fix(dashboard): remove @has_access_api from filter state REST API by FrancescoCastaldi · Pull Request #43564 · apache/superset

FrancescoCastaldi · 2026-08-26T21:50:43Z

SUMMARY

In DashboardFilterStateRestApi, @has_access_api and @api decorators were erroneously present on post() and put() endpoints. Because DashboardFilterStateRestApi inherits from TemporaryCacheRestApi, endpoint access control and permissions are managed at the command level (verifying access to the underlying dashboard resource via CheckAccessDataCommand).

The presence of @has_access_api caused standard users and API clients to receive 401 Unauthorized on POST and PUT requests when creating or updating filter state in dashboards, as can_post / can_put permissions for DashboardFilterStateRestApi are not registered in FAB's role manager.

This PR removes @has_access_api and @api from post() and put(), aligning them with get() and delete() in the same API as well as FormDataRestApi.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

N/A (Backend REST API fix)

TESTING INSTRUCTIONS

Open a dashboard with native filters as an authenticated user.
Apply or update a filter state (POST /api/v1/dashboard/<pk>/filter_state or PUT /api/v1/dashboard/<pk>/filter_state/<key>).
Verify that the request succeeds (returns HTTP 200/201) without returning 401 Unauthorized.

ADDITIONAL INFORMATION

Has associated issue: Fixes Bug: @has_access_api on DashboardFilterStateRestApi causes 401 for all users (including admin) on POST/PUT #43257
Required feature flags:
Changes UI
Includes DB Migration
Introduces new feature or API
Removes existing feature or API

SUGGESTED LABELS

#bug:regression, api, api:dashboards, dashboard:native-filters, validation:validated, P2

bito-code-review · 2026-08-26T21:50:53Z

Code Review Agent Run #28c683

Actionable Suggestions - 0

Review Details

Files reviewed - 1 · Commit Range: 970e127..970e127
- superset/dashboards/filter_state/api.py
Files skipped - 0
Tools
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers an incremental AI Review.
/review full - Manually triggers a full AI Review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

… and permissions

codecov · 2026-08-26T22:47:37Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.11%. Comparing base (a140e74) to head (38c5e7c).
⚠️ Report is 11 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #43564   +/-   ##
=======================================
  Coverage   79.10%   79.11%           
=======================================
  Files        2878     2878           
  Lines      165634   165635    +1     
  Branches    38294    38296    +2     
=======================================
+ Hits       131023   131035   +12     
+ Misses      32123    32118    -5     
+ Partials     2488     2482    -6

Flag	Coverage Δ
hive	`37.95% <ø> (-0.01%)`	⬇️
mysql	`57.70% <ø> (-0.01%)`	⬇️
postgres	`57.73% <ø> (-0.01%)`	⬇️
presto	`39.86% <ø> (-0.01%)`	⬇️
python	`83.68% <ø> (+0.01%)`	⬆️
sqlite	`57.42% <ø> (-0.01%)`	⬇️
unit	`73.81% <ø> (+0.04%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

bito-code-review · 2026-08-27T00:56:01Z

Code Review Agent Run #062333

Actionable Suggestions - 0

Review Details

Files reviewed - 2 · Commit Range: 970e127..3038c72
- tests/integration_tests/dashboards/filter_state/api_tests.py
- tests/unit_tests/dashboards/filter_state_api_test.py
Files skipped - 0
Tools
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers an incremental AI Review.
/review full - Manually triggers a full AI Review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

… alpha user

…state integration tests

…for authenticated non-admin user

bito-code-review · 2026-08-27T11:56:11Z

Code Review Agent Run #33562e

Actionable Suggestions - 0

Additional Suggestions - 1

tests/integration_tests/dashboards/filter_state/api_tests.py - 1
- Missed mock assertion · Line 273-273
  
  The test patches `create.check_access` (line 273) but never asserts it was called. The POST at line 286 triggers this mock, so add `mock_create_check_access.assert_called_once_with(dashboard_id)` after the POST status assertion to verify the create path's access check is exercised.

Review Details

Files reviewed - 1 · Commit Range: 3038c72..e38a9c5
- tests/integration_tests/dashboards/filter_state/api_tests.py
Files skipped - 0
Tools
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers an incremental AI Review.
/review full - Manually triggers a full AI Review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

…heck_access call in integration test

bito-code-review · 2026-08-27T15:40:32Z

Code Review Agent Run #fe8d93

Actionable Suggestions - 0

Review Details

Files reviewed - 2 · Commit Range: e38a9c5..38c5e7c
- tests/integration_tests/dashboards/filter_state/api_tests.py
- tests/unit_tests/dashboards/filter_state_api_test.py
Files skipped - 0
Tools
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers an incremental AI Review.
/review full - Manually triggers a full AI Review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

FrancescoCastaldi · 2026-08-28T11:09:24Z

Thanks for the review @sadpandajoe!

