You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "sha174n (via GitHub)" <gi...@apache.org> on 2026/03/25 14:12:54 UTC
[PR] feat(reports): validate email recipient addresses at schema layer [superset]
sha174n opened a new pull request, #38847:
URL: https://github.com/apache/superset/pull/38847
### SUMMARY
Resolves the long-standing `# TODO if email check validity` comment in `ReportRecipientConfigJSONSchema` by adding a `validates_schema` hook on `ReportRecipientSchema`.
The hook rejects malformed email addresses for `target`, `ccTarget`, and `bccTarget` fields when the recipient type is `Email`. Slack and Webhook recipients are unaffected.
**Before:** the schema accepted any string as an email address, deferring validation (if any) to the mail transport layer.
**After:** marshmallow returns a 400 with a descriptive error at the API boundary if an invalid address is supplied.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
N/A — API-only change.
### TESTING INSTRUCTIONS
```bash
pytest tests/unit_tests/reports/schemas_test.py
```
Manual: POST/PUT to `/api/v1/report/` with an `Email` recipient containing a malformed address (e.g. `"not-an-email"`) — expect HTTP 400 with a `recipient_config_json` validation error. Valid addresses and non-Email recipient types should be unaffected.
### ADDITIONAL INFORMATION
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(reports): lock recipient to owner email for chart/dashboard reports [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #38847:
URL: https://github.com/apache/superset/pull/38847#issuecomment-4150088743
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
<details>
<summary>
Bito Usage Guide
</summary>
**Commands**
Type the following command in the pull request comment and save the comment.
- `/review` - Manually triggers a full AI review.
- `/pause` - Pauses automatic reviews on this pull request.
- `/resume` - Resumes automatic reviews.
- `/resolve` - Marks all Bito-posted review comments as resolved.
- `/abort` - Cancels all in-progress reviews.
Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
**Configuration**
This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
**Documentation & Help**
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(reports): enforce server-side recipient on chart/dashboard report subscriptions [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #38847:
URL: https://github.com/apache/superset/pull/38847#issuecomment-4232845725
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
<details>
<summary>
Bito Usage Guide
</summary>
**Commands**
Type the following command in the pull request comment and save the comment.
- `/review` - Manually triggers a full AI review.
- `/pause` - Pauses automatic reviews on this pull request.
- `/resume` - Resumes automatic reviews.
- `/resolve` - Marks all Bito-posted review comments as resolved.
- `/abort` - Cancels all in-progress reviews.
Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
**Configuration**
This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
**Documentation & Help**
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(reports): enforce server-side recipient on chart/dashboard report subscriptions [superset]
Posted by "sha174n (via GitHub)" <gi...@apache.org>.
sha174n commented on code in PR #38847:
URL: https://github.com/apache/superset/pull/38847#discussion_r3196475855
##########
superset/commands/report/update.py:
##########
@@ -89,6 +97,26 @@ def validate(self) -> None: # noqa: C901
):
self._properties["last_state"] = ReportState.NOOP
+ # For reports created from charts or dashboards the recipient must always
+ # be the requesting user's own email address.
+ if (
Review Comment:
The `/api/v1/report/subscribe` endpoint added in this PR is exactly the separate endpoint you're describing. Gamma users get `can_subscribe` permission (not `can_write`), and the endpoint derives `creation_method` server-side from the chart/dashboard object — no client-supplied value. The regular `POST /api/v1/report/` still requires `can_write` (admins). The two flows are separated.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(reports): lock recipient to owner email for chart/dashboard reports [superset]
Posted by "codeant-ai-for-open-source[bot] (via GitHub)" <gi...@apache.org>.
codeant-ai-for-open-source[bot] commented on PR #38847:
URL: https://github.com/apache/superset/pull/38847#issuecomment-4132973820
## **Sequence Diagram**
This PR ensures that when updating reports created from charts or dashboards, the email recipient is always forced to the current user's address, and adds schema-level validation for email recipient fields. Invalid email addresses in recipient configuration now cause a validation error instead of being accepted.
```mermaid
sequenceDiagram
participant Client
participant API
participant ReportsBackend
Client->>API: Update chart or dashboard report with recipients
API->>ReportsBackend: Validate and apply report update
ReportsBackend->>ReportsBackend: For chart or dashboard, replace recipients with current user email
ReportsBackend-->>API: Report schedule saved with locked recipient
API-->>Client: Response with updated report
Client->>API: Submit report recipient with email addresses
API->>ReportsBackend: Validate recipient schema
ReportsBackend->>ReportsBackend: Check target cc and bcc are valid emails
ReportsBackend-->>API: Return validation error if any email is invalid
```
---
*Generated by [CodeAnt AI](https://codeant.ai)*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(reports): lock recipient to owner email for chart/dashboard reports [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #38847:
URL: https://github.com/apache/superset/pull/38847#issuecomment-4133624629
<!-- Bito Reply -->
The security concern is valid: relying on client-supplied 'creation_method' in create.py allows potential bypass for sending reports to any email. Creating a separate endpoint like POST /api/v1/report/my_report, restricted to Gamma users, enforces server-side security and aligns with the update.py validation that forces user emails for chart/dashboard reports.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(reports): enforce server-side recipient on chart/dashboard report subscriptions [superset]
Posted by "sha174n (via GitHub)" <gi...@apache.org>.
sha174n commented on code in PR #38847:
URL: https://github.com/apache/superset/pull/38847#discussion_r3016274240
##########
superset/reports/schemas.py:
##########
@@ -305,6 +305,20 @@ def validate_report_references( # pylint: disable=unused-argument
)
+class ReportScheduleSubscribeSchema(ReportSchedulePostSchema):
+ """Schema for creating a chart/dashboard subscription.
