editorship check, where a caller with no edit rights keeps getting
+    # the plain editorship denial.
+    if dashboard.is_managed_externally:

Review Comment:
   Ratified as a follow-up: agreed the owners/roles/update_dashboard tools share the exact command-bypassing write path, and the shared-base `managed_externally` field + refusal shape from this PR were built so the hoist is mechanical. Tracked as sc-120483, which also carries the one open policy question (whether owners/roles governance is Superset-local like `published` or external-content like title/metadata) for Elizabeth; kept out of this PR to avoid widening it mid-review. Leaving this thread open for you to resolve.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix(mcp): refuse certification changes on externally managed dashboards [superset]

Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #44094:
URL: https://github.com/apache/superset/pull/44094#issuecomment-5669671314

   AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
   
   <details>
   <summary>
   Bito Usage Guide
   </summary>
   
   **Commands**
         
   Type the following command in the pull request comment and save the comment.
         
   - `/review` - Manually triggers an incremental AI Review.
   - `/review full` - Manually triggers a full AI Review.
   
   - `/pause` - Pauses automatic reviews on this pull request.
   - `/resume` - Resumes automatic reviews.
   - `/resolve` - Marks all Bito-posted review comments as resolved.
   - `/abort` - Cancels all in-progress reviews.
   
         
   Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
         
   **Configuration**
   
   This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
         
   **Documentation & Help**
   - <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
   - <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
   - <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
   - <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
   
   </details>
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix(mcp): refuse certification changes on externally managed dashboards [superset]

Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #44094:
URL: https://github.com/apache/superset/pull/44094#issuecomment-5605825962

   AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix(mcp): refuse certification changes on externally managed dashboards [superset]

Posted by "fitzee (via GitHub)" <gi...@apache.org>.
fitzee commented on code in PR #44094:
URL: https://github.com/apache/superset/pull/44094#discussion_r4001404605


##########
superset/mcp_service/dashboard/tool/manage_dashboard_certification.py:
##########
@@ -92,6 +92,25 @@ def manage_dashboard_certification(
             warnings=["No fields provided; dashboard unchanged."],
         )
 
+    # Externally managed dashboards refuse certification CHANGES (the
+    # no-field inspect path above still returns current values): their
+    # source of truth lives outside Superset, so a badge set here would be
+    # overwritten (or drift from the certifying system) on the next
+    # external sync. This tool writes by direct attribute assignment +
+    # commit rather than through a command, so no command-layer check can
+    # protect it — the refusal must live in the tool itself, after the
+    # editorship check, where a caller with no edit rights keeps getting
+    # the plain editorship denial.
+    if dashboard.is_managed_externally:

Review Comment:
   **Fix altitude: this guard is a per-tool special case, but the sibling governance tools share the exact same command-bypassing direct-commit write path and remain unguarded.** I verified none of them check `is_managed_externally` (it appears only here + schemas.py):
   - `manage_dashboard_owners.py:193` — `db.session.commit()` after mutating owners
   - `manage_dashboard_roles.py:287` — `db.session.commit()` after mutating roles
   - `update_dashboard.py:181-206` — direct assignment of `dashboard_title` / `slug` / `json_metadata` / `css`, commit at 360
   
   All three go through the same `find_and_authorize_dashboard` helper (which does editorship but not this check), and the comment here explicitly cites *"writes by direct attribute assignment + commit rather than through a command, so no command-layer check can protect it"* — which is equally true of those tools. So an LLM caller can still add/remove owners, change RBAC roles, or edit title/metadata/CSS on an externally-managed dashboard, and those writes drift/get overwritten on the next external sync — the same harm this PR guards against for certification. Consider hoisting the check into a shared helper (with care to preserve certification's no-field *inspect* path, which should still work on managed dashboards), so all mutating tools inherit it.



