aminghadersohi opened a new pull request, #41606: URL: https://github.com/apache/superset/pull/41606
## Summary Follow-up to #40957 (`update_dashboard` MCP tool). During that review, `owners`, `roles`, `certified_by`, and `certification_details` were scoped out of `update_dashboard` because they're distinct governance concerns from layout/theme/metadata, and a full-replacement list has no safety guard (`owners=[]` could silently orphan a dashboard; `roles=[]`/partial lists could silently widen or narrow access). See discussion: https://github.com/apache/superset/pull/40957#discussion_r3414810238 This PR adds three dedicated tools instead, each with explicit add/remove (or set/clear) semantics: - **`manage_dashboard_owners`** — `add_owner_ids`/`remove_owner_ids`. Rejects removals that are not currently owners, and rejects any change that would leave the dashboard with zero owners. Surfaces a warning when a non-admin caller's self-removal is auto-reverted by `populate_owner_list`'s existing self-protection. - **`manage_dashboard_roles`** — `add_role_ids`/`remove_role_ids` for the DASHBOARD_RBAC access list. Reports `dashboard_rbac_enabled` and warns when the flag is off (roles are stored but inert). - **`manage_dashboard_certification`** — independent `certified_by`/`certification_details` fields; `None` leaves a field unchanged, `""` clears it, mirroring the `slug`/`css` clear-with-empty-string convention already used by `update_dashboard`. `theme_id`/`color_scheme` remain out of scope, per the original discussion — there's no `list_themes`/`get_theme_info` discovery tool yet, so a caller could only guess an ID. All three tools are RBAC-gated the same way as `update_dashboard` (`class_permission_name="Dashboard"`, `method_permission_name="write"`, `security_manager.raise_for_ownership`). Since their responses disclose current owners/roles, `app.py`'s server instructions were updated with a narrow carve-out (mirroring the existing `find_users` carve-out): that data may only be used to confirm the operation the caller explicitly requested on that specific dashboard, not to answer general "who owns/can access X" questions. ## Test plan - [x] `pytest tests/unit_tests/mcp_service/dashboard/` — 288 passed (26 new + all existing dashboard MCP tests, no regressions) - [x] `pre-commit run` on changed files (mypy, ruff, ruff-format, pylint, auto-walrus) — all passed - [x] New tools registered in `dashboard/tool/__init__.py` and imported in `app.py` - [x] Manual review of `DEFAULT_INSTRUCTIONS` tool listing and write-tool/privacy bullets for accuracy -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