+
+ ``recipients`` and ``creation_method`` are excluded — both are set
+ server-side: recipients are locked to the authenticated user's email,
+ and creation_method is derived from the presence of ``chart`` or
+ ``dashboard`` in the payload.
+ """
+
+ class Meta:
Review Comment:
Added a type override in ReportScheduleSubscribeSchema restricting to Report only, with a test covering the Alert rejection.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(reports): lock recipient to owner email for chart/dashboard reports [superset]
Posted by "dpgaspar (via GitHub)" <gi...@apache.org>.
dpgaspar commented on code in PR #38847:
URL: https://github.com/apache/superset/pull/38847#discussion_r2993993186
##########
superset/commands/report/update.py:
##########
@@ -89,6 +97,26 @@ def validate(self) -> None: # noqa: C901
):
self._properties["last_state"] = ReportState.NOOP
+ # For reports created from charts or dashboards the recipient must always
+ # be the requesting user's own email address.
+ if (
Review Comment:
The core problem: the same POST /api/v1/report/ endpoint handles both flows, and the security-relevant branching is based on a client-supplied value:
On creation (superset/commands/report/create.py):
creation_method = self._properties.get("creation_method") # from the request!
This means the user can still change the POST /api/v1/report/ and send a report to any email.
Creating a separate endpoint just for this purpose is probably the best path, permission to this new endpoint can be given to Gamma users. Something like POST /api/v1/report/my_report (or similar), this way security is enforced at the server side
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(reports): enforce server-side recipient on chart/dashboard report subscriptions [superset]
Posted by "codeant-ai-for-open-source[bot] (via GitHub)" <gi...@apache.org>.
codeant-ai-for-open-source[bot] commented on code in PR #38847:
URL: https://github.com/apache/superset/pull/38847#discussion_r3069651122
##########
tests/unit_tests/reports/schemas_test.py:
##########
@@ -77,6 +82,149 @@ def test_report_post_schema_custom_width_validation(mocker: MockerFixture) -> No
}
+def test_report_recipient_schema_email_valid() -> None:
+ schema = ReportRecipientSchema()
Review Comment:
**Suggestion:** Add a docstring to this newly added test function to comply with the requirement that new function definitions include documentation. [custom_rule]
**Severity Level:** Minor ⚠️
```suggestion
"""Validate that an email recipient with a valid target is accepted."""
```
<details>
<summary><b>Why it matters? 🤔 </b></summary>
The new function in the final file lacks a docstring, which violates the stated rule requiring documentation for new function definitions. The improved code adds a concise docstring and keeps the function syntactically valid.
</details>
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** tests/unit_tests/reports/schemas_test.py
**Line:** 86:86
**Comment:**
*Custom Rule: Add a docstring to this newly added test function to comply with the requirement that new function definitions include documentation.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
```
</details>
<a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F38847&comment_hash=fd3f113f183ef54ceef4e4017c0e64ff2ff7d5dc1145b570444bda99fbc026aa&reaction=like'>👍</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F38847&comment_hash=fd3f113f183ef54ceef4e4017c0e64ff2ff7d5dc1145b570444bda99fbc026aa&reaction=dislike'>👎</a>
##########
tests/unit_tests/reports/schemas_test.py:
##########
@@ -77,6 +82,149 @@ def test_report_post_schema_custom_width_validation(mocker: MockerFixture) -> No
}
+def test_report_recipient_schema_email_valid() -> None:
+ schema = ReportRecipientSchema()
+ result = schema.load(
+ {
+ "type": "Email",
+ "recipient_config_json": {"target": "user@example.com"},
+ }
+ )
+ assert result["recipient_config_json"]["target"] == "user@example.com"
+
+
+def test_report_recipient_schema_email_invalid_target() -> None:
+ schema = ReportRecipientSchema()
+ with pytest.raises(ValidationError) as excinfo:
+ schema.load(
+ {
+ "type": "Email",
+ "recipient_config_json": {"target": "not-an-email"},
+ }
+ )
+ assert "target" in excinfo.value.messages
+
+
+def test_report_recipient_schema_email_invalid_cc() -> None:
+ schema = ReportRecipientSchema()
Review Comment:
**Suggestion:** Add a docstring to this newly introduced function to satisfy the requirement for documenting new function definitions. [custom_rule]
**Severity Level:** Minor ⚠️
```suggestion
"""Validate that an invalid cc email value is rejected."""
```
<details>
<summary><b>Why it matters? 🤔 </b></summary>
This is a newly introduced function without a docstring in the final file, so the rule violation is real. The improved code correctly adds documentation and remains executable.
