You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "aminghadersohi (via GitHub)" <gi...@apache.org> on 2026/03/04 09:27:23 UTC
[PR] feat(mcp): add compile check to validate chart queries before returning [superset]
aminghadersohi opened a new pull request, #38392:
URL: https://github.com/apache/superset/pull/38392
### SUMMARY
When generating a chart via MCP, the tool previously returned a chart URL without verifying
that the underlying query actually executes successfully. This meant users could receive
links to broken charts that fail to render.
This PR adds a compile check step that runs a lightweight test query (row_limit=2) via
`QueryContextFactory` + `ChartDataCommand` after chart generation. If the query fails,
a structured error response is returned instead of a broken chart link.
**Behavior:**
- **Saved charts** (`save_chart=True`): If compile check fails, the chart is deleted from
the database and an error is returned — no broken charts are left behind
- **Preview-only mode** (`save_chart=False`): If compile check fails, an error is returned
with details about what went wrong
- **Success path**: Compile warnings (if any) are included in the response
The `_compile_chart()` helper catches `ChartDataQueryFailedError`, `ChartDataCacheLoadError`,
`CommandException`, `ValueError`, and `KeyError` — returning a `CompileResult` dataclass
with success status, error message, warnings, and row count.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
N/A — backend-only change, no UI modifications.
### TESTING INSTRUCTIONS
1. Run the unit tests:
```bash
pytest tests/unit_tests/mcp_service/chart/tool/test_generate_chart.py -v
```
2. Verify all 14 tests pass (10 existing + 4 new compile check tests)
3. The new `TestCompileChart` class covers:
- Successful compile with row count verification
- Query errors embedded in result payload
- `ChartDataQueryFailedError` exceptions
- `ValueError` from invalid configuration
### ADDITIONAL INFORMATION
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [x] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(mcp): add compile check to validate chart queries before returning [superset]
Posted by "aminghadersohi (via GitHub)" <gi...@apache.org>.
aminghadersohi commented on code in PR #38392:
URL: https://github.com/apache/superset/pull/38392#discussion_r2882836060
##########
superset/mcp_service/chart/tool/generate_chart.py:
##########
@@ -384,6 +509,67 @@ async def generate_chart( # noqa: C901
if form_data_key_list:
form_data_key = form_data_key_list[0]
+ # Compile check for preview-only mode
+ await ctx.report_progress(3, 5, "Running compile check (test query)")
+ numeric_dataset_id: int | None = None
+ if isinstance(request.dataset_id, int):
+ numeric_dataset_id = request.dataset_id
+ elif isinstance(request.dataset_id, str) and request.dataset_id.isdigit():
+ numeric_dataset_id = int(request.dataset_id)
+ else:
+ from superset.daos.dataset import DatasetDAO
+
+ ds = DatasetDAO.find_by_id(request.dataset_id, id_column="uuid")
+ if ds:
+ numeric_dataset_id = ds.id
Review Comment:
Good catch — added has_dataset_access(ds) check in the preview compile path UUID lookup (b69ec08). The save path already had this validation; the preview path was missing it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(mcp): add compile check to validate chart queries before returning [superset]
Posted by "aminghadersohi (via GitHub)" <gi...@apache.org>.
aminghadersohi closed pull request #38392: feat(mcp): add compile check to validate chart queries before returning
URL: https://github.com/apache/superset/pull/38392
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(mcp): add compile check to validate chart queries before returning [superset]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #38392:
URL: https://github.com/apache/superset/pull/38392#issuecomment-3996325089
## [Codecov](https://app.codecov.io/gh/apache/superset/pull/38392?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 54.60%. Comparing base ([`983b633`](https://app.codecov.io/gh/apache/superset/commit/983b633972fde332921f63f28d04f8975f14459f?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`a570d28`](https://app.codecov.io/gh/apache/superset/commit/a570d2873d99d97ec4b3b4a914e42a15e1675a53?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
:x: Your project check has failed because the head coverage (96.03%) is below the target coverage (100.00%). You can increase the head coverage or adjust the [target](https://docs.codecov.com/docs/commit-status#target) coverage.
