fix(embedded): tighten guest-token scoping for annotations, result types, and channels by rusackas · Pull Request #43391 · apache/superset

rusackas · 2026-08-21T16:10:30Z

SUMMARY

Guest-token query tamper checks now also compare annotation_layers and result_type against the stored chart's query context, closing gaps where a request could reference an annotation layer or result type (e.g. samples/drill_detail) the stored chart didn't itself use.
The embedded-dashboard pre-auth page no longer renders the dashboard's title/description before a guest token is presented; the SPA fetches that metadata through the authenticated API instead.
The guest async-channel id is now derived from the full decoded token claim set instead of an enumerated field subset, so any claim difference (not just the ones someone remembered to list) produces a distinct channel.

TESTING INSTRUCTIONS

pytest tests/unit_tests/security/manager_test.py tests/unit_tests/async_events/ tests/integration_tests/embedded/test_view.py — new/extended tests per change, each verified to fail pre-fix and pass post-fix.

ADDITIONAL INFORMATION

bito-code-review · 2026-08-21T16:10:40Z

Code Review Agent Run #3432a2

Actionable Suggestions - 0

Review Details

Files reviewed - 6 · Commit Range: 6f96d11..0893514
- superset/async_events/async_query_manager.py
- superset/embedded/view.py
- superset/security/manager.py
- tests/integration_tests/embedded/test_view.py
- tests/unit_tests/async_events/async_query_manager_tests.py
- tests/unit_tests/security/manager_test.py
Files skipped - 0
Tools
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers an incremental AI Review.
/review full - Manually triggers a full AI Review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

bito-code-review · 2026-08-21T16:16:34Z

The flagged issue is correct. Deriving the channel ID from the entire guest token, including iat (issued-at) and exp (expiration), causes the channel identity to change whenever a token is refreshed. This breaks the connection for in-flight async jobs, as the client and server no longer agree on the channel ID.

To resolve this, you should derive the channel ID from a stable claim that persists across token refreshes, such as a unique session identifier or a user-specific claim that remains constant for the duration of the embedded session. You should exclude volatile claims like iat and exp from the channel derivation logic.

I have checked the PR comments, and there are no other actionable suggestions in the provided context. Would you like me to implement a fix for this issue?

superset/async_events/async_query_manager.py

# Use a stable session/channel claim instead of the full token
        message = json.dumps(
            {
                "user": token.get("user"),
                "resources": token.get("resources"),
                "session_id": token.get("session_id"),
            },
            sort_keys=True,
        ).encode("utf-8")

netlify · 2026-08-21T16:17:44Z

✅ Deploy Preview for superset-docs-preview ready!

Name	Link
🔨 Latest commit	`1d786fa`
🔍 Latest deploy log	https://app.netlify.com/projects/superset-docs-preview/deploys/6aaf086a40208d0008e85ae9
😎 Deploy Preview	https://deploy-preview-43391--superset-docs-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

codecov · 2026-08-21T16:52:06Z

Codecov Report

❌ Patch coverage is 92.30769% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 80.65%. Comparing base (43fee87) to head (d0b503d).
⚠️ Report is 4 commits behind head on master.

Files with missing lines	Patch %	Lines
superset/security/manager.py	92.30%	2 Missing and 2 partials ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #43391   +/-   ##
=======================================
  Coverage   80.65%   80.65%           
=======================================
  Files        2942     2942           
  Lines      175692   175730   +38     
  Branches    40788    40797    +9     
=======================================
+ Hits       141705   141740   +35     
- Misses      31325    31327    +2     
- Partials     2662     2663    +1

Flag	Coverage Δ
hive	`37.15% <17.30%> (-0.01%)`	⬇️
mysql	`56.38% <44.23%> (-0.01%)`	⬇️
postgres	`56.39% <44.23%> (-0.01%)`	⬇️
presto	`39.03% <17.30%> (-0.01%)`	⬇️
python	`84.96% <92.30%> (+<0.01%)`	⬆️
sqlite	`56.10% <44.23%> (-0.01%)`	⬇️
unit	`76.78% <92.30%> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

bito-code-review · 2026-08-21T23:45:55Z

Code Review Agent Run #6a5989

Actionable Suggestions - 0

Review Details

Files reviewed - 2 · Commit Range: 0893514..0ba34c9
- superset/security/manager.py
- tests/unit_tests/security/manager_test.py
Files skipped - 0
Tools
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers an incremental AI Review.
/review full - Manually triggers a full AI Review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

bito-code-review · 2026-08-27T13:51:19Z

Code Review Agent Run #d4f446

Actionable Suggestions - 0

Review Details

Files reviewed - 2 · Commit Range: 0ba34c9..d3a0e36
- superset/security/manager.py
- tests/unit_tests/security/manager_test.py
Files skipped - 0
Tools
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers an incremental AI Review.
/review full - Manually triggers a full AI Review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

bito-code-review · 2026-09-03T22:18:16Z

Code Review Agent Run #adfcf1

Actionable Suggestions - 0

Additional Suggestions - 1

superset/security/manager.py - 1
- Duplicated row-expanding check · Line 862-868
  
  The `any(_effective_result_type(...) in _ROW_EXPANDING_RESULT_TYPES for query in query_context.queries)` block is duplicated verbatim from `_native_filter_request_modified` (lines 914-921). If the row-expanding set or effective-result-type logic changes, both sites must be updated in lockstep. Consider extracting a shared `_any_row_expanding_result_type(query_context)` helper.