</details>
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** tests/unit_tests/reports/schemas_test.py
**Line:** 109:109
**Comment:**
*Custom Rule: Add a docstring to this newly introduced function to satisfy the requirement for documenting new function definitions.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
```
</details>
<a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F38847&comment_hash=5dedcb30d81833361e46fefce9cf9662cb724a973063de8ff761aa6b3acbbc5c&reaction=like'>👍</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F38847&comment_hash=5dedcb30d81833361e46fefce9cf9662cb724a973063de8ff761aa6b3acbbc5c&reaction=dislike'>👎</a>
##########
tests/unit_tests/reports/schemas_test.py:
##########
@@ -77,6 +82,149 @@ def test_report_post_schema_custom_width_validation(mocker: MockerFixture) -> No
}
+def test_report_recipient_schema_email_valid() -> None:
+ schema = ReportRecipientSchema()
+ result = schema.load(
+ {
+ "type": "Email",
+ "recipient_config_json": {"target": "user@example.com"},
+ }
+ )
+ assert result["recipient_config_json"]["target"] == "user@example.com"
+
+
+def test_report_recipient_schema_email_invalid_target() -> None:
+ schema = ReportRecipientSchema()
+ with pytest.raises(ValidationError) as excinfo:
+ schema.load(
+ {
+ "type": "Email",
+ "recipient_config_json": {"target": "not-an-email"},
+ }
+ )
+ assert "target" in excinfo.value.messages
+
+
+def test_report_recipient_schema_email_invalid_cc() -> None:
+ schema = ReportRecipientSchema()
+ with pytest.raises(ValidationError) as excinfo:
+ schema.load(
+ {
+ "type": "Email",
+ "recipient_config_json": {
+ "target": "user@example.com",
+ "ccTarget": "bad-email",
+ },
+ }
+ )
+ assert "ccTarget" in excinfo.value.messages
+
+
+def test_report_recipient_schema_email_invalid_bcc() -> None:
+ schema = ReportRecipientSchema()
Review Comment:
**Suggestion:** Add a docstring to this new function so it complies with the rule requiring docstrings on newly added functions. [custom_rule]
**Severity Level:** Minor ⚠️
```suggestion
"""Validate that an invalid bcc email value is rejected."""
```
<details>
<summary><b>Why it matters? 🤔 </b></summary>
The final file shows this new test function has no docstring, so it violates the documented-new-function rule. The suggested docstring is valid Python and does not introduce any new dependencies.
</details>
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** tests/unit_tests/reports/schemas_test.py
**Line:** 124:124
**Comment:**
*Custom Rule: Add a docstring to this new function so it complies with the rule requiring docstrings on newly added functions.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
```
</details>
<a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F38847&comment_hash=dd342f63ee57f8989f05f5dfa0fd800dc234c07582c2e8a8676b0a10d256d3c7&reaction=like'>👍</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F38847&comment_hash=dd342f63ee57f8989f05f5dfa0fd800dc234c07582c2e8a8676b0a10d256d3c7&reaction=dislike'>👎</a>
##########
tests/unit_tests/reports/schemas_test.py:
##########
@@ -77,6 +82,149 @@ def test_report_post_schema_custom_width_validation(mocker: MockerFixture) -> No
}
+def test_report_recipient_schema_email_valid() -> None:
+ schema = ReportRecipientSchema()
+ result = schema.load(
+ {
+ "type": "Email",
+ "recipient_config_json": {"target": "user@example.com"},
+ }
+ )
+ assert result["recipient_config_json"]["target"] == "user@example.com"
+
+
+def test_report_recipient_schema_email_invalid_target() -> None:
+ schema = ReportRecipientSchema()
+ with pytest.raises(ValidationError) as excinfo:
+ schema.load(
+ {
+ "type": "Email",
+ "recipient_config_json": {"target": "not-an-email"},
+ }
+ )
+ assert "target" in excinfo.value.messages
+
+
+def test_report_recipient_schema_email_invalid_cc() -> None:
+ schema = ReportRecipientSchema()
+ with pytest.raises(ValidationError) as excinfo:
+ schema.load(
+ {
+ "type": "Email",
+ "recipient_config_json": {
+ "target": "user@example.com",
+ "ccTarget": "bad-email",
+ },
+ }
+ )
+ assert "ccTarget" in excinfo.value.messages
+
+
+def test_report_recipient_schema_email_invalid_bcc() -> None:
+ schema = ReportRecipientSchema()
+ with pytest.raises(ValidationError) as excinfo:
+ schema.load(
+ {
+ "type": "Email",
+ "recipient_config_json": {
+ "target": "user@example.com",
+ "bccTarget": "not-valid",
+ },
+ }
+ )
+ assert "bccTarget" in excinfo.value.messages
+
+
+def test_report_recipient_schema_email_empty_bcc_allowed() -> None:
+ schema = ReportRecipientSchema()
Review Comment:
**Suggestion:** Add a docstring to this newly added test to document its purpose and meet the new-function docstring requirement. [custom_rule]
**Severity Level:** Minor ⚠️
```suggestion
"""Validate that an empty bcc value is accepted for email recipients."""
```
<details>
<summary><b>Why it matters? 🤔 </b></summary>
The existing code lacks a docstring for a newly added function, which is the rule being enforced. The improved code adds the docstring correctly and is syntactically sound.
