You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "durgaprasadml (via GitHub)" <gi...@apache.org> on 2026/07/27 13:15:11 UTC
[PR] fix(sqllab): allow SQL Lab query owners to create charts without all_datasource_access [superset]
durgaprasadml opened a new pull request, #42479:
URL: https://github.com/apache/superset/pull/42479
### SUMMARY
Fixes an authorization issue that prevents non-admin users from creating charts from SQL Lab.
Previously, users with `database_access` and SQL Lab permissions but without `all_datasource_access` were denied access when clicking **Create chart**, resulting in a backend authorization error and a frontend navigation failure.
This change updates the ownership check for SQL Lab query resources so that models using `user_id` (such as `Query` and `SavedQuery`) are recognized as owned by their creator during authorization.
### BEFORE/AFTER
**Before**
- Non-admin users receive a 403 error when clicking **Create chart**.
- Explore fails to open because no valid dataset/form data is returned.
**After**
- Authorized SQL Lab users can successfully create charts from their own queries.
- Existing RBAC checks for unauthorized users remain unchanged.
### TESTING INSTRUCTIONS
1. Create a Gamma user with `sql_lab` and `database_access`.
2. Run a query in SQL Lab.
3. Click **Create chart**.
4. Verify that Explore opens successfully.
5. Verify that users without the required permissions are still denied access.
### ADDITIONAL INFORMATION
Fixes #42389
- [x] Has associated issue
- [ ] Changes UI
- [ ] Includes DB Migration
- [ ] Introduces new feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(sqllab): allow SQL Lab query owners to create charts without all_datasource_access [superset]
Posted by "codeant-ai-for-open-source[bot] (via GitHub)" <gi...@apache.org>.
codeant-ai-for-open-source[bot] commented on code in PR #42479:
URL: https://github.com/apache/superset/pull/42479#discussion_r3663781763
##########
superset-frontend/src/dashboard/components/gridComponents/Chart/Chart.tsx:
##########
@@ -320,11 +320,39 @@ const Chart = (props: ChartProps) => {
);
useLayoutEffect(() => {
- if (isExpanded && descriptionRef.current) {
- setDescriptionHeight(descriptionRef.current.offsetHeight);
- } else {
+ if (!isExpanded || !descriptionRef.current) {
setDescriptionHeight(0);
+ return undefined;
}
+
+ let isDescriptionHeightSet = false;
+ const initialHeight = descriptionRef.current.offsetHeight;
+ if (initialHeight > 0) {
+ setDescriptionHeight(initialHeight);
+ isDescriptionHeightSet = true;
+ }
+
+ if (typeof ResizeObserver !== 'undefined') {
+ const observer = new ResizeObserver(entries => {
+ for (const entry of entries) {
+ if (entry.target === descriptionRef.current) {
+ const height = (entry.target as HTMLElement).offsetHeight;
+ if (height > 0 || !isDescriptionHeightSet) {
+ setDescriptionHeight(height);
+ isDescriptionHeightSet = true;
+ }
+ }
+ }
+ });
+
+ observer.observe(descriptionRef.current);
+
+ return () => {
+ observer.disconnect();
+ };
+ }
+
+ return undefined;
}, [isExpanded]);
Review Comment:
**Suggestion:** The effect only reruns when `isExpanded` changes. If `slice.description_markdown` is removed while the chart remains expanded, the description element is unmounted but this effect does not run again, so the observer is not disconnected and `descriptionHeight` retains the old value. The chart then continues to subtract the height of a description that is no longer rendered. Include the description presence/content or the observed element identity in the lifecycle handling, and reset the height when the element disappears. [stale reference]
<details>
<summary><b>Severity Level:</b> Major ⚠️</summary>
```mdx
- ❌ Expanded charts retain space for removed descriptions.
- ⚠️ Chart rendering uses stale dimensions after slice updates.
- ⚠️ Detached description observers remain registered until unmount.