##########
superset/mcp_service/dashboard/tool/manage_dashboard_certification.py:
##########
@@ -92,6 +92,25 @@ def manage_dashboard_certification(
             warnings=["No fields provided; dashboard unchanged."],
         )
 
+    # Externally managed dashboards refuse certification CHANGES (the
+    # no-field inspect path above still returns current values): their
+    # source of truth lives outside Superset, so a badge set here would be
+    # overwritten (or drift from the certifying system) on the next
+    # external sync. This tool writes by direct attribute assignment +
+    # commit rather than through a command, so no command-layer check can
+    # protect it — the refusal must live in the tool itself, after the
+    # editorship check, where a caller with no edit rights keeps getting
+    # the plain editorship denial.
+    if dashboard.is_managed_externally:
+        return ManageDashboardCertificationResponse(
+            permission_denied=True,
+            error=(
+                f"Dashboard '{dashboard.dashboard_title}' (ID: {dashboard.id}) "
+                "is managed externally; its certification is owned by the "

Review Comment:
   **Doc nit:** the tool docstring (lines 62-73) still advertises unconditional set/clear and never mentions that externally-managed dashboards are refused — the new behavior is documented only in the response schema. An agent reading the tool description will attempt the mutation and be surprised by the `permission_denied` response. Worth a one-line note in the docstring (and ideally the example) so the tool's own description reflects the refusal.



##########
superset/mcp_service/dashboard/tool/manage_dashboard_certification.py:
##########
@@ -92,6 +92,25 @@ def manage_dashboard_certification(
             warnings=["No fields provided; dashboard unchanged."],
         )
 
+    # Externally managed dashboards refuse certification CHANGES (the
+    # no-field inspect path above still returns current values): their
+    # source of truth lives outside Superset, so a badge set here would be
+    # overwritten (or drift from the certifying system) on the next
+    # external sync. This tool writes by direct attribute assignment +
+    # commit rather than through a command, so no command-layer check can
+    # protect it — the refusal must live in the tool itself, after the
+    # editorship check, where a caller with no edit rights keeps getting
+    # the plain editorship denial.
+    if dashboard.is_managed_externally:
+        return ManageDashboardCertificationResponse(
+            permission_denied=True,

Review Comment:
   **Semantics: overloading `permission_denied` conflates a structural refusal with an ACL denial, and they need opposite remediation.** The same flag is set by `find_and_authorize_dashboard` for real access denials whose canonical guidance is *"Ask the user to grant access; do not retry."* A managed-externally refusal is structural — granting permissions can never resolve it — yet a downstream agent that branches on the boolean (rather than parsing the free-text `error`) will tell the user to request access and, worse, may retry. The schema doc update helps for clients that read it, but the boolean itself can't be disambiguated. Consider a distinct signal (e.g. a `managed_externally: true` field or a machine-readable reason code) so agents can route the two cases differently.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix(mcp): refuse certification changes on externally managed dashboards [superset]

Posted by "netlify[bot] (via GitHub)" <gi...@apache.org>.
netlify[bot] commented on PR #44094:
URL: https://github.com/apache/superset/pull/44094#issuecomment-5639194811

   ### <span aria-hidden="true">✅</span> Deploy Preview for *superset-docs-preview* ready!
   
   
   |  Name | Link |
   |:-:|------------------------|
   |<span aria-hidden="true">🔨</span> Latest commit | 5a73e615b190de3135a1b2613855bb785507e6cd |
   |<span aria-hidden="true">🔍</span> Latest deploy log | https://app.netlify.com/projects/superset-docs-preview/deploys/6aa44c732feef3000803588c |
   |<span aria-hidden="true">😎</span> Deploy Preview | [https://deploy-preview-44094--superset-docs-preview.netlify.app](https://deploy-preview-44094--superset-docs-preview.netlify.app) |
   |<span aria-hidden="true">📱</span> Preview on mobile | <details><summary> Toggle QR Code... </summary><br /><br />![QR Code](https://app.netlify.com/qr-code/eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1cmwiOiJodHRwczovL2RlcGxveS1wcmV2aWV3LTQ0MDk0LS1zdXBlcnNldC1kb2NzLXByZXZpZXcubmV0bGlmeS5hcHAifQ.haIByCnQoek9Go1iJhRjRFZhWMn7BYIzKKAV86_1jL0)<br /><br />_Use your smartphone camera to open QR code link._</details> |
   |<span aria-hidden="true">🤖</span> Make changes | [Run an agent on this branch](https://app.netlify.com/projects/superset-docs-preview/agent-runs#DcvBDYAgDEDRXXqWpAoqcQPHqKUoiQJBLsa4u9z-4f0XcklXrrAAdLAViny0vln1A-LYK5ZSgw9MNaSoLoq0i1M7VWneST7Ts7p2TETG8KwHL-I1IlrUo7UM3w8) |
   ---
   <!-- [superset-docs-preview Preview](https://deploy-preview-44094--superset-docs-preview.netlify.app) -->
   _To edit notification comments on pull requests, go to your [Netlify project configuration](https://app.netlify.com/projects/superset-docs-preview/configuration/notifications#deploy-notifications)._


