You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "rusackas (via GitHub)" <gi...@apache.org> on 2026/07/11 18:18:10 UTC
[PR] test(security): prove Drill By access does not require can_explore (#27900) [superset]
rusackas opened a new pull request, #41967:
URL: https://github.com/apache/superset/pull/41967
### SUMMARY
Test-only PR for #27900 ("Cannot use drill-by/drill-to without `can explore` on Superset permission").
The issue reports that Drill By / Drill to Detail appears to require the broad `can explore on Superset` permission, which also grants the ability to view the underlying query and edit charts. This PR adds regression coverage that pins the actual backend behavior of the Drill By access gate.
`superset/explore/utils.py::check_access` is the access check invoked by `CreateFormDataCommand` when the client stores drill `form_data` through `ExploreFormDataRestApi` — the endpoint issue commenters specifically identified as required "for drill-by". The new tests assert:
- **`test_drill_by_access_without_can_explore`** — with `can read on Chart` granted and `can explore on Superset` *explicitly denied*, access is still granted. Drill By does not require `can explore`.
- **`test_drill_by_access_can_explore_is_not_the_gate`** — with *only* `can explore on Superset` granted (and `can read on Chart` denied, not owner/admin), access is refused. `can explore` is neither necessary nor sufficient; the granular chart-read permission is the real gate.
No production code is changed.
### How to interpret CI
- **Green** (expected on current master): the backend Drill By gate is already decoupled from `can explore` — access is governed by the granular `can read on Chart` permission. This documents/guards the current contract and matches recent maintainer reports that drilling works with granular permissions (`can drill on Dashboard`, `can samples on Datasource`, `can write on ExploreFormDataRestApi`) and no `can explore`.
- **Red**: the gate would still be coupled to `can explore`, meaning the reported bug is live at the backend layer.
Note: this covers the backend permission path. Any residual `can explore` coupling in the frontend menu/UI (e.g. the "Edit chart" affordance inside the drill modal) is out of scope for this backend test.
### TESTING INSTRUCTIONS
```bash
pytest tests/unit_tests/explore/utils_test.py::test_drill_by_access_without_can_explore \
tests/unit_tests/explore/utils_test.py::test_drill_by_access_can_explore_is_not_the_gate -v
```
### ADDITIONAL INFORMATION
- [ ] Has associated issue: Closes #27900
- [x] Required feature flags: none
- [x] Changes UI: no
- [x] Includes DB Migration: no
- [x] Introduces new feature or API: no
- [x] Removes existing feature or API: no
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] test(security): prove Drill By access does not require can_explore (#27900) [superset]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #41967:
URL: https://github.com/apache/superset/pull/41967#issuecomment-4948303316
## [Codecov](https://app.codecov.io/gh/apache/superset/pull/41967?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 63.97%. Comparing base ([`df209ce`](https://app.codecov.io/gh/apache/superset/commit/df209cedbf851ba7f96e8deff0e94446504e6d1c?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`42ee658`](https://app.codecov.io/gh/apache/superset/commit/42ee65841744b6b9df010e6fdebbefb92c9db018?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## master #41967 +/- ##
==========================================
- Coverage 64.77% 63.97% -0.81%
==========================================
Files 2742 2742
Lines 153316 153316
Branches 35143 35143
==========================================
- Hits 99311 98083 -1228
- Misses 52107 53342 +1235
+ Partials 1898 1891 -7
```
| [Flag](https://app.codecov.io/gh/apache/superset/pull/41967/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [hive](https://app.codecov.io/gh/apache/superset/pull/41967/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `39.07% <ø> (ø)` | |
| [mysql](https://app.codecov.io/gh/apache/superset/pull/41967/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [postgres](https://app.codecov.io/gh/apache/superset/pull/41967/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [presto](https://app.codecov.io/gh/apache/superset/pull/41967/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `41.06% <ø> (ø)` | |
| [python](https://app.codecov.io/gh/apache/superset/pull/41967/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `57.79% <ø> (-1.64%)` | :arrow_down: |
| [sqlite](https://app.codecov.io/gh/apache/superset/pull/41967/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `57.65% <ø> (ø)` | |
| [unit](https://app.codecov.io/gh/apache/superset/pull/41967/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>
[:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/apache/superset/pull/41967?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] test(security): prove Drill By access does not require can_explore (#27900) [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #41967:
URL: https://github.com/apache/superset/pull/41967#issuecomment-4948255109
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] test(security): prove Drill By access does not require can_explore (#27900) [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas merged PR #41967:
URL: https://github.com/apache/superset/pull/41967
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org