You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@superset.apache.org by ru...@apache.org on 2026/06/13 08:07:53 UTC
(superset) branch tdd/issue-32768-guest-time-grain updated (9e7e1ecdbc3 -> d355e82d8e0)
This is an automated email from the ASF dual-hosted git repository.
rusackas pushed a change to branch tdd/issue-32768-guest-time-grain
in repository https://gitbox.apache.org/repos/asf/superset.git
omit 9e7e1ecdbc3 chore(deps): bump ioredis from 5.11.0 to 5.11.1 in /superset-websocket (#40989)
new d355e82d8e0 chore(deps): bump ioredis from 5.11.0 to 5.11.1 in /superset-websocket (#40989)
This update added new revisions after undoing existing revisions.
That is to say, some revisions that were in the old version of the
branch are not in the new version. This situation occurs
when a user --force pushes a change and generates a repository
containing something like this:
* -- * -- B -- O -- O -- O (9e7e1ecdbc3)
\
N -- N -- N refs/heads/tdd/issue-32768-guest-time-grain (d355e82d8e0)
You should already have received notification emails for all of the O
revisions, and so the following emails describe only the N revisions
from the common base, B.
Any revisions marked "omit" are not gone; other references still
refer to them. Any revisions marked "discard" are gone forever.
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
tests/unit_tests/security/manager_test.py | 69 +++++++++++++++++++++++++++++++
1 file changed, 69 insertions(+)
(superset) 01/01: chore(deps): bump ioredis from 5.11.0 to 5.11.1 in /superset-websocket (#40989)
Posted by ru...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rusackas pushed a commit to branch tdd/issue-32768-guest-time-grain
in repository https://gitbox.apache.org/repos/asf/superset.git
commit d355e82d8e0930ebe9f8b4980fb350442c0d5a9f
Author: dependabot[bot] <49...@users.noreply.github.com>
AuthorDate: Fri Jun 12 11:14:22 2026 -0700
chore(deps): bump ioredis from 5.11.0 to 5.11.1 in /superset-websocket (#40989)
Signed-off-by: dependabot[bot] <su...@github.com>
Co-authored-by: dependabot[bot] <49...@users.noreply.github.com>
---
superset-websocket/package-lock.json | 14 +++----
superset-websocket/package.json | 2 +-
tests/unit_tests/security/manager_test.py | 69 +++++++++++++++++++++++++++++++
3 files changed, 77 insertions(+), 8 deletions(-)
diff --git a/superset-websocket/package-lock.json b/superset-websocket/package-lock.json
index 9c38820dce9..9bacc2034fe 100644
--- a/superset-websocket/package-lock.json
+++ b/superset-websocket/package-lock.json
@@ -11,7 +11,7 @@
"dependencies": {
"cookie": "^1.1.1",
"hot-shots": "^15.0.0",
- "ioredis": "^5.11.0",
+ "ioredis": "^5.11.1",
"jsonwebtoken": "^9.0.3",
"lodash": "^4.18.1",
"winston": "^3.19.0",
@@ -3545,9 +3545,9 @@
"integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
},
"node_modules/ioredis": {
- "version": "5.11.0",
- "resolved": "https://registry.npmjs.org/ioredis/-/ioredis-5.11.0.tgz",
- "integrity": "sha512-EZBErytyVovD8f6pDfG3Kb37N6Y3lmDA9NNj+4+IP13CzzHGeX+OyeRM2Um13khRzoBSzzL+5lVnCX8V2RLeMg==",
+ "version": "5.11.1",
+ "resolved": "https://registry.npmjs.org/ioredis/-/ioredis-5.11.1.tgz",
+ "integrity": "sha512-ehuGcf94bQXhfagULNXrJdfnWO38v070jxSx/qE87Kjzmu2fU7ro5EFAb+OPituLqgfyuQaym5DlrNydW2sJ9A==",
"license": "MIT",
"dependencies": {
"@ioredis/commands": "1.10.0",
@@ -9077,9 +9077,9 @@
"integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="
},
"ioredis": {
- "version": "5.11.0",
- "resolved": "https://registry.npmjs.org/ioredis/-/ioredis-5.11.0.tgz",