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix(mcp): refuse certification changes on externally managed dashboards [superset]

Posted by "codeant-ai-for-open-source[bot] (via GitHub)" <gi...@apache.org>.
codeant-ai-for-open-source[bot] commented on code in PR #44094:
URL: https://github.com/apache/superset/pull/44094#discussion_r4008450810


##########
superset/mcp_service/dashboard/tool/manage_dashboard_certification.py:
##########
@@ -92,6 +98,25 @@ def manage_dashboard_certification(
             warnings=["No fields provided; dashboard unchanged."],
         )
 
+    # Externally managed dashboards refuse certification CHANGES (the
+    # no-field inspect path above still returns current values): their
+    # source of truth lives outside Superset, so a badge set here would be
+    # overwritten (or drift from the certifying system) on the next
+    # external sync. This tool writes by direct attribute assignment +
+    # commit rather than through a command, so no command-layer check can
+    # protect it — the refusal must live in the tool itself, after the
+    # editorship check, where a caller with no edit rights keeps getting
+    # the plain editorship denial.
+    if dashboard.is_managed_externally:
+        return ManageDashboardCertificationResponse(

Review Comment:
   ✅ **Customized review instruction saved!**
   
   **Instruction:**
   > For governance tools that directly commit dashboard changes, re-read and lock the externally managed flag within the writing transaction to prevent TOCTOU races; centralize this check in the shared managed-externally guard.
   
   **Applied to:**
     - `superset/mcp_service/dashboard/tool/manage_dashboard_certification.py`
   
   ---
   💡 *To manage or update this instruction, visit: [CodeAnt AI Settings](https://app.codeant.ai/org/settings/learnings)*



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix(mcp): refuse certification changes on externally managed dashboards [superset]

Posted by "richardfogaca (via GitHub)" <gi...@apache.org>.
richardfogaca merged PR #44094:
URL: https://github.com/apache/superset/pull/44094


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix(mcp): refuse certification changes on externally managed dashboards [superset]

Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #44094:
URL: https://github.com/apache/superset/pull/44094#issuecomment-5641011160

   AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
   
   <details>
   <summary>
   Bito Usage Guide
   </summary>
   
   **Commands**
         
   Type the following command in the pull request comment and save the comment.
         
   - `/review` - Manually triggers an incremental AI Review.
   - `/review full` - Manually triggers a full AI Review.
   
   - `/pause` - Pauses automatic reviews on this pull request.
   - `/resume` - Resumes automatic reviews.
   - `/resolve` - Marks all Bito-posted review comments as resolved.
   - `/abort` - Cancels all in-progress reviews.
   
         
   Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
         
   **Configuration**
   
   This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
         
   **Documentation & Help**
   - <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
   - <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
   - <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
   - <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
   
   </details>
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix(mcp): refuse certification changes on externally managed dashboards [superset]

Posted by "mikebridge (via GitHub)" <gi...@apache.org>.
mikebridge commented on code in PR #44094:
URL: https://github.com/apache/superset/pull/44094#discussion_r4008447910


##########
superset/mcp_service/dashboard/tool/manage_dashboard_certification.py:
##########
@@ -92,6 +98,25 @@ def manage_dashboard_certification(
             warnings=["No fields provided; dashboard unchanged."],
         )
 
