sadpandajoe commented on code in PR #43389:
URL: https://github.com/apache/superset/pull/43389#discussion_r3832974261
##########
superset/commands/semantic_layer/create.py:
##########
@@ -92,9 +95,15 @@ def run(self) -> Model:
def validate(self) -> None:
layer_uuid: str = self._properties.get("semantic_layer_uuid", "")
- if not SemanticLayerDAO.find_by_uuid(layer_uuid):
+ layer = SemanticLayerDAO.find_by_uuid(layer_uuid)
+ if not layer:
raise SemanticLayerNotFoundError()
+ try:
+ security_manager.raise_for_editorship(layer)
Review Comment:
`SemanticLayer` has no `editors` relationship, and the create path does not
assign an editor subject. With the default extra-editor resolver, this check
therefore rejects every non-admin—even one granted the existing write
permission—when they try to add a semantic view to a layer. Should this use the
semantic-layer access/ownership policy (or persist editors) instead of generic
editorship?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