```
</details>
<details>
<summary><b>Steps of Reproduction ✅ </b></summary>
```mdx
1. Render a dashboard chart with `expandedSlices[props.id]` set to `true`;
`Chart.tsx:209-211` derives `isExpanded`, and `Chart.tsx:786-795` mounts the description
element when `slice.description_markdown` is truthy.
2. Allow the effect at `Chart.tsx:322-356` to measure the description and register a
`ResizeObserver`; the positive measurement is stored in `descriptionHeight` at
`Chart.tsx:329-343`.
3. Update the chart's slice entity so `description_markdown` becomes empty while
`isExpanded` remains true. Slice entities are replaced through `updateSlices()` at
`src/dashboard/actions/sliceEntities.ts:118-121`, and the fetched slice shape includes
`description_markdown` at `src/dashboard/actions/sliceEntities.ts:101-107`.
4. React removes the `<aside>` at `Chart.tsx:786-795`, but the effect does not rerun
because its dependency array only contains `isExpanded` at `Chart.tsx:356`; therefore its
cleanup does not disconnect the observer or reset `descriptionHeight`, and
`getChartHeight()` continues subtracting the stale value at `Chart.tsx:395-396`.
```
</details>
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=0b717162d00b4e329da63d679c99b838&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) [](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=0b717162d00b4e329da63d679c99b838&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
*(Use Cmd/Ctrl + Click for best experience)*
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** superset-frontend/src/dashboard/components/gridComponents/Chart/Chart.tsx
**Line:** 356:356
**Comment:**
*Stale Reference: The effect only reruns when `isExpanded` changes. If `slice.description_markdown` is removed while the chart remains expanded, the description element is unmounted but this effect does not run again, so the observer is not disconnected and `descriptionHeight` retains the old value. The chart then continues to subtract the height of a description that is no longer rendered. Include the description presence/content or the observed element identity in the lifecycle handling, and reset the height when the element disappears.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F42479&comment_hash=28b5f99bbb6ca7d3c367467dadeef288e6e214ca0beb21d85373a84ed28b0a04&reaction=like'>👍</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F42479&comment_hash=28b5f99bbb6ca7d3c367467dadeef288e6e214ca0beb21d85373a84ed28b0a04&reaction=dislike'>👎</a>
##########
superset/security/manager.py:
##########
@@ -4803,6 +4803,11 @@ def is_editor(self, resource: Model) -> bool:
editor_subject_ids = set(get_extra_editor_subject_ids(resource))
if hasattr(resource, "editors"):
editor_subject_ids.update(s.id for s in resource.editors)
+
+ # Fallback for models like Query and SavedQuery that use 'user_id'
+ if hasattr(resource, "user_id") and resource.user_id is not None:
+ editor_subject_ids.add(resource.user_id)
Review Comment:
**Suggestion:** The fallback adds an `ab_user.id` directly to a set of `Subject.id` values. These are separate primary-key namespaces, so an SQL Lab query owner will usually not match their own user subject and will still be denied editorship. Conversely, if a user's primary-key value happens to equal another user's, role's, or group's subject ID, this can grant editorship to the wrong principal. Resolve the `Subject` for `resource.user_id` and add its subject ID instead. [security]
<details>
<summary><b>Severity Level:</b> Critical 🚨</summary>
```mdx
- ❌ SQL Lab owners can still receive 403 errors when creating charts.
- ❌ Explore navigation can fail for authorized query creators.
- ⚠️ Subject-ID collisions can grant editorship to unrelated principals.
```
</details>
<details>
<summary><b>Steps of Reproduction ✅ </b></summary>
```mdx
1. Create a non-admin SQL Lab user and execute a query. The `Query` model stores the
creator's `ab_user.id` in `user_id` at `superset/models/sql_lab.py:39-49`; `SavedQuery`
does the same at `superset/models/sql_lab.py:37-40`.
2. Click SQL Lab's Create chart flow, which eventually performs resource ownership checks
through `SecurityManager.is_editor()` at `superset/security/manager.py:4778-4811`.
