rusackas opened a new pull request, #42737: URL: https://github.com/apache/superset/pull/42737
### SUMMARY Regression/TDD test for #38884: an Alpha user with `can write on Chart` (but no ownership or editor rights on a specific chart) can open the "Edit chart properties" modal for a chart they don't own, only to have the save silently rejected server-side (`UpdateChartCommand` correctly enforces ownership). The root cause is a missing frontend gate: `useExploreAdditionalActionsMenu` pushes the "Edit chart properties" menu item whenever a `slice` exists, with no check against the current user's ownership/editor rights. `ExploreChartHeader`'s own title-edit affordance already gates on the equivalent `editors`/`user_subjects` check (see `canEdit` in `ExploreChartHeader/index.tsx`), so the same signal is available, just not applied to this menu item. This PR adds a test only, no production code change — it's currently **red**, documenting the bug rather than fixing it. ### TESTING INSTRUCTIONS ``` cd superset-frontend npx jest src/explore/components/useExploreAdditionalActionsMenu/useExploreAdditionalActionsMenu.test.tsx -t "regression #38884" ``` Currently fails: the "Edit chart properties" menu item renders even when the slice's `editors` list doesn't include the current user. ### ADDITIONAL INFORMATION - [x] Has associated issue: #38884 - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