</details>
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** tests/unit_tests/reports/schemas_test.py
**Line:** 139:139
**Comment:**
*Custom Rule: Add a docstring to this newly added test to document its purpose and meet the new-function docstring requirement.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
```
</details>
<a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F38847&comment_hash=580cf995f1bc6322f2aea1e1900d7ea0c12133da80aaa51492235b1a42760528&reaction=like'>👍</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F38847&comment_hash=580cf995f1bc6322f2aea1e1900d7ea0c12133da80aaa51492235b1a42760528&reaction=dislike'>👎</a>
##########
tests/unit_tests/reports/schemas_test.py:
##########
@@ -77,6 +82,149 @@ def test_report_post_schema_custom_width_validation(mocker: MockerFixture) -> No
}
+def test_report_recipient_schema_email_valid() -> None:
+ schema = ReportRecipientSchema()
+ result = schema.load(
+ {
+ "type": "Email",
+ "recipient_config_json": {"target": "user@example.com"},
+ }
+ )
+ assert result["recipient_config_json"]["target"] == "user@example.com"
+
+
+def test_report_recipient_schema_email_invalid_target() -> None:
+ schema = ReportRecipientSchema()
Review Comment:
**Suggestion:** Add a docstring to this new test function so the new definition is documented per the docstring rule. [custom_rule]
**Severity Level:** Minor ⚠️
```suggestion
"""Validate that an invalid email target raises a validation error."""
```
<details>
<summary><b>Why it matters? 🤔 </b></summary>
The function is newly added and currently has no docstring, so it matches the custom rule violation. The suggested change adds a valid docstring without affecting behavior.
</details>
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** tests/unit_tests/reports/schemas_test.py
**Line:** 97:97
**Comment:**
*Custom Rule: Add a docstring to this new test function so the new definition is documented per the docstring rule.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
```
</details>
<a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F38847&comment_hash=a9c414ab41f697b1ae75eabed958866cc60dbc964982828139f59399546deebf&reaction=like'>👍</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F38847&comment_hash=a9c414ab41f697b1ae75eabed958866cc60dbc964982828139f59399546deebf&reaction=dislike'>👎</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(reports): lock recipient to owner email for chart/dashboard reports [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #38847:
URL: https://github.com/apache/superset/pull/38847#issuecomment-4129955264
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
<details>
<summary>
Bito Usage Guide
</summary>
**Commands**
Type the following command in the pull request comment and save the comment.
- `/review` - Manually triggers a full AI review.
- `/pause` - Pauses automatic reviews on this pull request.
- `/resume` - Resumes automatic reviews.
- `/resolve` - Marks all Bito-posted review comments as resolved.
- `/abort` - Cancels all in-progress reviews.
Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
**Configuration**
This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
**Documentation & Help**
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(reports): enforce server-side recipient on chart/dashboard report subscriptions [superset]
Posted by "codeant-ai-for-open-source[bot] (via GitHub)" <gi...@apache.org>.
codeant-ai-for-open-source[bot] commented on code in PR #38847:
URL: https://github.com/apache/superset/pull/38847#discussion_r3069655226
##########
superset/reports/schemas.py:
##########
@@ -305,6 +305,30 @@ def validate_report_references( # pylint: disable=unused-argument
)
+class ReportScheduleSubscribeSchema(ReportSchedulePostSchema):
+ """Schema for creating a chart/dashboard subscription.
+
+ ``recipients`` and ``creation_method`` are excluded — both are set
+ server-side: recipients are locked to the authenticated user's email,
+ and creation_method is derived from the presence of ``chart`` or
+ ``dashboard`` in the payload.
+
+ ``type`` is restricted to ``Report`` — alert schedules cannot be
+ created through the subscribe endpoint.
+ """
+
+ type = fields.String(
+ metadata={"description": type_description},
+ allow_none=False,
+ required=True,
+ validate=validate.OneOf(choices=[ReportScheduleType.REPORT.value]),
+ )
+
+ class Meta:
+ exclude = ("recipients", "creation_method")
Review Comment:
**Suggestion:** The subscribe schema still allows client-controlled `owners` because only `recipients` and `creation_method` are excluded. In this flow, that lets a requester inject arbitrary user IDs as owners (the create command accepts and resolves them), which breaks the intended "personal subscription" model and can grant unintended edit/delete access to other users. Exclude `owners` in this schema so ownership is set server-side. [security]
<details>
<summary><b>Severity Level:</b> Major ⚠️</summary>
```mdx
- ⚠️ Subscribe endpoint lets clients assign arbitrary report schedule owners.
- ⚠️ Owners gain edit/delete rights to another user's subscription.
- ⚠️ Weakens intended personal-subscription semantics for chart/dashboard reports.
```
</details>
```suggestion
exclude = ("recipients", "creation_method", "owners")
```
<details>
<summary><b>Steps of Reproduction ✅ </b></summary>
```mdx
1. Log in as a regular Superset user and call `POST /api/v1/report/subscribe` (implemented
in `superset/reports/api.py:318-391`) with a JSON body containing required report fields
plus an explicit `owners` list, for example:
```json
{
"type": "Report",
"name": "My subscription",
"crontab": "0 9 * * *",
"timezone": "UTC",
"chart": 1,
"owners": [123] // some other user's ID
}
```
2. The request is validated by `ReportScheduleRestApi.subscribe()` using
`self.subscribe_schema.load(request.json)` at `superset/reports/api.py:361-363`, where
`subscribe_schema` is an instance of `ReportScheduleSubscribeSchema`
(`superset/reports/api.py:195-197`).
