EnxDev commented on code in PR #43967:
URL: https://github.com/apache/superset/pull/43967#discussion_r3976525045
##########
superset/datasets/api.py:
##########
@@ -1182,11 +1241,10 @@ def related_objects(self, id_or_uuid: str) -> Response:
for dashboard in data["dashboards"]
if security_manager.can_access_dashboard(dashboard)
]
- return self.response(
- 200,
- charts={"count": len(charts), "result": charts},
- dashboards={"count": len(dashboards), "result": dashboards},
- )
+ return {
+ "charts": {"count": len(charts), "result": charts},
Review Comment:
**[P1] Preserve the total impact when some dependents are restricted.**
`count` is computed after `can_access_*`, so a dataset editor who is excluded
by a chart or dashboard viewer list gets zero here even though deleting the
dataset still breaks those objects. The new modal then gives the explicit false
assurance, “No charts or dashboards depend…”. `serialize_dataset_purge_impact`
on `master` already handles the same privacy boundary with total `count`, a
redacted `result`, and `restricted_count`. Could this endpoint follow that
shape and add a non-admin editor regression with a restricted dependent?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
