SQL Lab "Create chart" broken for non-admin users #42389

Activity

1. dosubot

   added

   authentication:RBACRelated to RBACRelated to RBAC

   sqllabNamespace | Anything related to the SQL LabNamespace | Anything related to the SQL Lab

   validation:requiredA committer should validate the issueA committer should validate the issue

   on Jul 24, 2026
2. dosubot commented on Jul 24, 2026

   

   dosubotBot

   on Jul 24, 2026 – with DosuBot

   More actions

   This looks related to the authorization hardening introduced in PR #40409, which tightened SQL Lab access so that operations now require a matching Superset dataset-level permission — database_access or schema_access alone is no longer sufficient for Gamma-style users.

   Here's what's happening in the "Create chart" flow:

   1. When you click Create chart, the frontend calls /api/v1/dataset/get_or_create/ to create a dataset from the CTAS/CVAS result [1].
   2. The CreateDatasetCommand validates access via raise_for_access(database=database, sql=sql, ...) [2]. For a Gamma user with only database_access (no all_datasource_access), this check fails because the hardened authorization now demands explicit datasource-level permission for the newly created/referenced table [3].
   3. Because the backend rejects the request, no valid dataset_id is returned, so the frontend navigation to Explore fails with the "Missing URL parameters" error.

   Workarounds:

   • Grant all_datasource_access to the role (which you've noted you want to avoid).
   • Grant schema-level access (schema_access) on the schema where CTAS tables are created (configured via CTAS_SCHEMA_NAME_FUNC in superset_config.py). This should satisfy raise_for_access at the schema level.
   • Ensure the user is set as owner of any datasets created, since ownership bypasses the datasource permission check [4].

   This may be an unintended regression from the authorization hardening wave (PRs #40409, #38952, #40497) — the "Create chart" flow inherently creates new datasets that the user wouldn't have pre-existing permissions for. You may want to check whether the dataset created via get_or_create properly assigns the creating user as owner, which would allow the subsequent Explore access to succeed.

   To reply, just mention @dosu.

   ---

   Share context across your team and agents. Try Dosu.

   
3. durgaprasadml commented on Jul 27, 2026

   

   durgaprasadml

   on Jul 27, 2026

   Contributor

   More actions

   I've opened a PR with a proposed fix for this issue:

   #42479 – fix(sqllab): allow SQL Lab query owners to create charts without all_datasource_access

   The fix preserves the existing RBAC behavior while allowing authorized SQL Lab users to create charts from their own queries.

   Feedback is welcome. Thanks!

   ❤️React with ❤️1Reacted by Evan Rusackas

   👀React with 👀1Reacted by Evan Rusackas
4. rusackas commented on Jul 28, 2026

   

   rusackas

   on Jul 28, 2026

   Member

   More actions

   Thanks for opening the PR... will review.
5. rusackas

   closed this as completedin #42479on Aug 24, 2026