sadpandajoe commented on code in PR #42404: URL: https://github.com/apache/superset/pull/42404#discussion_r3869088009
########## superset/commands/theme/create.py: ########## @@ -0,0 +1,62 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +import logging +from functools import partial +from typing import Any + +from marshmallow import ValidationError + +from superset.commands.base import BaseCommand, CreateMixin +from superset.commands.theme.exceptions import ( + ThemeCreateFailedError, + ThemeInvalidError, +) +from superset.commands.utils import populate_subjects +from superset.daos.theme import ThemeDAO +from superset.models.core import Theme +from superset.utils.decorators import on_error, transaction + +logger = logging.getLogger(__name__) + + +class CreateThemeCommand(CreateMixin, BaseCommand): + def __init__(self, data: dict[str, Any]): + self._properties = data.copy() + + @transaction(on_error=partial(on_error, reraise=ThemeCreateFailedError)) + def run(self) -> Theme: + self.validate() + # User-created themes are never system themes. + self._properties["is_system"] = False + return ThemeDAO.create(attributes=self._properties) + + def _populate_subjects(self, exceptions: list[ValidationError]) -> None: Review Comment: This editor seeding only protects the REST create path. The existing FastMCP `create_theme` tool still calls `ThemeDAO.create` directly, so a non-admin can create a theme without an editor and is then locked out of PUT/DELETE/import overwrite. Could the MCP path reuse this command or shared seeding logic? ########## superset/themes/api.py: ########## @@ -205,6 +222,8 @@ def delete(self, pk: int) -> Response: return self.response_404() except SystemThemeProtectedError: return self.response_403() + except ThemeForbiddenError: Review Comment: Catching the forbidden exception for the single-delete route leaves the same new failure unhandled by `bulk_delete()`: a writer who selects any theme they do not edit gets a 500 through `@safe` instead of 403. Could the bulk route translate `ThemeForbiddenError` too and cover the non-editor bulk-delete case? ########## superset-frontend/src/features/themes/ThemeModal.tsx: ########## @@ -139,13 +160,41 @@ const ThemeModal: FunctionComponent<ThemeModalProps> = ({ const supersetTheme = useTheme(); const { setTemporaryTheme } = useThemeContext(); const [disableSave, setDisableSave] = useState<boolean>(true); - const [currentTheme, setCurrentTheme] = useState<ThemeObject | null>(null); - const [initialTheme, setInitialTheme] = useState<ThemeObject | null>(null); + const [currentTheme, setCurrentTheme] = useState<ThemeModalObject | null>( + null, + ); + const [initialTheme, setInitialTheme] = useState<ThemeModalObject | null>( + null, + ); const [isHidden, setIsHidden] = useState<boolean>(true); const [showConfirmAlert, setShowConfirmAlert] = useState<boolean>(false); const isEditMode = theme !== null; const isSystemTheme = currentTheme?.is_system === true; - const isReadOnly = isSystemTheme; + + const currentUser = useSelector<any, UserWithPermissionsAndRoles>( + state => state.user, + ); + const currentUserSubjectId = getBootstrapData()?.common?.user_subject_id; + + // theme fetch logic + const { + state: { loading, resource }, + fetchResource, + createResource, + updateResource, + } = useSingleViewResource<ThemeObject, ThemeSavePayload>( + 'theme', + t('theme'), + addDangerToast, + ); + + // In edit mode a non-editor (and non-admin) may only view the theme. The + // editorship check runs against the persisted editors from the fetched + // resource, not the in-progress picker selection. + const canEditTheme = Review Comment: The backend treats subjects from `EXTRA_EDITORS_RESOLVER` as editors, but this check receives only the persisted `editors` list. A user granted access solely by the resolver can update through the API but is shown a read-only modal. Could the Theme API expose `extra_editors` and pass them here, as the chart/dashboard paths do? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