3. `ReportScheduleSubscribeSchema` inherits from `ReportSchedulePostSchema` and only
excludes `recipients` and `creation_method` in its `Meta` class
(`superset/reports/schemas.py:320-329`). Because `owners` is not listed in `exclude =
("recipients", "creation_method")`, the loaded `item` dict still contains the
client-supplied `owners` field.
4. `subscribe()` then sets `creation_method` based on `chart`/`dashboard` and calls
`CreateReportScheduleCommand(item).run()` (`superset/reports/api.py:366-377`). Inside
`CreateReportScheduleCommand.validate()` (`superset/commands/report/create.py:87-119`),
`owner_ids` is read from `self._properties.get("owners")` (`create.py:100-105`) and passed
to `CreateMixin.populate_owners()` via `owners = self.populate_owners(owner_ids)`
(`create.py:158-160`, with implementation in `superset/commands/base.py:7-19`). This
resolves the arbitrary IDs into actual owner users and assigns them to
`self._properties["owners"]`, so the resulting `ReportSchedule` row is created with
whatever owners the client specified, despite the subscribe endpoint being documented as a
personal subscription flow where key fields are intended to be server-controlled.
```
</details>
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** superset/reports/schemas.py
**Line:** 328:328
**Comment:**
*Security: The subscribe schema still allows client-controlled `owners` because only `recipients` and `creation_method` are excluded. In this flow, that lets a requester inject arbitrary user IDs as owners (the create command accepts and resolves them), which breaks the intended "personal subscription" model and can grant unintended edit/delete access to other users. Exclude `owners` in this schema so ownership is set server-side.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
```
</details>
<a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F38847&comment_hash=b87309791eb62e18594ab538f56911bf2ab826fd00f5399bf8670fa1a062fc69&reaction=like'>👍</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F38847&comment_hash=b87309791eb62e18594ab538f56911bf2ab826fd00f5399bf8670fa1a062fc69&reaction=dislike'>👎</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(reports): enforce server-side recipient on chart/dashboard report subscriptions [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #38847:
URL: https://github.com/apache/superset/pull/38847#issuecomment-4163400109
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
<details>
<summary>
Bito Usage Guide
</summary>
**Commands**
Type the following command in the pull request comment and save the comment.
- `/review` - Manually triggers a full AI review.
- `/pause` - Pauses automatic reviews on this pull request.
- `/resume` - Resumes automatic reviews.
- `/resolve` - Marks all Bito-posted review comments as resolved.
- `/abort` - Cancels all in-progress reviews.
Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
**Configuration**
This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
**Documentation & Help**
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(reports): enforce server-side recipient on chart/dashboard report subscriptions [superset]
Posted by "codeant-ai-for-open-source[bot] (via GitHub)" <gi...@apache.org>.
codeant-ai-for-open-source[bot] commented on code in PR #38847:
URL: https://github.com/apache/superset/pull/38847#discussion_r3016222469
##########
superset/reports/schemas.py:
##########
@@ -305,6 +305,20 @@ def validate_report_references( # pylint: disable=unused-argument
)
+class ReportScheduleSubscribeSchema(ReportSchedulePostSchema):
+ """Schema for creating a chart/dashboard subscription.
+
+ ``recipients`` and ``creation_method`` are excluded — both are set
+ server-side: recipients are locked to the authenticated user's email,
+ and creation_method is derived from the presence of ``chart`` or
+ ``dashboard`` in the payload.
+ """
+
+ class Meta:
Review Comment:
**Suggestion:** The subscribe schema still accepts all report types from the generic post schema, so a caller can submit `type="Alert"` and create alert schedules through the weaker `subscribe` permission path. Restrict this schema to only allow `Report` type so the new endpoint cannot be used to create alert configs. [security]
<details>
<summary><b>Severity Level:</b> Critical 🚨</summary>
```mdx
- ❌ Subscribe endpoint can create alerts via unrestricted type field.
- ⚠️ Bypasses intended separation between subscribe and write permissions.
- ⚠️ Inconsistent with docs: endpoint claims report-only subscriptions.
```
</details>
```suggestion
type = fields.String(
metadata={"description": type_description},
allow_none=False,
required=True,
validate=validate.OneOf(choices=(ReportScheduleType.REPORT.value,)),
)
```
<details>
<summary><b>Steps of Reproduction ✅ </b></summary>
```mdx
1. Start Superset with this PR code and ensure the ReportSchedule REST API is registered
(ReportScheduleRestApi in `superset/reports/api.py:67-85` with `resource_name =
"report"`).
2. Issue an HTTP `POST` to `/api/v1/report/subscribe` which is handled by
`ReportScheduleRestApi.subscribe` (`superset/reports/api.py:318-379`) with a JSON body
containing `"type": "Alert"` plus valid `name`, `crontab`, `database`, and either `chart`
or `dashboard` IDs, for example:
`{"type": "Alert", "name": "Escalated alert", "crontab": "* * * * *", "database":
<valid_db_id>, "chart": <valid_chart_id>}`.