Review Details

Files reviewed - 2 · Commit Range: d3a0e36..ce5e707
- superset/security/manager.py
- tests/unit_tests/security/manager_test.py
Files skipped - 0
Tools
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers an incremental AI Review.
/review full - Manually triggers a full AI Review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

bito-code-review · 2026-09-04T05:08:27Z

Code Review Agent Run #95e833

Actionable Suggestions - 0

Additional Suggestions - 1

superset/security/manager.py - 1
- CWE-284: Access Control Bypass · Line 1652-1655
  
  `_annotation_layer_identity` excludes `overrides`, but `get_viz_annotation_data` (query_context_processor.py) applies `overrides.time_range`/`time_grain_sqla` to the referenced chart's query. A guest replaying a stored chart-backed layer with a wider `time_range` yields the same identity, so `_annotation_layers_modified` returns False while the response returns more rows than the stored chart renders. Include these override keys in the identity. ([CWE-284](https://cwe.mitre.org/data/definitions/284.html))

Review Details

Files reviewed - 6 · Commit Range: a6b4f46..cffbb36
- superset/async_events/async_query_manager.py
- superset/embedded/view.py
- superset/security/manager.py
- tests/integration_tests/embedded/test_view.py
- tests/unit_tests/async_events/async_query_manager_tests.py
- tests/unit_tests/security/manager_test.py
Files skipped - 0
Tools
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers an incremental AI Review.
/review full - Manually triggers a full AI Review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

bito-code-review · 2026-09-05T17:28:19Z

Code Review Agent Run #d11154

Actionable Suggestions - 0

Additional Suggestions - 1

superset/security/manager.py - 1
- CWE-200: Annotation Overrides Bypass · Line 1674-1677
  
  `_annotation_layer_identity` excludes `overrides`, but `get_viz_annotation_data` (query_context_processor.py:889-899) applies `overrides.time_range`/`time_grain_sqla` to the referenced chart's query. A guest replaying a stored layer can widen the annotation chart's time range and read rows never shared. Include `freeze_value(layer.get("overrides"))` in the identity tuple. ([CWE-200](https://cwe.mitre.org/data/definitions/200.html))

Review Details

Files reviewed - 4 · Commit Range: f452ecc..39b8693
- superset/embedded/view.py
- superset/security/manager.py
- tests/integration_tests/embedded/test_view.py
- tests/unit_tests/security/manager_test.py
Files skipped - 0
Tools
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers an incremental AI Review.
/review full - Manually triggers a full AI Review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

bito-code-review · 2026-09-12T03:03:31Z

Code Review Agent Run #cf2b35

Actionable Suggestions - 0

Review Details

Files reviewed - 2 · Commit Range: 39b8693..f23dc32
- superset/security/manager.py
- tests/unit_tests/security/manager_test.py
Files skipped - 0
Tools
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers an incremental AI Review.
/review full - Manually triggers a full AI Review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

query_context_modified() compared columns/metrics/series-limit/order-by against a chart's stored query context but never inspected annotation_layers, which is accepted on any query object and resolved by AnnotationLayerDAO.find_by_ids with no per-object restriction. Add _annotation_layers_modified(), matching the existing subset-comparator pattern: the union of annotation layers in form_data and every query object must already appear (by sourceType/value identity) on the stored chart's params or saved query_context. Replaying a chart's own layers still passes; referencing any other layer now fails the guest tamper check.

query_context_modified() compared columns/metrics/order-by against the stored chart but never compared result_type, and the samples/drill_detail preparers in query_actions.py rewrite an accepted query to every column on the datasource (dropping metrics/post_processing) after that check has already passed. Add _result_type_modified(), checking the request's top-level and per-query result_type (samples or drill_detail) against the stored chart's own saved query context; unless the chart itself uses one of those result types, requesting it now fails the guest tamper check.

…t auth The Referer and Sec-Fetch-Dest checks on the pre-token embed page are browser-cooperation only; a non-browser client can forge or omit both headers, so anything the page renders is effectively reachable by knowing an embed UUID. Stop passing the dashboard title and description into the template at this stage. The embedded SPA already fetches dashboard metadata through the guest-token-authenticated API once it holds a token, so the pre-auth page falls back to a generic title.