I've updated the tests in the latest commit:

Updated the unit tests ( ests/unit_tests/dashboards/filter_state_api_test.py) to explicitly assert that neither @has_access_api nor @api decorators are present on post() and put().
Added integration test assertions to verify that access control delegation to check_access works as expected for authenticated non-admin requests.

…3564) Co-authored-by: FrancescoCastaldi <francesco.castaldi@mapsgroup.it>

fix(dashboard): remove @has_access_api from filter state REST API

970e127

pull-request-size Bot added the size/XS label Aug 26, 2026

github-actions Bot added the api Related to the REST API label Aug 26, 2026

test(dashboard): add unit and integration tests for filter state auth…

f8d1b92

… and permissions

pull-request-size Bot added size/M and removed size/XS labels Aug 26, 2026

FrancescoCastaldi added 2 commits August 27, 2026 00:06

style: apply ruff format and fix line-length constraints

3a98038

ci: re-trigger test-postgres-hive after network flake

3038c72

rusackas requested review from sadpandajoe and sha174n August 26, 2026 22:52

test(dashboard): fix filter state integration tests for authenticated…

cd1e72a

… alpha user

pull-request-size Bot added size/L and removed size/M labels Aug 27, 2026

FrancescoCastaldi added 2 commits August 27, 2026 10:37

ci: re-trigger test-postgres-hive after network timeout

2998a4a

test(dashboards): remove invalid dashboard.owners access from filter …

7be0f72

…state integration tests

pull-request-size Bot added size/M and removed size/L labels Aug 27, 2026

test(dashboard): mock check_access in filter state integration tests …

e38a9c5

…for authenticated non-admin user

pull-request-size Bot added size/L and removed size/M labels Aug 27, 2026

sadpandajoe reviewed Aug 27, 2026

View reviewed changes

Comment thread tests/unit_tests/dashboards/filter_state_api_test.py Outdated

test(dashboard): assert absence of @api decorator and verify create c…

bace0c1

…heck_access call in integration test

pull-request-size Bot added size/XL and removed size/L labels Aug 27, 2026

FrancescoCastaldi requested a review from sadpandajoe August 27, 2026 12:35

style: apply ruff formatting to filter_state_api_test.py

38c5e7c

sadpandajoe approved these changes Aug 28, 2026

View reviewed changes

rusackas merged commit 058eaf7 into apache:master Aug 29, 2026
73 checks passed

rusackas pushed a commit that referenced this pull request Aug 29, 2026

fix(dashboard): remove @has_access_api from filter state REST API (#4…

859d457

…3564) Co-authored-by: FrancescoCastaldi <francesco.castaldi@mapsgroup.it>

shoemoney mentioned this pull request Sep 1, 2026

fix(api): remove has_access_api before protect on filter_state POST/PUT #43525

Closed

Navigation Menu

Repository navigation

fix(dashboard): remove @has_access_api from filter state REST API - #43564

fix(dashboard): remove @has_access_api from filter state REST API#43564
rusackas merged 10 commits into
apache:masterfrom
FrancescoCastaldi:fix/filter-state-api-auth

FrancescoCastaldi commented Aug 26, 2026 •

edited

Loading

Uh oh!

bito-code-review Bot commented Aug 26, 2026 •

edited

Loading

Code Review Agent Run #28c683

Uh oh!

codecov Bot commented Aug 26, 2026 •

edited

Loading

Uh oh!

bito-code-review Bot commented Aug 27, 2026 •

edited

Loading

Code Review Agent Run #062333

Uh oh!

bito-code-review Bot commented Aug 27, 2026 •

edited

Loading

Code Review Agent Run #33562e

Uh oh!

Uh oh!

bito-code-review Bot commented Aug 27, 2026 •

edited

Loading

Code Review Agent Run #fe8d93

Uh oh!

FrancescoCastaldi commented Aug 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

FrancescoCastaldi commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

SUMMARY

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

SUGGESTED LABELS

Uh oh!

bito-code-review Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #28c683

Uh oh!

codecov Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

bito-code-review Bot commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #062333

Uh oh!

bito-code-review Bot commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #33562e

Uh oh!

Uh oh!

bito-code-review Bot commented Aug 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #fe8d93

Uh oh!

FrancescoCastaldi commented Aug 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

FrancescoCastaldi commented Aug 26, 2026 •

edited

Loading

bito-code-review Bot commented Aug 26, 2026 •

edited

Loading

codecov Bot commented Aug 26, 2026 •

edited

Loading

bito-code-review Bot commented Aug 27, 2026 •

edited

Loading

bito-code-review Bot commented Aug 27, 2026 •

edited

Loading

bito-code-review Bot commented Aug 27, 2026 •

edited

Loading