3. The request body is deserialized using `ReportScheduleSubscribeSchema`
(`superset/reports/schemas.py:308-319`), which subclasses `ReportSchedulePostSchema`
without redefining `type`, so the inherited `type` field (`ReportSchedulePostSchema.type`
in the same file) accepts any `ReportScheduleType` value, including `ALERT`, and therefore
the payload with `"type": "Alert"` passes schema validation.
4. Inside `subscribe`, the code sets `creation_method` based solely on the presence of
`dashboard` or `chart` (`superset/reports/api.py:366-371`), then calls
`CreateReportScheduleCommand(item).run()` (`superset/commands/report/create.py:49-57`),
whose `validate` method (`superset/commands/report/create.py:87-141`) permits `report_type
== ReportScheduleType.ALERT` as long as `database` is present, resulting in a persisted
`ReportSchedule` of type `ALERT` being created via the `/subscribe` endpoint under the
`subscribe` permission (`@permission_name("subscribe"` at `superset/reports/api.py:321`),
despite the endpoint's docstring advertising "chart or dashboard report" subscriptions
only.
```
</details>
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** superset/reports/schemas.py
**Line:** 317:317
**Comment:**
*Security: The subscribe schema still accepts all report types from the generic post schema, so a caller can submit `type="Alert"` and create alert schedules through the weaker `subscribe` permission path. Restrict this schema to only allow `Report` type so the new endpoint cannot be used to create alert configs.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
```
</details>
<a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F38847&comment_hash=1fdfe3df3ebc296c9ec06909eb4f04d7e97a4dea191044e6f566059ccaf48e8d&reaction=like'>👍</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F38847&comment_hash=1fdfe3df3ebc296c9ec06909eb4f04d7e97a4dea191044e6f566059ccaf48e8d&reaction=dislike'>👎</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(reports): lock recipient to owner email for chart/dashboard reports [superset]
Posted by "codeant-ai-for-open-source[bot] (via GitHub)" <gi...@apache.org>.
codeant-ai-for-open-source[bot] commented on code in PR #38847:
URL: https://github.com/apache/superset/pull/38847#discussion_r3005476817
##########
superset/reports/schemas.py:
##########
@@ -305,6 +305,19 @@ def validate_report_references( # pylint: disable=unused-argument
)
+class ReportScheduleSubscribeSchema(ReportSchedulePostSchema):
+ """Schema for creating a chart/dashboard subscription.
+
+ ``recipients`` and ``creation_method`` are excluded — both are set
+ server-side: recipients are locked to the authenticated user's email,
+ and creation_method is derived from the presence of ``chart`` or
+ ``dashboard`` in the payload.
+ """
+
+ class Meta:
+ exclude = ("recipients", "creation_method")
Review Comment:
**Suggestion:** As currently written, the subscription schema excludes `recipients` and `creation_method` but leaves the default `unknown=RAISE`, so if a client includes these fields (as the testing instructions explicitly allow), marshmallow will treat them as unknown and raise a validation error instead of silently discarding them and letting server-side logic override the values. [logic error]
<details>
<summary><b>Severity Level:</b> Major ⚠️</summary>
```mdx
- ❌ POST /api/v1/report/subscribe 400s if recipients included.
- ⚠️ Clients reusing /report payloads break on subscribe.
- ⚠️ Behavior contradicts subscribe endpoint description comments.
```
</details>
```suggestion
unknown = EXCLUDE
```
<details>
<summary><b>Steps of Reproduction ✅ </b></summary>
```mdx
1. Start a Superset instance with this PR code, ensuring ALERT_REPORTS feature is enabled
so the `ReportScheduleRestApi` is registered (see `superset/reports/api.py:67-82`).
2. Send an HTTP `POST` request to `/api/v1/report/subscribe` with JSON body that includes
standard required fields plus a `recipients` field, for example:
`{"type": "Report", "chart": 123, "name": "Test", "crontab": "0 0 * * *", "timezone":
"UTC", "recipients": [{"type": "Email", "recipient_config_json": {"target":
"someone@example.com"}}]}`.
3. The request reaches `ReportScheduleRestApi.subscribe` in
`superset/reports/api.py:59-105`, which calls `self.subscribe_schema.load(request.json)`
at `superset/reports/api.py:102`.
4. `self.subscribe_schema` is an instance of `ReportScheduleSubscribeSchema` defined in
`superset/reports/api.py:195-197` and implemented in
`superset/reports/schemas.py:308-318`; its `Meta` only sets `exclude = ("recipients",
"creation_method")` and does not set `unknown`, so Marshmallow (default `unknown=RAISE`)
treats incoming `recipients` and `creation_method` keys as unknown fields (because they
are excluded), raising a `ValidationError` that is caught in `subscribe` and returned as a
`400` response (`superset/reports/api.py:103-105`) instead of silently discarding those
fields and proceeding to set recipients and `creation_method` server-side as described in
the endpoint docstring (`superset/reports/api.py:65-73`).
