endimonan opened a new pull request, #43006:
URL: https://github.com/apache/superset/pull/43006
### SUMMARY
Fixes #34904. A Gamma user can create a chart but has no `can_read` on
`Annotation` (intentional since #24826), so when they picked the "Superset
annotation" source in the annotation layer popover, the layer dropdown fetched
`/api/v1/annotation_layer/`, got a 403 and rendered a raw "Forbidden" message
as if it were content.
This hides the "Superset annotation" option from the annotation source
select when the user doesn't hold the permission, which is the same approach
#34293 took for the "View in SQL Lab" button in the same directory. The
permission is computed in the connected control via `findPermission('can_read',
'Annotation', user.roles)`, mirroring the API gate, and passed down as a prop.
`mapStateToProps` is exported so the permission wiring itself is unit tested,
since a missing state prop would silently fall through to untyped ownProps and
hide the option for everyone.
One special case: a chart may already have a saved native annotation layer,
and those keep rendering for viewers today. For that case the source option
stays visible so the saved configuration isn't invalidated, but the layer
selector renders disabled with "You don't have permission to view annotation
layers." and the known-forbidden requests (the listing and the fetch by id) are
never fired. The user can still remove the layer, tweak its display settings or
switch it to a chart-based source, and re-applying preserves the saved
reference as is. Once switched away, the native option is gone.
Formula and chart-based annotation sources don't touch the annotation API
and are unaffected. The fetch of the applied native layer also gains a catch
handler, it used to be an unhandled promise rejection.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
Before (from the issue, Gamma user):
<img width="868" alt="before"
src="https://github.com/user-attachments/assets/57d23c08-5bd8-438d-aaf0-c6cb58d7371c";
/>
After: the "Superset annotation" option is not offered to users without the
permission (screenshot coming shortly).
### TESTING INSTRUCTIONS
As a Gamma user (no `can_read` on `Annotation`), open a line chart in
Explore, add an annotation layer of type Event or Interval and open the
"Annotation source" select: "Superset annotation" should not be listed, while
chart sources and Formula keep working. As Admin, the option is still there. To
check the preserved case, have an Admin save a chart with a native annotation
layer, then open it as Gamma: the layer still renders on the chart, and in the
popover the source shows "Superset annotation" with the layer selector disabled
and a permission note instead of the old Forbidden error.
### ADDITIONAL INFORMATION
- [x] Has associated issue: Fixes #34904
- [ ] Required feature flags:
- [x] Changes UI
- [ ] Includes DB Migration (follow approval process in
[SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
