sha174n opened a new pull request, #42716: URL: https://github.com/apache/superset/pull/42716
The dashboard datasets endpoint already narrows a member dataset's serialized payload when the caller cannot access that datasource on its own (`_serialize_dashboard_dataset`). This PR applies that same treatment consistently to the other places where a dashboard's members are serialized, so the three member-serialization paths behave the same way. - **`GET /<id>/datasets`**: extend the existing narrowing to the remaining schema/connection-describing fields (`database`, column definitions, `verbose_map`, `perm`/`edit_url`, ordering and grain choices), matching the treatment already applied to guest users in `DashboardDatasetSchema.post_dump`. Identifying fields (`id`, `table_name`, `schema`, `name`) are unchanged. - **`GET /<id>/charts`**: add `_serialize_dashboard_chart`, which includes the chart configuration payload (`form_data`) only for charts the caller can access, using the existing `security_manager.can_access_chart` helper. The chart's identifying fields are always included so the response shape is unchanged for existing clients. - **`GET /<id>`**: the `charts` name list now reflects only the member charts the caller can access. **Design note:** field-narrowing over omitting members. Every member is still present with the same shape and keys; only fields that require per-object access are conditionally included. This keeps dashboard rendering working for legitimate viewers and is consistent with the guest-user and existing dataset behavior, rather than introducing wholesale omission that could break clients that iterate over members. Tests added to `tests/integration_tests/dashboards/api_tests.py` cover a caller with access to only one member getting the config payload for that member and only the identifying fields for the rest, across both the charts endpoint and the dashboard-level charts list. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