```
</details>
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** superset/reports/schemas.py
**Line:** 318:318
**Comment:**
*Logic Error: As currently written, the subscription schema excludes `recipients` and `creation_method` but leaves the default `unknown=RAISE`, so if a client includes these fields (as the testing instructions explicitly allow), marshmallow will treat them as unknown and raise a validation error instead of silently discarding them and letting server-side logic override the values.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
```
</details>
<a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F38847&comment_hash=7ad771cc33fda703f2d224b7e474afdc7ab90881374e5e5e7e8ecad2b3e29f37&reaction=like'>👍</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F38847&comment_hash=7ad771cc33fda703f2d224b7e474afdc7ab90881374e5e5e7e8ecad2b3e29f37&reaction=dislike'>👎</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(reports): validate email recipient addresses at schema layer [superset]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #38847:
URL: https://github.com/apache/superset/pull/38847#issuecomment-4126963075
## [Codecov](https://app.codecov.io/gh/apache/superset/pull/38847?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:x: Patch coverage is `14.28571%` with `12 lines` in your changes missing coverage. Please review.
:white_check_mark: Project coverage is 54.52%. Comparing base ([`12aca72`](https://app.codecov.io/gh/apache/superset/commit/12aca720746d70a13e0f76c24380ef4bdb69118f?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`8d4d320`](https://app.codecov.io/gh/apache/superset/commit/8d4d320fb6b63e2985333c957091fec72482254d?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
| [Files with missing lines](https://app.codecov.io/gh/apache/superset/pull/38847?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Patch % | Lines |
|---|---|---|
| [superset/reports/schemas.py](https://app.codecov.io/gh/apache/superset/pull/38847?src=pr&el=tree&filepath=superset%2Freports%2Fschemas.py&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-c3VwZXJzZXQvcmVwb3J0cy9zY2hlbWFzLnB5) | 14.28% | [12 Missing :warning: ](https://app.codecov.io/gh/apache/superset/pull/38847?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
:x: Your project check has failed because the head coverage (99.85%) is below the target coverage (100.00%). You can increase the head coverage or adjust the [target](https://docs.codecov.com/docs/commit-status#target) coverage.
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## master #38847 +/- ##
===========================================
- Coverage 65.54% 54.52% -11.03%
===========================================
Files 1823 2536 +713
Lines 73154 130647 +57493
Branches 23437 30294 +6857
===========================================
+ Hits 47951 71229 +23278
- Misses 25203 59074 +33871
- Partials 0 344 +344
```
| [Flag](https://app.codecov.io/gh/apache/superset/pull/38847/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [hive](https://app.codecov.io/gh/apache/superset/pull/38847/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `40.39% <14.28%> (?)` | |
| [presto](https://app.codecov.io/gh/apache/superset/pull/38847/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `40.41% <14.28%> (?)` | |
| [python](https://app.codecov.io/gh/apache/superset/pull/38847/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `40.48% <14.28%> (?)` | |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>
[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/apache/superset/pull/38847?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(reports): enforce server-side recipient on chart/dashboard report subscriptions [superset]
Posted by "sha174n (via GitHub)" <gi...@apache.org>.
sha174n commented on PR #38847:
URL: https://github.com/apache/superset/pull/38847#issuecomment-4498529024
@dpgaspar Done — `ReportModal` now calls `POST /api/v1/report/subscribe` for new subscriptions. `recipients`, `creation_method`, and `owners` are no longer sent from the frontend; all derived server-side. Edit path (PUT) unchanged.
On permissions: no changes needed. `ReportSchedule` is in `ALPHA_ONLY_VIEW_MENUS` so `can_subscribe` is already alpha-only by inheritance. Gamma users can't reach the feature anyway — the frontend button is gated by `menu_access on Manage`, not ReportSchedule permissions.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(reports): lock recipient to owner email for chart/dashboard reports [superset]
Posted by "sha174n (via GitHub)" <gi...@apache.org>.
sha174n commented on code in PR #38847:
URL: https://github.com/apache/superset/pull/38847#discussion_r3000748860
##########
superset/commands/report/update.py:
##########
@@ -89,6 +97,26 @@ def validate(self) -> None: # noqa: C901
):
self._properties["last_state"] = ReportState.NOOP
+ # For reports created from charts or dashboards the recipient must always
+ # be the requesting user's own email address.
+ if (
Review Comment:
Good call, went with the dedicated endpoint.
Added POST /api/v1/report/subscribe with its own subscribe permission - schema strips recipients and creation_method entirely, both derived server-side.
Original POST /api/v1/report/ untouched for admin workflows.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(reports): lock recipient to owner email for chart/dashboard reports [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #38847:
URL: https://github.com/apache/superset/pull/38847#issuecomment-4142666974
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
<details>
<summary>
Bito Usage Guide
</summary>
**Commands**
Type the following command in the pull request comment and save the comment.
- `/review` - Manually triggers a full AI review.
- `/pause` - Pauses automatic reviews on this pull request.
- `/resume` - Resumes automatic reviews.
- `/resolve` - Marks all Bito-posted review comments as resolved.
- `/abort` - Cancels all in-progress reviews.
Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
**Configuration**
This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
**Documentation & Help**
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(reports): enforce server-side recipient on chart/dashboard report subscriptions [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #38847:
URL: https://github.com/apache/superset/pull/38847#issuecomment-4231912041
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
<details>
<summary>
Bito Usage Guide
</summary>
**Commands**
Type the following command in the pull request comment and save the comment.