3. `is_editor()` obtains the current user's subject IDs using `get_user_subject_ids()` at
`superset/security/manager.py:4793-4794`. That helper returns `subjects.id` values at
`superset/subjects/utils.py:82-91`, including the user's USER subject selected through
`Subject.user_id` at `superset/subjects/utils.py:46`.
4. The new fallback instead inserts `resource.user_id` directly at
`superset/security/manager.py:4807-4809`. `Subject.id` is an independent primary key at
`superset/subjects/models.py:48`, while `Subject.user_id` separately references
`ab_user.id` at `superset/subjects/models.py:55-60`; therefore the creator's user ID
generally does not equal the creator's subject ID, so the intersection at
`superset/security/manager.py:4811` remains empty and the owner can still receive the
ownership denial.
5. If an `ab_user.id` happens to equal a subject ID belonging to another user, role, or
group, the same direct integer comparison can instead make that unrelated principal appear
to own the query. Resolve the USER subject by `Subject.user_id` (for example through
`get_user_subject(resource.user_id)`) and add its `Subject.id`.
```
</details>
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=546c18a30a744fa08037e860209f6eae&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) [](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=546c18a30a744fa08037e860209f6eae&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
*(Use Cmd/Ctrl + Click for best experience)*
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** superset/security/manager.py
**Line:** 4807:4809
**Comment:**
*Security: The fallback adds an `ab_user.id` directly to a set of `Subject.id` values. These are separate primary-key namespaces, so an SQL Lab query owner will usually not match their own user subject and will still be denied editorship. Conversely, if a user's primary-key value happens to equal another user's, role's, or group's subject ID, this can grant editorship to the wrong principal. Resolve the `Subject` for `resource.user_id` and add its subject ID instead.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F42479&comment_hash=be7083af2f2bc9084564afbf36aab9729a7cb288a73d12e8eb60856ffd78cfae&reaction=like'>👍</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F42479&comment_hash=be7083af2f2bc9084564afbf36aab9729a7cb288a73d12e8eb60856ffd78cfae&reaction=dislike'>👎</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(sqllab): allow SQL Lab query owners to create charts without all_datasource_access [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #42479:
URL: https://github.com/apache/superset/pull/42479#issuecomment-5091821524
<!-- Bito Reply -->
The flagged issue is correct. The current implementation in `Chart.tsx` only measures the description height once when `ResizeObserver` is unavailable, which fails to account for asynchronous content updates.
To resolve this, you can implement a `MutationObserver` as a fallback when `ResizeObserver` is not supported. This will monitor changes to the description element's subtree and trigger a re-measurement.
### Proposed Fix
```tsx
// ... inside useLayoutEffect
if (typeof ResizeObserver !== 'undefined') {
// ... existing ResizeObserver logic
} else if (typeof MutationObserver !== 'undefined' && descriptionRef.current) {
const observer = new MutationObserver(() => {
if (descriptionRef.current) {
setDescriptionHeight(descriptionRef.current.offsetHeight);
}
});
observer.observe(descriptionRef.current, { childList: true, subtree: true, characterData: true });
return () => observer.disconnect();
}
return undefined;
```
Would you like me to check the other comments on this PR and implement fixes for them as well?
**superset-frontend/src/dashboard/components/gridComponents/Chart/Chart.tsx**
```
if (typeof ResizeObserver !== 'undefined') {
const observer = new ResizeObserver(entries => {
for (const entry of entries) {
if (entry.target === descriptionRef.current) {
const height = (entry.target as HTMLElement).offsetHeight;
if (height > 0 || !isDescriptionHeightSet) {
setDescriptionHeight(height);
isDescriptionHeightSet = true;
}
}
}
});
observer.observe(descriptionRef.current);
return () => {
observer.disconnect();
};
} else if (typeof MutationObserver !== 'undefined' && descriptionRef.current) {
const observer = new MutationObserver(() => {
if (descriptionRef.current) {
setDescriptionHeight(descriptionRef.current.offsetHeight);
}
});
observer.observe(descriptionRef.current, { childList: true, subtree: true, characterData: true });
return () => observer.disconnect();
}
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(sqllab): allow SQL Lab query owners to create charts without all_datasource_access [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #42479:
URL: https://github.com/apache/superset/pull/42479#issuecomment-5404162579
**Bito Automatic Review Skipped – PR Already Merged**<br/><br/>Bito scheduled an automatic review for this pull request, but the review was skipped because this PR was merged before the review could be run.<br/>No action is needed if you didn't intend to review it. To get a review, you can type `/review` in a comment and save it
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(sqllab): allow SQL Lab query owners to create charts without all_datasource_access [superset]
Posted by "netlify[bot] (via GitHub)" <gi...@apache.org>.
