(superset) branch work-pr-39604 updated: fix(security): remove redundant ApiKey conditional from _is_admin_only

[mi...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

aminghadersohi pushed a commit to branch work-pr-39604
in repository https://gitbox.apache.org/repos/asf/superset.git


The following commit(s) were added to refs/heads/work-pr-39604 by this push:
     new 162d3e848ae fix(security): remove redundant ApiKey conditional from _is_admin_only
162d3e848ae is described below

commit 162d3e848aec6b22b767f878a79f4a14a7347386
Author: Amin Ghadersohi <am...@gmail.com>
AuthorDate: Thu May 28 17:28:39 2026 +0000

    fix(security): remove redundant ApiKey conditional from _is_admin_only
    
    'ApiKey' is already in the static ADMIN_ONLY_VIEW_MENUS set, so the
    per-call config check in _is_admin_only is unreachable dead code.
---
 superset/security/manager.py | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/superset/security/manager.py b/superset/security/manager.py
index 8d2476714e3..96a008e2c11 100644
--- a/superset/security/manager.py
+++ b/superset/security/manager.py
@@ -1646,10 +1646,6 @@ class SupersetSecurityManager(  # pylint: disable=too-many-public-methods
             and pvm.permission.name not in self.READ_ONLY_PERMISSION
         ):
             return True
-        if pvm.view_menu.name == "ApiKey" and current_app.config.get(
-            "FAB_API_KEY_ENABLED", False
-        ):
-            return True
         return (
             pvm.view_menu.name in self.ADMIN_ONLY_VIEW_MENUS
             or pvm.permission.name in self.ADMIN_ONLY_PERMISSIONS