…d query, not the flattened set _result_type_modified previously unioned every stored query's result_type into one set and checked requested result types against that set, so a result type stored on one query (e.g. samples) could be requested for a different query in the same query context. Compare each requested query's effective result type (its own result_type, falling back to the query context's top-level result_type - mirroring how the value is resolved at render time) against the corresponding stored query at the same position instead. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

…uests The samples/drill_detail preparers replace a query's column list with every column on the datasource, bypassing the native-filter target-column allowlist entirely. Reject those result types outright on the chartless native-filter path. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…s requests Drill By (slice_id sentinel 0 plus a source chart_id) is only supposed to read the chart's configured drillable dimensions, not the whole datasource. The samples/drill_detail preparers ignore groupby entirely and return every column, bypassing that allowlist. Drill to Detail (no slice_id/chart_id at all) is unaffected since it's already meant to expose a full dataset attached to the dashboard. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…y_context_modified Rebasing onto master pulled in the JSONDecodeError branch, which pushed query_context_modified past ruff's C901 threshold. Collapse the six comparator/warn/return blocks into one loop over (comparator, reason) pairs; behavior and log messages are unchanged. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015ybdwS1GbAy3Pkt6YGKCQp

… chartless guards The Drill By and native-filter guards carried the same any(...) expression over _ROW_EXPANDING_RESULT_TYPES; fold it into _any_row_expanding_result_type so the set and effective-type logic have one call site to keep in sync. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015ybdwS1GbAy3Pkt6YGKCQp

…t params A params-only chart update can drop an annotation layer without refreshing the chart's cached query_context, so authorizing a requested layer whenever it appeared in either the current params or that stale snapshot let an embedded guest keep requesting a layer that had since been removed from the chart. Check the requested layer against params only. Co-Authored-By: Evan Rusackas <evan@preset.io> Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

bito-code-review · 2026-09-20T01:13:24Z

Code Review Agent Run #b2faba

Actionable Suggestions - 0

Additional Suggestions - 4

superset/security/manager.py - 3
- Out-of-order declarations · Line 1746-1749
  
  `_ROW_EXPANDING_RESULT_TYPES` (line 1746) and `_effective_result_type` (line 1757) are first referenced at lines 902/925, ~850 lines earlier. It works at runtime (module globals resolve at call time) but the out-of-order placement forces a reader to jump across the file to understand `_any_row_expanding_result_type`. Define the constant and helpers before their first use.
- Magic sentinel literal · Line 923-923
  
  `slice_id == 0` encodes the business meaning 'chartless Drill By sentinel' as a bare literal. It is documented in the docstring, but a named constant would make the comparison self-describing and keep the sentinel value in one place if it ever changes.
- Positional index misalignment · Line 1800-1804
  
  `stored_queries` filters out non-dict entries (line 1803), so its indices no longer align with `query_context.queries` when a stored query is not a dict. `_result_type_modified` then compares `requested` against the wrong stored query by position, which can falsely reject a legitimate replay (or, in a contrived layout, accept a row-expanding type at a position the chart never renders). Keep positional correspondence when filtering.
tests/integration_tests/embedded/test_view.py - 1
- Missing return annotation · Line 161-161
  
  BITO.md adaptive rule 7819 requires explicit return type annotations on all functions, including test methods. Sibling `test_get_embedded_dashboard` (line 56) declares `-> None`, but this new test omits it. Adding `-> None` aligns the file with the org typing standard and enables static type checking.

Review Details

Files reviewed - 4 · Commit Range: dbeca4c..1d786fa
- superset/embedded/view.py
- superset/security/manager.py
- tests/integration_tests/embedded/test_view.py
- tests/unit_tests/security/manager_test.py
Files skipped - 0
Tools
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers an incremental AI Review.
/review full - Manually triggers a full AI Review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

_result_type_modified accessed query.result_type directly while its sibling _any_row_expanding_result_type already used getattr, raising AttributeError whenever a query object lacks the attribute. Co-Authored-By: Evan Rusackas <evan@preset.io> Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

bito-code-review · 2026-09-20T04:27:34Z

Code Review Agent Run #78b726

Actionable Suggestions - 0

Review Details

Files reviewed - 1 · Commit Range: 1d786fa..f80ca5c
- superset/security/manager.py
Files skipped - 0
Tools
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers an incremental AI Review.
/review full - Manually triggers a full AI Review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

