mikebridge opened a new pull request, #44179: URL: https://github.com/apache/superset/pull/44179
### SUMMARY Fixes the Recently Archived view offering Recover and Delete permanently actions to read-only users. The shared list now uses the selected resource's existing `can_write` permission from `_info`, matching the restore/purge API permission mappings for dashboards, charts, and datasets. Readable archived rows remain visible, but the Actions column and recovery tooltip are hidden without write permission. Existing server-side authorization and ownership checks are unchanged. Permissions remain fail-closed while loading or after an info request failure, and reset when switching object types. Associated ticket: [SC-120335](https://app.shortcut.com/preset/story/120335). ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF Before: a read-only user could see a Recover control on a readable archived dashboard; clicking it resulted in a server-denied request. After: read-only users see the archived rows without recovery/deletion controls or recovery guidance. Write-enabled users retain the existing controls. No screenshots captured locally; browser verification remains outstanding because the local application health endpoint returns HTTP 500. ### TESTING INSTRUCTIONS Automated verification: ```bash cd superset-frontend npm run test -- --maxWorkers=2 src/pages/ArchivedList/ArchivedList.test.tsx ``` 39 tests pass, including 10 added cases covering read-only/write-enabled access across all three types, delete-only permissions, permission loading/failure, and type switching. All applicable staged pre-commit hooks pass, including TypeScript. Manual verification (outstanding): 1. Enable `SOFT_DELETE` and archive a dashboard readable by a user with Dashboard read/export permissions but no write permission. 2. As that user, open Recently Archived and select Dashboard. Confirm readable rows remain visible but no Actions column, Recover/Delete permanently buttons, or recovery tooltip appears. 3. Repeat for Chart and Dataset with readable archived objects and read-only permissions. 4. As a write-enabled editor or admin, confirm Recover remains available and restores an eligible object successfully. 5. Switch between types for which the user has different write permissions and confirm controls follow the selected type. ### ADDITIONAL INFORMATION - [x] Has associated issue: [SC-120335](https://app.shortcut.com/preset/story/120335) - [x] Required feature flags: `SOFT_DELETE` - [x] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API No schema, API, dependency, or permission-definition changes. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
