tien238lnd opened a new pull request, #44339: URL: https://github.com/apache/superset/pull/44339
### SUMMARY A user whose roles all come from a group is reported with an empty `roles` list by `get_instance_info`, `get_user_info`, `list_users` and `find_users`: `serialize_user_object` reads `User.roles`, which holds only directly assigned roles. The security manager reads both direct and group roles, so the same user can successfully call write tools that the server instructions have just told the client they hold no role for. Those instructions tell clients to check the user's roles before suggesting write operations, so an empty list is actively misleading rather than merely incomplete. `serialize_user_object` now collects the roles of each of the user's groups as well, keeping each name once with direct roles first. A user object whose `groups` relationship is not iterable still reports its own direct roles. ### TESTING INSTRUCTIONS `pytest tests/unit_tests/mcp_service/system/test_serialize_user_object.py` Manually: create a group, grant it a role, add a user to that group and give the user no direct role. `get_user_info` for that user previously returned `roles: []`; it now lists the group's role. A user with both direct and group roles reports both, without duplicates. ### ADDITIONAL INFORMATION - [ ] Has associated issue: -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
