You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@superset.apache.org by ru...@apache.org on 2026/06/13 08:07:54 UTC
(superset) 01/01: chore(deps): bump ioredis from 5.11.0 to 5.11.1 in /superset-websocket (#40989)
This is an automated email from the ASF dual-hosted git repository.
rusackas pushed a commit to branch tdd/issue-32768-guest-time-grain
in repository https://gitbox.apache.org/repos/asf/superset.git
commit d355e82d8e0930ebe9f8b4980fb350442c0d5a9f
Author: dependabot[bot] <49...@users.noreply.github.com>
AuthorDate: Fri Jun 12 11:14:22 2026 -0700
chore(deps): bump ioredis from 5.11.0 to 5.11.1 in /superset-websocket (#40989)
Signed-off-by: dependabot[bot] <su...@github.com>
Co-authored-by: dependabot[bot] <49...@users.noreply.github.com>
---
superset-websocket/package-lock.json | 14 +++----
superset-websocket/package.json | 2 +-
tests/unit_tests/security/manager_test.py | 69 +++++++++++++++++++++++++++++++
3 files changed, 77 insertions(+), 8 deletions(-)
diff --git a/superset-websocket/package-lock.json b/superset-websocket/package-lock.json
index 9c38820dce9..9bacc2034fe 100644
--- a/superset-websocket/package-lock.json
+++ b/superset-websocket/package-lock.json
@@ -11,7 +11,7 @@
"dependencies": {
"cookie": "^1.1.1",
"hot-shots": "^15.0.0",
- "ioredis": "^5.11.0",
+ "ioredis": "^5.11.1",
"jsonwebtoken": "^9.0.3",
"lodash": "^4.18.1",
"winston": "^3.19.0",
@@ -3545,9 +3545,9 @@
"integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
},
"node_modules/ioredis": {
- "version": "5.11.0",
- "resolved": "https://registry.npmjs.org/ioredis/-/ioredis-5.11.0.tgz",
- "integrity": "sha512-EZBErytyVovD8f6pDfG3Kb37N6Y3lmDA9NNj+4+IP13CzzHGeX+OyeRM2Um13khRzoBSzzL+5lVnCX8V2RLeMg==",
+ "version": "5.11.1",
+ "resolved": "https://registry.npmjs.org/ioredis/-/ioredis-5.11.1.tgz",
+ "integrity": "sha512-ehuGcf94bQXhfagULNXrJdfnWO38v070jxSx/qE87Kjzmu2fU7ro5EFAb+OPituLqgfyuQaym5DlrNydW2sJ9A==",
"license": "MIT",
"dependencies": {
"@ioredis/commands": "1.10.0",
@@ -9077,9 +9077,9 @@
"integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
},
"ioredis": {
- "version": "5.11.0",
- "resolved": "https://registry.npmjs.org/ioredis/-/ioredis-5.11.0.tgz",
- "integrity": "sha512-EZBErytyVovD8f6pDfG3Kb37N6Y3lmDA9NNj+4+IP13CzzHGeX+OyeRM2Um13khRzoBSzzL+5lVnCX8V2RLeMg==",
+ "version": "5.11.1",
+ "resolved": "https://registry.npmjs.org/ioredis/-/ioredis-5.11.1.tgz",
+ "integrity": "sha512-ehuGcf94bQXhfagULNXrJdfnWO38v070jxSx/qE87Kjzmu2fU7ro5EFAb+OPituLqgfyuQaym5DlrNydW2sJ9A==",
"requires": {
"@ioredis/commands": "1.10.0",
"cluster-key-slot": "1.1.1",
diff --git a/superset-websocket/package.json b/superset-websocket/package.json
index e3c0b12d310..d34a48dbcb2 100644
--- a/superset-websocket/package.json
+++ b/superset-websocket/package.json
@@ -19,7 +19,7 @@
"dependencies": {
"cookie": "^1.1.1",
"hot-shots": "^15.0.0",
- "ioredis": "^5.11.0",
+ "ioredis": "^5.11.1",
"jsonwebtoken": "^9.0.3",
"lodash": "^4.18.1",
"winston": "^3.19.0",
diff --git a/tests/unit_tests/security/manager_test.py b/tests/unit_tests/security/manager_test.py
index 1968bbc9d9b..238674c2618 100644
--- a/tests/unit_tests/security/manager_test.py
+++ b/tests/unit_tests/security/manager_test.py
@@ -1045,6 +1045,75 @@ def test_query_context_modified_orderby(mocker: MockerFixture) -> None:
assert query_context_modified(query_context)
+def test_query_context_modified_time_grain_native_filter(
+ mocker: MockerFixture,
+) -> None:
+ """
+ Test `query_context_modified` when a guest applies a Time Grain native filter.
+
+ Reproduces https://github.com/apache/superset/issues/32768.
+
+ On a chart that uses a generic x-axis, the selected time grain is baked into the
+ ``BASE_AXIS`` adhoc column as a ``timeGrain`` property (see
+ ``normalizeTimeColumn`` on the frontend, which copies ``extras.time_grain_sqla``
+ onto the column). A Time Grain native filter is a supported, read-only guest
+ interaction: it only changes the granularity at which the *same* dimension is
+ bucketed, never which metrics or columns are queried.
+
+ However, because the changed time grain travels inside the ``columns`` payload,
+ the subset comparison treats the request as tampering and
+ ``query_context_modified`` returns ``True`` -- so guests hit "Guest user cannot
+ modify chart payload" whenever they pick a grain other than the chart default.
+
+ This is a faithful, expected-RED test: it asserts the correct behavior (a pure
+ time-grain change is *not* a modification) and therefore fails against current
+ ``master`` until the guard ignores the ``timeGrain`` of a ``BASE_AXIS`` column.
+ """
+ # The chart was saved with a monthly grain on its x-axis column.
+ stored_axis_column: AdhocColumn = {
+ "label": "order_date",
+ "sqlExpression": "order_date",
+ "columnType": "BASE_AXIS",
+ "timeGrain": "P1M",
+ }
+ # The guest picked a daily grain via the dashboard Time Grain native filter;
+ # `normalizeTimeColumn` rewrote the otherwise-identical column accordingly.
+ requested_axis_column: AdhocColumn = {
+ **stored_axis_column,
+ "timeGrain": "P1D",
+ }
+
+ query_context = mocker.MagicMock()
+ query_context.slice_.id = 42
+ query_context.slice_.params_dict = {
+ "metrics": ["count"],
+ }
+ query_context.slice_.query_context = json.dumps(
+ {
+ "queries": [
+ {
+ "columns": [stored_axis_column],
+ "metrics": ["count"],
+ }
+ ],
+ }
+ )
+ # Native-filter data requests don't carry the mutated columns at the top level;
+ # the grain change only shows up inside the query's columns.
+ query_context.form_data = {
+ "slice_id": 42,
+ "metrics": ["count"],
+ }
+ query_context.queries = [
+ QueryObject(
+ columns=[requested_axis_column],
+ metrics=["count"],
+ ),
+ ]
+
+ assert not query_context_modified(query_context)
+
+
def test_get_catalog_perm() -> None:
"""
Test the `get_catalog_perm` method.