netlify[bot] commented on PR #42479:
URL: https://github.com/apache/superset/pull/42479#issuecomment-5091797246
### <span aria-hidden="true">✅</span> Deploy Preview for *superset-docs-preview* ready!
| Name | Link |
|:-:|------------------------|
|<span aria-hidden="true">🔨</span> Latest commit | fbc268985b560b280e768d143da04c15a21c3cb2 |
|<span aria-hidden="true">🔍</span> Latest deploy log | https://app.netlify.com/projects/superset-docs-preview/deploys/6a6759dff1e1df00098d205b |
|<span aria-hidden="true">😎</span> Deploy Preview | [https://deploy-preview-42479--superset-docs-preview.netlify.app](https://deploy-preview-42479--superset-docs-preview.netlify.app) |
|<span aria-hidden="true">📱</span> Preview on mobile | <details><summary> Toggle QR Code... </summary><br /><br /><br /><br />_Use your smartphone camera to open QR code link._</details> |
|<span aria-hidden="true">🤖</span> Make changes | [Run an agent on this branch](https://app.netlify.com/projects/superset-docs-preview/agent-runs#DcpBCoAgEADAv-y5BbOs7Ac9Y3WVAisziSL6e97mMC_EtK8xwwhQgUm02bnYLzeeR8BABm1ylB3amVLGVjaDxkuWzC6G_Zm49I66Xmn2vnY1eyGEHlgKZeD7AQ) |
---
<!-- [superset-docs-preview Preview](https://deploy-preview-42479--superset-docs-preview.netlify.app) -->
_To edit notification comments on pull requests, go to your [Netlify project configuration](https://app.netlify.com/projects/superset-docs-preview/configuration/notifications#deploy-notifications)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(sqllab): allow SQL Lab query owners to create charts without all_datasource_access [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #42479:
URL: https://github.com/apache/superset/pull/42479#issuecomment-5091775941
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(sqllab): allow SQL Lab query owners to create charts without all_datasource_access [superset]
Posted by "codeant-ai-for-open-source[bot] (via GitHub)" <gi...@apache.org>.
codeant-ai-for-open-source[bot] commented on code in PR #42479:
URL: https://github.com/apache/superset/pull/42479#discussion_r3657470773
##########
superset-frontend/src/dashboard/components/gridComponents/Chart/Chart.tsx:
##########
@@ -320,11 +320,39 @@ const Chart = (props: ChartProps) => {
);
useLayoutEffect(() => {
- if (isExpanded && descriptionRef.current) {
- setDescriptionHeight(descriptionRef.current.offsetHeight);
- } else {
+ if (!isExpanded || !descriptionRef.current) {
setDescriptionHeight(0);
+ return undefined;
}
+
+ let isDescriptionHeightSet = false;
+ const initialHeight = descriptionRef.current.offsetHeight;
+ if (initialHeight > 0) {
+ setDescriptionHeight(initialHeight);
+ isDescriptionHeightSet = true;
+ }
+
+ if (typeof ResizeObserver !== 'undefined') {
+ const observer = new ResizeObserver(entries => {
+ for (const entry of entries) {
+ if (entry.target === descriptionRef.current) {
+ const height = (entry.target as HTMLElement).offsetHeight;
+ if (height > 0 || !isDescriptionHeightSet) {
+ setDescriptionHeight(height);
+ isDescriptionHeightSet = true;
+ }
+ }
+ }
+ });
+
+ observer.observe(descriptionRef.current);
+
+ return () => {
+ observer.disconnect();
+ };
+ }
+
+ return undefined;
Review Comment:
**Suggestion:** When `ResizeObserver` is unavailable, this effect only measures `offsetHeight` once. If the markdown description renders asynchronously afterward, `descriptionHeight` remains stale and the chart can be clipped or allocated the wrong height. Provide a fallback measurement/update mechanism or require the observer support used by this component. [possible bug]
<details>
<summary><b>Severity Level:</b> Major ⚠️</summary>
```mdx
- ⚠️ Expanded dashboard chart height can become stale.