+    # Externally managed dashboards refuse certification CHANGES (the
+    # no-field inspect path above still returns current values): their
+    # source of truth lives outside Superset, so a badge set here would be
+    # overwritten (or drift from the certifying system) on the next
+    # external sync. This tool writes by direct attribute assignment +
+    # commit rather than through a command, so no command-layer check can
+    # protect it — the refusal must live in the tool itself, after the
+    # editorship check, where a caller with no edit rights keeps getting
+    # the plain editorship denial.
+    if dashboard.is_managed_externally:
+        return ManageDashboardCertificationResponse(

Review Comment:
   Confirmed real in shape, deferred to the tracked hoist rather than this PR: the check reads the already-loaded row and nothing re-verifies the flag inside the transaction that commits (manage_dashboard_certification.py — check at the guard, direct attribute writes + `db.session.commit()` ~40 lines later, no lock/re-read), so a concurrent sync flipping `is_managed_externally` between the two can let one certification write land on a newly-managed dashboard. Same TOCTOU class as the entity-lock work in #44027/#44091, and the right fix is the same shape — re-read/lock the flag in the writing transaction. It belongs in sc-120483 (the shared managed-externally hoist for ALL the governance tools that share this direct-commit path), where one helper can own gate + re-verify for owners/roles/update_dashboard/certification together instead of four hand-rolled copies; noted on that ticket's scope. Consequence bound meanwhile: a lost race produces one drifting write that the next externa
 l sync overwrites — the exposure the gate narrows, not a privilege change.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix(mcp): refuse certification changes on externally managed dashboards [superset]

Posted by "mikebridge (via GitHub)" <gi...@apache.org>.
mikebridge closed pull request #44094: fix(mcp): refuse certification changes on externally managed dashboards
URL: https://github.com/apache/superset/pull/44094


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix(mcp): refuse certification changes on externally managed dashboards [superset]

Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #44094:
URL: https://github.com/apache/superset/pull/44094#issuecomment-5639383001

   ## [Codecov](https://app.codecov.io/gh/apache/superset/pull/44094?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
   :x: Patch coverage is `0%` with `2 lines` in your changes missing coverage. Please review.
   :white_check_mark: Project coverage is 66.13%. Comparing base ([`078915f`](https://app.codecov.io/gh/apache/superset/commit/078915f4ceda837b0371a1b2fe00971146a547f7?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`5a73e61`](https://app.codecov.io/gh/apache/superset/commit/5a73e615b190de3135a1b2613855bb785507e6cd?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
   :warning: Report is 64 commits behind head on master.
   
   | [Files with missing lines](https://app.codecov.io/gh/apache/superset/pull/44094?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Patch % | Lines |
   |---|---|---|
   | [...e/dashboard/tool/manage\_dashboard\_certification.py](https://app.codecov.io/gh/apache/superset/pull/44094?src=pr&el=tree&filepath=superset%2Fmcp_service%2Fdashboard%2Ftool%2Fmanage_dashboard_certification.py&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-c3VwZXJzZXQvbWNwX3NlcnZpY2UvZGFzaGJvYXJkL3Rvb2wvbWFuYWdlX2Rhc2hib2FyZF9jZXJ0aWZpY2F0aW9uLnB5) | 0.00% | [2 Missing :warning: ](https://app.codecov.io/gh/apache/superset/pull/44094?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
   > :exclamation:  There is a different number of reports uploaded between BASE (078915f) and HEAD (5a73e61). Click for more details.
   > 
   > <details><summary>HEAD has 3 uploads less than BASE</summary>
   >
   >| Flag | BASE (078915f) | HEAD (5a73e61) |
   >|------|------|------|
   >|python|6|3|
   ></details>
   
   <details><summary>Additional details and impacted files</summary>
   
   
   