The default-result-type read in _any_row_expanding_result_type and _result_type_modified accessed query_context.result_type directly, raising AttributeError on any QueryContext-like object without that attribute set (e.g. a test double), unlike the per-query result_type read next to it which already used getattr. Co-Authored-By: Evan Rusackas <evan@preset.io> Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

bito-code-review · 2026-09-20T20:23:30Z

Code Review Agent Run #d1bc6e

Actionable Suggestions - 0

Review Details

Files reviewed - 1 · Commit Range: f80ca5c..d0b503d
- superset/security/manager.py
Files skipped - 0
Tools
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers an incremental AI Review.
/review full - Manually triggers a full AI Review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

…pes, and channels (#43391) Co-authored-by: Superset Dev <dev@superset.apache.org> Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> (cherry picked from commit add97e5)

rusackas requested review from eschutho, sadpandajoe, sha174n and villebro August 21, 2026 16:10

pull-request-size Bot added the size/L label Aug 21, 2026

dosubot Bot added authentication Related to authentication embedded labels Aug 21, 2026

github-actions Bot removed the embedded label Aug 21, 2026

codeant-ai-for-open-source Bot reviewed Aug 21, 2026

View reviewed changes

Comment thread superset/async_events/async_query_manager.py Outdated

rusackas added the merge-if-green If approved and tests are green, please go ahead and merge it for me label Aug 21, 2026

sadpandajoe reviewed Aug 21, 2026

View reviewed changes

Comment thread superset/security/manager.py Outdated

sadpandajoe reviewed Aug 27, 2026

View reviewed changes

Comment thread superset/security/manager.py Outdated

sadpandajoe reviewed Sep 2, 2026

View reviewed changes

Comment thread superset/security/manager.py Outdated

pull-request-size Bot added size/XL and removed size/L labels Sep 3, 2026

github-actions Bot added the requires:rebase Requires rebasing on top of current master label Sep 3, 2026

rusackas force-pushed the fix/guest-token-embedded-scoping branch from ce5e707 to 54d42c9 Compare September 4, 2026 02:05

rusackas added the size/XL label Sep 4, 2026

github-actions Bot added the requires:rebase Requires rebasing on top of current master label Sep 5, 2026

rusackas force-pushed the fix/guest-token-embedded-scoping branch from cffbb36 to 39b8693 Compare September 5, 2026 14:25

github-actions Bot removed the requires:rebase Requires rebasing on top of current master label Sep 5, 2026

sadpandajoe reviewed Sep 11, 2026

View reviewed changes

Comment thread superset/security/manager.py Outdated

github-actions Bot added the requires:rebase Requires rebasing on top of current master label Sep 18, 2026

Superset Dev and others added 9 commits September 19, 2026 15:06

rusackas force-pushed the fix/guest-token-embedded-scoping branch from f23dc32 to 1d786fa Compare September 19, 2026 22:10

github-actions Bot removed the requires:rebase Requires rebasing on top of current master label Sep 19, 2026

sadpandajoe approved these changes Sep 22, 2026

View reviewed changes

sadpandajoe merged commit add97e5 into master Sep 22, 2026
76 checks passed

sadpandajoe deleted the fix/guest-token-embedded-scoping branch September 22, 2026 21:55

Conversation

rusackas commented Aug 21, 2026

SUMMARY

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

Uh oh!

bito-code-review Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #3432a2

Uh oh!

Uh oh!

bito-code-review Bot commented Aug 21, 2026

Uh oh!

netlify Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for superset-docs-preview ready!

Uh oh!

codecov Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

bito-code-review Bot commented Aug 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #6a5989

Uh oh!

Uh oh!

bito-code-review Bot commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #d4f446

Uh oh!

Uh oh!

bito-code-review Bot commented Sep 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #adfcf1

Uh oh!

bito-code-review Bot commented Sep 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #95e833

Uh oh!

bito-code-review Bot commented Sep 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #d11154

Uh oh!

Uh oh!

bito-code-review Bot commented Sep 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #cf2b35

Uh oh!

bito-code-review Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #b2faba

Uh oh!

bito-code-review Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #78b726

Uh oh!

bito-code-review Bot commented Sep 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #d1bc6e

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

bito-code-review Bot commented Aug 21, 2026 •

edited

Loading

netlify Bot commented Aug 21, 2026 •

edited

Loading

codecov Bot commented Aug 21, 2026 •

edited

Loading

bito-code-review Bot commented Aug 21, 2026 •

edited

Loading

bito-code-review Bot commented Aug 27, 2026 •

edited

Loading

bito-code-review Bot commented Sep 3, 2026 •

edited

Loading

bito-code-review Bot commented Sep 4, 2026 •

edited

Loading

bito-code-review Bot commented Sep 5, 2026 •

edited

Loading

bito-code-review Bot commented Sep 12, 2026 •

edited

Loading

bito-code-review Bot commented Sep 20, 2026 •

edited

Loading

bito-code-review Bot commented Sep 20, 2026 •

edited

Loading

bito-code-review Bot commented Sep 20, 2026 •

edited

Loading