mikebridge commented on PR #44013:
URL: https://github.com/apache/superset/pull/44013#issuecomment-5591047336
@aminghadersohi thanks — good catches. Addressed in cc6a82ada3:
- Corrected the comment: FAB's response_403 does return a fixed `{"message":
"Forbidden"}` body; reworded to say it carries a fixed body with no reason
detail (identical to the editorship denial), so the refusal discloses nothing
but reads the same as a permission denial.
On your question about the opaque 403 for a fully-authorized editor: that's
the intended end state for this change. The non-disclosure is deliberate (a
managed-externally refusal shouldn't be more informative than a permission
denial), and keeping it as the shared forbidden_exc avoids a distinct exception
+ endpoint mapping for what sc-115616 scoped as the minimal server-side gate. A
distinguishable, documented error (e.g. a 409/422 with a 'managed externally'
reason) is a reasonable future enhancement if operators need to tell the two
apart — happy to file it as a follow-up if you think it's worth surfacing to
API clients.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
