mikebridge commented on PR #43885:
URL: https://github.com/apache/superset/pull/43885#issuecomment-5736425854

   Thanks @richardfogaca — rechecked your exact null-type scenario at 
`a631f673cf2a930e8f9819e848822a40ed18f1f0`. `UpdateChartCommand` now rejects a 
supplied null type even when `datasource_id` is omitted, before DAO update or 
commit. `test_update_rejects_null_type_without_mutating_chart[table]` and 
`[semantic_view]` pass the payload through `ChartPutSchema` and the decorated 
command, and assert unchanged datasource ID/type and all three permission 
fields. All 78 affected tests passed again; the API’s existing 
`ChartInvalidError` handler maps this to 422. These are mocked 
persistence/authorization command tests, not a live HTTP/database test.
   
   Your accuracy note is right: `raise_for_access(chart=...)` does not read 
`Slice.perm`. The source comment was corrected in `a631f673`; I have now also 
corrected the PR description and its testing claims. Clearing derived columns 
removes stale permission matches in list filters; datasource-derived object 
access depends on `resolved_datasource`, and independent owner/Admin/viewer 
grants retain their usual checks. This also corrects the broader “null perm 
means no access” claim in our earlier comment.
   
   Could you take another look at the updated head and description? No threads 
resolved.
   
   _Verified and posted by Codex on Mike’s behalf._
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to