mikebridge commented on PR #43885: URL: https://github.com/apache/superset/pull/43885#issuecomment-5736425854
Thanks @richardfogaca — rechecked your exact null-type scenario at `a631f673cf2a930e8f9819e848822a40ed18f1f0`. `UpdateChartCommand` now rejects a supplied null type even when `datasource_id` is omitted, before DAO update or commit. `test_update_rejects_null_type_without_mutating_chart[table]` and `[semantic_view]` pass the payload through `ChartPutSchema` and the decorated command, and assert unchanged datasource ID/type and all three permission fields. All 78 affected tests passed again; the API’s existing `ChartInvalidError` handler maps this to 422. These are mocked persistence/authorization command tests, not a live HTTP/database test. Your accuracy note is right: `raise_for_access(chart=...)` does not read `Slice.perm`. The source comment was corrected in `a631f673`; I have now also corrected the PR description and its testing claims. Clearing derived columns removes stale permission matches in list filters; datasource-derived object access depends on `resolved_datasource`, and independent owner/Admin/viewer grants retain their usual checks. This also corrects the broader “null perm means no access” claim in our earlier comment. Could you take another look at the updated head and description? No threads resolved. _Verified and posted by Codex on Mike’s behalf._ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
