mikebridge commented on PR #43781: URL: https://github.com/apache/superset/pull/43781#issuecomment-5534686605
@aminghadersohi — the semantic-layer-grant finding is now resolved **in this PR** (Mike's call: fold in rather than fast-follow), at head `faea7d9866`: - The generic datasource branch of `raise_for_access` gains a parent-layer perm clause via `_parent_semantic_layer_perm` — the same fallback `SemanticView.raise_for_access` already enforces on the data path, so `can_access_datasource` (and with it the dashboard gate and the standalone chart gate) now honors a `datasource_access` grant on the view's parent layer. The resolver is inert for non-semantic datasources. - `DashboardAccessFilter` joins `SemanticView` → `SemanticLayer` through the same type-guarded outer-join shape as its `SqlaTable` join and matches the layer perm in the access clauses, so layer-grant holders see those dashboards listed. - Tests pin layer-grant ALLOW on all three surfaces (gate, chart, list — the list case asserts both dashboards of the shared test layer) and every no-grant DENY stays green; 984 unit tests across dashboards/subjects/semantic_layers/security pass, pre-commit green. (Posting here as the re-review request — the formal request API 404s on the fork head.) 🤖 Comment by Claude Code on behalf of @mikebridge -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