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## master #38392 +/- ##
==========================================
- Coverage 64.30% 54.60% -9.71%
==========================================
Files 1811 2484 +673
Lines 71557 123408 +51851
Branches 22810 28683 +5873
==========================================
+ Hits 46015 67387 +21372
- Misses 25542 55706 +30164
- Partials 0 315 +315
```
| [Flag](https://app.codecov.io/gh/apache/superset/pull/38392/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [hive](https://app.codecov.io/gh/apache/superset/pull/38392/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `41.11% <ø> (?)` | |
| [presto](https://app.codecov.io/gh/apache/superset/pull/38392/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `41.13% <ø> (?)` | |
| [python](https://app.codecov.io/gh/apache/superset/pull/38392/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `41.21% <ø> (?)` | |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>
[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/apache/superset/pull/38392?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(mcp): add compile check to validate chart queries before returning [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #38392:
URL: https://github.com/apache/superset/pull/38392#issuecomment-3996304331
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(mcp): add compile check to validate chart queries before returning [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on code in PR #38392:
URL: https://github.com/apache/superset/pull/38392#discussion_r2882811826
##########
superset/mcp_service/chart/tool/generate_chart.py:
##########
@@ -384,6 +509,67 @@ async def generate_chart( # noqa: C901
if form_data_key_list:
form_data_key = form_data_key_list[0]
+ # Compile check for preview-only mode
+ await ctx.report_progress(3, 5, "Running compile check (test query)")
+ numeric_dataset_id: int | None = None
+ if isinstance(request.dataset_id, int):
+ numeric_dataset_id = request.dataset_id
+ elif isinstance(request.dataset_id, str) and request.dataset_id.isdigit():
+ numeric_dataset_id = int(request.dataset_id)
+ else:
+ from superset.daos.dataset import DatasetDAO
+
+ ds = DatasetDAO.find_by_id(request.dataset_id, id_column="uuid")
+ if ds:
+ numeric_dataset_id = ds.id
Review Comment:
<div>
<div id="suggestion">
<div id="issue"><b>Security: Missing permission check in preview compile</b></div>
<div id="fix">
The preview compile check fetches datasets without permission validation, unlike the save_chart path. This could allow users to probe compilation of inaccessible datasets via UUID. Add has_dataset_access checks after dataset lookup to prevent unauthorized information disclosure.
</div>
</div>
<details>
<summary><b>Citations</b></summary>
<ul>
<li>
Rule Violated: <a href="https://github.com/apache/superset/blob/a570d28/superset/mcp_service/CLAUDE.md#L202">CLAUDE.md:202</a>
</li>
</ul>
</details>
<small><i>Code Review Run #146e02</i></small>
</div>
---
Should Bito avoid suggestions like this for future reviews? (<a href=https://alpha.bito.ai/home/ai-agents/review-rules>Manage Rules</a>)
- [ ] Yes, avoid them
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(mcp): add compile check to validate chart queries before returning [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on code in PR #38392:
URL: https://github.com/apache/superset/pull/38392#discussion_r2882842086
##########
superset/mcp_service/chart/tool/generate_chart.py:
##########
@@ -384,6 +509,67 @@ async def generate_chart( # noqa: C901
if form_data_key_list:
form_data_key = form_data_key_list[0]
+ # Compile check for preview-only mode
+ await ctx.report_progress(3, 5, "Running compile check (test query)")
+ numeric_dataset_id: int | None = None
+ if isinstance(request.dataset_id, int):
+ numeric_dataset_id = request.dataset_id
+ elif isinstance(request.dataset_id, str) and request.dataset_id.isdigit():
+ numeric_dataset_id = int(request.dataset_id)
+ else:
+ from superset.daos.dataset import DatasetDAO
+
+ ds = DatasetDAO.find_by_id(request.dataset_id, id_column="uuid")
+ if ds:
+ numeric_dataset_id = ds.id
Review Comment:
<!-- Bito Reply -->
Yes, adding the `has_dataset_access(ds)` check in the preview compile path UUID lookup addresses the security issue by preventing unauthorized access to dataset compilation, matching the validation already in the save path.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(mcp): add compile check to validate chart queries before returning [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #38392:
URL: https://github.com/apache/superset/pull/38392#issuecomment-3996763815
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
<details>
<summary>
Bito Usage Guide
</summary>
**Commands**
Type the following command in the pull request comment and save the comment.
- `/review` - Manually triggers a full AI review.
- `/pause` - Pauses automatic reviews on this pull request.
- `/resume` - Resumes automatic reviews.
- `/resolve` - Marks all Bito-posted review comments as resolved.
- `/abort` - Cancels all in-progress reviews.
Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
**Configuration**
This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
**Documentation & Help**
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(mcp): add compile check to validate chart queries before returning [superset]
Posted by "aminghadersohi (via GitHub)" <gi...@apache.org>.
aminghadersohi commented on PR #38392:
URL: https://github.com/apache/superset/pull/38392#issuecomment-3999654984
Reopening with a clean branch name.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org