You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@superset.apache.org by mi...@apache.org on 2026/05/28 14:24:53 UTC
(superset) 01/01: fix(security): make ApiKey admin-only view menu conditional on FAB_API_KEY_ENABLED
This is an automated email from the ASF dual-hosted git repository.
aminghadersohi pushed a commit to branch work-pr-39604
in repository https://gitbox.apache.org/repos/asf/superset.git
commit 11dce414ed7325228b798f21e651fc80fb2a6643
Author: Amin Ghadersohi <am...@gmail.com>
AuthorDate: Thu May 28 14:24:25 2026 +0000
fix(security): make ApiKey admin-only view menu conditional on FAB_API_KEY_ENABLED
Move the ApiKey view-menu guard from the static ADMIN_ONLY_VIEW_MENUS set into
_is_admin_only so it is only enforced when FAB_API_KEY_ENABLED=True, as
requested in review.
---
superset/security/manager.py | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/superset/security/manager.py b/superset/security/manager.py
index 7e4938c2c31..30c3dc41c65 100644
--- a/superset/security/manager.py
+++ b/superset/security/manager.py
@@ -463,10 +463,6 @@ class SupersetSecurityManager( # pylint: disable=too-many-public-methods
"PermissionViewMenu",
"ViewMenu",
"User",
- # FAB ApiKeyApi blueprint (active when FAB_API_KEY_ENABLED=True).
- # Listed unconditionally — harmless when the feature is off because
- # no PVMs exist under this view menu.
- "ApiKey",
} | USER_MODEL_VIEWS
ALPHA_ONLY_VIEW_MENUS = {
@@ -1648,6 +1644,10 @@ class SupersetSecurityManager( # pylint: disable=too-many-public-methods
and pvm.permission.name not in self.READ_ONLY_PERMISSION
):
return True
+ if pvm.view_menu.name == "ApiKey" and current_app.config.get(
+ "FAB_API_KEY_ENABLED", False
+ ):
+ return True
return (
pvm.view_menu.name in self.ADMIN_ONLY_VIEW_MENUS
or pvm.permission.name in self.ADMIN_ONLY_PERMISSIONS