- `/review` - Manually triggers a full AI review.
- `/pause` - Pauses automatic reviews on this pull request.
- `/resume` - Resumes automatic reviews.
- `/resolve` - Marks all Bito-posted review comments as resolved.
- `/abort` - Cancels all in-progress reviews.
Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
**Configuration**
This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
**Documentation & Help**
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(reports): lock recipient to owner email for chart/dashboard reports [superset]
Posted by "netlify[bot] (via GitHub)" <gi...@apache.org>.
netlify[bot] commented on PR #38847:
URL: https://github.com/apache/superset/pull/38847#issuecomment-4128020551
### <span aria-hidden="true">✅</span> Deploy Preview for *superset-docs-preview* ready!
| Name | Link |
|:-:|------------------------|
|<span aria-hidden="true">🔨</span> Latest commit | cf81f57daa847b6346e9ea1602dd4bb3c4d07370 |
|<span aria-hidden="true">🔍</span> Latest deploy log | https://app.netlify.com/projects/superset-docs-preview/deploys/69c40cfc32fac700083cba4b |
|<span aria-hidden="true">😎</span> Deploy Preview | [https://deploy-preview-38847--superset-docs-preview.netlify.app](https://deploy-preview-38847--superset-docs-preview.netlify.app) |
|<span aria-hidden="true">📱</span> Preview on mobile | <details><summary> Toggle QR Code... </summary><br /><br /><br /><br />_Use your smartphone camera to open QR code link._</details> |
---
<!-- [superset-docs-preview Preview](https://deploy-preview-38847--superset-docs-preview.netlify.app) -->
_To edit notification comments on pull requests, go to your [Netlify project configuration](https://app.netlify.com/projects/superset-docs-preview/configuration/notifications#deploy-notifications)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(reports): enforce server-side recipient on chart/dashboard report subscriptions [superset]
Posted by "dpgaspar (via GitHub)" <gi...@apache.org>.
dpgaspar commented on PR #38847:
URL: https://github.com/apache/superset/pull/38847#issuecomment-4498079850
@sha174n now we need to change the frontend so that this path calls this new endpoint:
<img width="1715" height="445" alt="Screenshot 2026-05-20 at 12 50 55" src="https://github.com/user-attachments/assets/5da2de4f-61fa-4cff-88d2-38ba6fb708df" />
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(reports): lock recipient to owner email for chart/dashboard reports [superset]
Posted by "netlify[bot] (via GitHub)" <gi...@apache.org>.
netlify[bot] commented on PR #38847:
URL: https://github.com/apache/superset/pull/38847#issuecomment-4129152301
### <span aria-hidden="true">✅</span> Deploy Preview for *superset-docs-preview* ready!
| Name | Link |
|:-:|------------------------|
|<span aria-hidden="true">🔨</span> Latest commit | 702e94aa7608306d84c66d3de8b72c24e7280aa2 |
|<span aria-hidden="true">🔍</span> Latest deploy log | https://app.netlify.com/projects/superset-docs-preview/deploys/69c4348cd7b1500008102b4b |
|<span aria-hidden="true">😎</span> Deploy Preview | [https://deploy-preview-38847--superset-docs-preview.netlify.app](https://deploy-preview-38847--superset-docs-preview.netlify.app) |
|<span aria-hidden="true">📱</span> Preview on mobile | <details><summary> Toggle QR Code... </summary><br /><br /><br /><br />_Use your smartphone camera to open QR code link._</details> |
---
<!-- [superset-docs-preview Preview](https://deploy-preview-38847--superset-docs-preview.netlify.app) -->
_To edit notification comments on pull requests, go to your [Netlify project configuration](https://app.netlify.com/projects/superset-docs-preview/configuration/notifications#deploy-notifications)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(reports): enforce server-side recipient on chart/dashboard report subscriptions [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #38847:
URL: https://github.com/apache/superset/pull/38847#issuecomment-4150204643
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
<details>
<summary>
Bito Usage Guide
</summary>
**Commands**
Type the following command in the pull request comment and save the comment.
- `/review` - Manually triggers a full AI review.
- `/pause` - Pauses automatic reviews on this pull request.
- `/resume` - Resumes automatic reviews.
- `/resolve` - Marks all Bito-posted review comments as resolved.
- `/abort` - Cancels all in-progress reviews.
Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
**Configuration**
This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
**Documentation & Help**
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(reports): validate email recipient addresses at schema layer [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #38847:
URL: https://github.com/apache/superset/pull/38847#issuecomment-4126935021
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(reports): enforce server-side recipient on chart/dashboard report subscriptions [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas merged PR #38847:
URL: https://github.com/apache/superset/pull/38847
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(reports): enforce server-side recipient on chart/dashboard report subscriptions [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #38847:
URL: https://github.com/apache/superset/pull/38847#issuecomment-4505333445
**Bito Automatic Review Skipped – PR Already Merged**<br/><br/>Bito scheduled an automatic review for this pull request, but the review was skipped because this PR was merged before the review could be run.<br/>No action is needed if you didn't intend to review it. To get a review, you can type `/review` in a comment and save it
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org