   ```diff
   @@             Coverage Diff             @@
   ##           master   #44094       +/-   ##
   ===========================================
   - Coverage   80.08%   66.13%   -13.95%     
   ===========================================
     Files        2922     2923        +1     
     Lines      171962   172401      +439     
     Branches    39907    39994       +87     
   ===========================================
   - Hits       137717   114019    -23698     
   - Misses      31664    56001    +24337     
   + Partials     2581     2381      -200     
   ```
   
   | [Flag](https://app.codecov.io/gh/apache/superset/pull/44094/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
   |---|---|---|
   | [hive](https://app.codecov.io/gh/apache/superset/pull/44094/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `37.33% <0.00%> (-0.07%)` | :arrow_down: |
   | [mysql](https://app.codecov.io/gh/apache/superset/pull/44094/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
   | [postgres](https://app.codecov.io/gh/apache/superset/pull/44094/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
   | [presto](https://app.codecov.io/gh/apache/superset/pull/44094/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `39.22% <0.00%> (-0.08%)` | :arrow_down: |
   | [python](https://app.codecov.io/gh/apache/superset/pull/44094/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `56.71% <0.00%> (-27.78%)` | :arrow_down: |
   | [sqlite](https://app.codecov.io/gh/apache/superset/pull/44094/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `56.59% <0.00%> (-0.12%)` | :arrow_down: |
   | [unit](https://app.codecov.io/gh/apache/superset/pull/44094/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
   
   Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
   </details>
   
   [:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/apache/superset/pull/44094?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).   
   :loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
   <details><summary> :rocket: New features to boost your workflow: </summary>
   
   - :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
   - :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
   </details>


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org

Re: [PR] fix(mcp): refuse certification changes on externally managed dashboards [superset]

Posted by "codeant-ai-for-open-source[bot] (via GitHub)" <gi...@apache.org>.
codeant-ai-for-open-source[bot] commented on code in PR #44094:
URL: https://github.com/apache/superset/pull/44094#discussion_r4007362707


##########
superset/mcp_service/dashboard/tool/manage_dashboard_certification.py:
##########
@@ -92,6 +98,25 @@ def manage_dashboard_certification(
             warnings=["No fields provided; dashboard unchanged."],
         )
 
+    # Externally managed dashboards refuse certification CHANGES (the
+    # no-field inspect path above still returns current values): their
+    # source of truth lives outside Superset, so a badge set here would be
+    # overwritten (or drift from the certifying system) on the next
+    # external sync. This tool writes by direct attribute assignment +
+    # commit rather than through a command, so no command-layer check can
+    # protect it — the refusal must live in the tool itself, after the
+    # editorship check, where a caller with no edit rights keeps getting
+    # the plain editorship denial.
+    if dashboard.is_managed_externally:
+        return ManageDashboardCertificationResponse(

Review Comment:
   **Suggestion:** The external-management check is separate from the later commit, so a concurrent sync can enable management after this check and certification is still written. [race condition]
   
   **Assessment:** 🟠 `Major` · 🔁 `Occurrence: Sometimes`
   
   [![Use CodeAnt Skill](https://new-codeant-butcket.s3.us-west-1.amazonaws.com/badges/use-codeant-skill-flat-v2.svg)](https://docs.codeant.ai/cli/resolve-pr-comments-skill) [![Fix in Cursor](https://new-codeant-butcket.s3.us-west-1.amazonaws.com/badges/fix-in-cursor-flat.svg)](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=59834cc6a2cc47c8883b09a0ae76660a&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) [![Fix in VSCode Claude](https://new-codeant-butcket.s3.us-west-1.amazonaws.com/badges/fix-in-vscode-claude-flat.svg)](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=59834cc6a2cc47c8883b09a0ae76660a&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
   <details>
   <summary><b>Prompt for AI Agent 🤖 </b></summary>
   
   ```mdx
   This is a comment left during a code review.
   
   **Path:** superset/mcp_service/dashboard/tool/manage_dashboard_certification.py
   **Line:** 110:111
   **Comment:**
   	*Race Condition: The external-management check is separate from the later commit, so a concurrent sync can enable management after this check and certification is still written.
   
   Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
   Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
   ```
   </details>
   <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F44094&comment_hash=9b60a8565d94dd1efc94f41743d50ad3250b94af7b01c9dbaca4dc83c643c248&reaction=like'>👍</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F44094&comment_hash=9b60a8565d94dd1efc94f41743d50ad3250b94af7b01c9dbaca4dc83c643c248&reaction=dislike'>👎</a>



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org