- "integrity": "sha512-EZBErytyVovD8f6pDfG3Kb37N6Y3lmDA9NNj+4+IP13CzzHGeX+OyeRM2Um13khRzoBSzzL+5lVnCX8V2RLeMg==",
+ "version": "5.11.1",
+ "resolved": "https://registry.npmjs.org/ioredis/-/ioredis-5.11.1.tgz",
+ "integrity": "sha512-ehuGcf94bQXhfagULNXrJdfnWO38v070jxSx/qE87Kjzmu2fU7ro5EFAb+OPituLqgfyuQaym5DlrNydW2sJ9A==",
"requires": {
"@ioredis/commands": "1.10.0",
"cluster-key-slot": "1.1.1",
diff --git a/superset-websocket/package.json b/superset-websocket/package.json
index e3c0b12d310..d34a48dbcb2 100644
--- a/superset-websocket/package.json
+++ b/superset-websocket/package.json
@@ -19,7 +19,7 @@
"dependencies": {
"cookie": "^1.1.1",
"hot-shots": "^15.0.0",
- "ioredis": "^5.11.0",
+ "ioredis": "^5.11.1",
"jsonwebtoken": "^9.0.3",
"lodash": "^4.18.1",
"winston": "^3.19.0",
diff --git a/tests/unit_tests/security/manager_test.py b/tests/unit_tests/security/manager_test.py
index 1968bbc9d9b..238674c2618 100644
--- a/tests/unit_tests/security/manager_test.py
+++ b/tests/unit_tests/security/manager_test.py
@@ -1045,6 +1045,75 @@ def test_query_context_modified_orderby(mocker: MockerFixture) -> None:
assert query_context_modified(query_context)
+def test_query_context_modified_time_grain_native_filter(
+ mocker: MockerFixture,
+) -> None:
+ """
+ Test `query_context_modified` when a guest applies a Time Grain native filter.
+
+ Reproduces https://github.com/apache/superset/issues/32768.
+
+ On a chart that uses a generic x-axis, the selected time grain is baked into the
+ ``BASE_AXIS`` adhoc column as a ``timeGrain`` property (see
+ ``normalizeTimeColumn`` on the frontend, which copies ``extras.time_grain_sqla``
+ onto the column). A Time Grain native filter is a supported, read-only guest
+ interaction: it only changes the granularity at which the *same* dimension is
+ bucketed, never which metrics or columns are queried.
+
+ However, because the changed time grain travels inside the ``columns`` payload,
+ the subset comparison treats the request as tampering and
+ ``query_context_modified`` returns ``True`` -- so guests hit "Guest user cannot
+ modify chart payload" whenever they pick a grain other than the chart default.
+
+ This is a faithful, expected-RED test: it asserts the correct behavior (a pure
+ time-grain change is *not* a modification) and therefore fails against current
+ ``master`` until the guard ignores the ``timeGrain`` of a ``BASE_AXIS`` column.
+ """
+ # The chart was saved with a monthly grain on its x-axis column.
+ stored_axis_column: AdhocColumn = {
+ "label": "order_date",
+ "sqlExpression": "order_date",
+ "columnType": "BASE_AXIS",
+ "timeGrain": "P1M",
+ }
+ # The guest picked a daily grain via the dashboard Time Grain native filter;
+ # `normalizeTimeColumn` rewrote the otherwise-identical column accordingly.
+ requested_axis_column: AdhocColumn = {
+ **stored_axis_column,
+ "timeGrain": "P1D",
+ }
+
+ query_context = mocker.MagicMock()
+ query_context.slice_.id = 42
+ query_context.slice_.params_dict = {
+ "metrics": ["count"],
+ }
+ query_context.slice_.query_context = json.dumps(
+ {
+ "queries": [
+ {
+ "columns": [stored_axis_column],
+ "metrics": ["count"],
+ }
+ ],
+ }
+ )
+ # Native-filter data requests don't carry the mutated columns at the top level;
+ # the grain change only shows up inside the query's columns.
+ query_context.form_data = {
+ "slice_id": 42,
+ "metrics": ["count"],
+ }
+ query_context.queries = [
+ QueryObject(
+ columns=[requested_axis_column],
+ metrics=["count"],
+ ),
+ ]
+
+ assert not query_context_modified(query_context)
+
+
def test_get_catalog_perm() -> None:
"""
Test the `get_catalog_perm` method.