Piyush-08-bot opened a new pull request, #43995: URL: https://github.com/apache/superset/pull/43995
Fixes #43987. Users with `schema_access` or `catalog_access` permissions could not open Explore from a SQL Lab result when they were not the query author and did not have `database_access`. The SQL Lab query itself could be executed successfully, but clicking **Create chart** resulted in: ```text 403 DATASOURCE_SECURITY_ACCESS_ERROR ``` This was caused by three issues in the SQL Lab access-checking path: * `raise_for_access()` did not return after completing the query-specific access check, causing `Query` objects to fall through to the generic datasource check. * `can_access_schema()` only handled `BaseDatasource` instances, excluding SQL Lab `Query` objects. * `Query.schema_perm` generated a permission string that did not match the format used by `sync_permissions()`. This change fixes the query access flow, allows schema access checks for SQL Lab queries, and uses the canonical schema permission format. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF Not applicable. This is a backend security/access-control fix and does not change the UI. ### TESTING INSTRUCTIONS Run the regression tests: ```bash pytest tests/unit_tests/security/test_sqllab_explore_access_43987.py -v ``` The tests cover: * `schema_access` for a non-query author * `catalog_access` for a non-query author * users without the required access * schema access checks for SQL Lab `Query` objects * `Query.schema_perm` with and without a catalog Manual verification: 1. Create a role with `sql_lab` and `schema_access` for a specific schema. 2. Do not grant `database_access` or `all_datasource_access`. 3. Run a SQL Lab query against that schema as another user. 4. Open the query as the user with `schema_access`. 5. Click **Create chart**. 6. Explore should open successfully. ### ADDITIONAL INFORMATION * [x] Has associated issue: Fixes #43987 * [ ] Required feature flags * [ ] Changes UI * [ ] Includes DB Migration * [ ] Introduces new feature or API * [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
