FrancescoCastaldi opened a new pull request, #43564: URL: https://github.com/apache/superset/pull/43564
### SUMMARY Fixes #43257 In \DashboardFilterStateRestApi\, \@has_access_api\ and \@api\ decorators were erroneously present on \post()\ and \put()\ endpoints. Because \DashboardFilterStateRestApi\ inherits from \TemporaryCacheRestApi\, endpoint access control and permissions are managed at the command level (verifying access to the underlying dashboard resource via \CheckAccessDataCommand\). The presence of \@has_access_api\ caused standard users and API clients to receive \401 Unauthorized\ on \POST\ and \PUT\ requests when creating or updating filter state in dashboards, as \can_post\ / \can_put\ permissions for \DashboardFilterStateRestApi\ are not registered in FAB's role manager. This PR removes \@has_access_api\ and \@api\ from \post()\ and \put()\, aligning them with \get()\ and \delete()\ in the same API as well as \FormDataRestApi\. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF N/A (Backend REST API fix) ### TESTING INSTRUCTIONS 1. Open a dashboard with native filters as an authenticated user. 2. Apply or update a filter state (\POST /api/v1/dashboard/<pk>/filter_state\ or \PUT /api/v1/dashboard/<pk>/filter_state/<key>\). 3. Verify that the request succeeds (returns HTTP 200/201) without returning 401 Unauthorized. ### ADDITIONAL INFORMATION - [x] Has associated issue: Fixes #43257 - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