- ❌ Delayed descriptions may be clipped or leave excess space.
- ⚠️ Jest environments without ResizeObserver cannot detect this regression.
```
</details>
<details>
<summary><b>Steps of Reproduction ✅ </b></summary>
```mdx
1. Render an expanded dashboard chart through `Chart` in
`superset-frontend/src/dashboard/components/gridComponents/Chart/Chart.tsx`, with
`isExpanded` true so the effect at lines 322-356 runs.
2. Use a browser or test environment where `ResizeObserver` is undefined; the effect
therefore skips the observer branch at lines 335-353.
3. The effect measures `descriptionRef.current.offsetHeight` once at line 329, before
delayed markdown content changes the description element's height.
4. After the description renders additional content, no callback or fallback measurement
runs because lines 355-356 return without scheduling an update; `descriptionHeight`
remains stale and the chart height calculation uses the old value.
```
</details>
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=6afff0ee0fe1445dba467b5f0dd3dbf5&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) [](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=6afff0ee0fe1445dba467b5f0dd3dbf5&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
*(Use Cmd/Ctrl + Click for best experience)*
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** superset-frontend/src/dashboard/components/gridComponents/Chart/Chart.tsx
**Line:** 335:355
**Comment:**
*Possible Bug: When `ResizeObserver` is unavailable, this effect only measures `offsetHeight` once. If the markdown description renders asynchronously afterward, `descriptionHeight` remains stale and the chart can be clipped or allocated the wrong height. Provide a fallback measurement/update mechanism or require the observer support used by this component.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F42479&comment_hash=152d7b1ac738c8df8a2a86d19aaf7d502fff3508f51442436cfd67813c635391&reaction=like'>👍</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F42479&comment_hash=152d7b1ac738c8df8a2a86d19aaf7d502fff3508f51442436cfd67813c635391&reaction=dislike'>👎</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(sqllab): allow SQL Lab query owners to create charts without all_datasource_access [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #42479:
URL: https://github.com/apache/superset/pull/42479#issuecomment-5221520001
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
<details>
<summary>
Bito Usage Guide
</summary>
**Commands**
Type the following command in the pull request comment and save the comment.
- `/review` - Manually triggers a full AI review.
- `/pause` - Pauses automatic reviews on this pull request.
- `/resume` - Resumes automatic reviews.
- `/resolve` - Marks all Bito-posted review comments as resolved.
- `/abort` - Cancels all in-progress reviews.
Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
**Configuration**
This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
**Documentation & Help**
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(sqllab): allow SQL Lab query owners to create charts without all_datasource_access [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #42479:
URL: https://github.com/apache/superset/pull/42479#issuecomment-5226538412
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
<details>
<summary>
Bito Usage Guide
</summary>
**Commands**
Type the following command in the pull request comment and save the comment.
- `/review` - Manually triggers a full AI review.
- `/pause` - Pauses automatic reviews on this pull request.
- `/resume` - Resumes automatic reviews.
- `/resolve` - Marks all Bito-posted review comments as resolved.
- `/abort` - Cancels all in-progress reviews.
Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
**Configuration**
This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
**Documentation & Help**
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(sqllab): allow SQL Lab query owners to create charts without all_datasource_access [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on PR #42479:
URL: https://github.com/apache/superset/pull/42479#issuecomment-5246499959
@sha174n I think this covers both your asks now. The `is_editor` fallback is scoped to `Query`/`SavedQuery` with an isinstance check, and there are backend tests for the owner grant plus a `TabState` case showing other `user_id` models don't get editorship. Frontend resize changes got split out too. Mind taking another look and clearing your review if it looks good?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(sqllab): allow SQL Lab query owners to create charts without all_datasource_access [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas merged PR #42479:
URL: https://github.com/apache/superset/pull/42479
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(sqllab): allow SQL Lab query owners to create charts without all_datasource_access [superset]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #42479:
URL: https://github.com/apache/superset/pull/42479#issuecomment-5091834842
## [Codecov](https://app.codecov.io/gh/apache/superset/pull/42479?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:x: Patch coverage is `0%` with `2 lines` in your changes missing coverage. Please review.
:white_check_mark: Project coverage is 56.03%. Comparing base ([`6856d0f`](https://app.codecov.io/gh/apache/superset/commit/6856d0fc671dda62f4f305212b66e1bef8e8203e?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`fbc2689`](https://app.codecov.io/gh/apache/superset/commit/fbc268985b560b280e768d143da04c15a21c3cb2?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
| [Files with missing lines](https://app.codecov.io/gh/apache/superset/pull/42479?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Patch % | Lines |
|---|---|---|
| [superset/security/manager.py](https://app.codecov.io/gh/apache/superset/pull/42479?src=pr&el=tree&filepath=superset%2Fsecurity%2Fmanager.py&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-c3VwZXJzZXQvc2VjdXJpdHkvbWFuYWdlci5weQ==) | 0.00% | [2 Missing :warning: ](https://app.codecov.io/gh/apache/superset/pull/42479?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
> :exclamation: There is a different number of reports uploaded between BASE (6856d0f) and HEAD (fbc2689). Click for more details.
>
> <details><summary>HEAD has 104 uploads less than BASE</summary>
>
>| Flag | BASE (6856d0f) | HEAD (fbc2689) |
>|------|------|------|
>|hive|13|1|
>|python|81|2|
>|presto|14|1|
></details>
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## master #42479 +/- ##
==========================================
- Coverage 65.25% 56.03% -9.22%
==========================================
Files 2795 2795
Lines 157639 157638 -1
Branches 36052 36051 -1
==========================================
- Hits 102869 88339 -14530
- Misses 52793 68474 +15681
+ Partials 1977 825 -1152
```
| [Flag](https://app.codecov.io/gh/apache/superset/pull/42479/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [hive](https://app.codecov.io/gh/apache/superset/pull/42479/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `38.38% <0.00%> (-0.01%)` | :arrow_down: |
| [mysql](https://app.codecov.io/gh/apache/superset/pull/42479/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [postgres](https://app.codecov.io/gh/apache/superset/pull/42479/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [presto](https://app.codecov.io/gh/apache/superset/pull/42479/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `40.30% <0.00%> (-0.01%)` | :arrow_down: |
| [python](https://app.codecov.io/gh/apache/superset/pull/42479/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `40.35% <0.00%> (-18.65%)` | :arrow_down: |
| [sqlite](https://app.codecov.io/gh/apache/superset/pull/42479/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [unit](https://app.codecov.io/gh/apache/superset/pull/42479/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>
[:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/apache/superset/pull/42479?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(sqllab): allow SQL Lab query owners to create charts without all_datasource_access [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #42479:
URL: https://github.com/apache/superset/pull/42479#issuecomment-5103183920
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
<details>
<summary>
Bito Usage Guide
</summary>
**Commands**
Type the following command in the pull request comment and save the comment.
- `/review` - Manually triggers a full AI review.
- `/pause` - Pauses automatic reviews on this pull request.
- `/resume` - Resumes automatic reviews.
- `/resolve` - Marks all Bito-posted review comments as resolved.
- `/abort` - Cancels all in-progress reviews.
Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
**Configuration**
This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
**Documentation & Help**
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org