Commit Graph

2947 Commits

Author SHA1 Message Date
Amin Ghadersohi
3dbfbbdefa style: fix E501 noqa placement and PT001 in export_test.py
noqa: E501 comments were on the closing-paren line instead of on the
actual long string lines, so ruff did not suppress the violations.
Add # noqa: PT001 on the @pytest.fixture decorator to pin the
no-parentheses style (ruff 0.9.7 default) and prevent ruff 0.5.x
from auto-converting it in either direction.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-10 23:04:53 +00:00
Amin Ghadersohi
e0149f38ee style: fix E501 noqa placement and PT001 in export_test.py
noqa: E501 comments were on the closing-paren line instead of on the
actual long string lines, so ruff did not suppress the violations.
Also applied ruff auto-fix for PT001 (@pytest.fixture -> @pytest.fixture()).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-10 23:04:53 +00:00
Amin Ghadersohi
7459b5ab40 style: ruff-format auto-format fix 2026-06-10 23:04:53 +00:00
Amin Ghadersohi
ec178b862c fix(mcp): fix saved-metric name normalization across all chart plugins
Add _get_canonical_metric_name() to DatasetValidator that searches only
available_metrics, preventing a column with matching case-insensitive name
from shadowing a saved metric's canonical casing.

Update all 7 chart plugins (xy, table, pie, big_number, handlebars,
mixed_timeseries, pivot_table) to branch on saved_metric flag: saved
metrics now go through _get_canonical_metric_name while regular column
refs continue to use _get_canonical_column_name.

Fix pre_validate alias handling in xy and mixed_timeseries plugins to
accept Pydantic AliasChoices keys (metrics/x_axis/metrics_b) so payloads
using canonical Superset field names are not incorrectly rejected.

Add TestGetCanonicalMetricName, TestSavedMetricNormalizationCorrectness,
and TestPreValidateAliasHandling test classes covering the collision case
and alias acceptance.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-10 23:04:53 +00:00
Amin Ghadersohi
4e0eb3a395 feat(mcp): add runtime chart plugin enable/disable via _PluginFilterConfig
Introduces a dynamic filter layer in the chart type registry so operators can
disable individual plugins (e.g. `handlebars`) without a code deploy:

- `MCP_DISABLED_CHART_PLUGINS: frozenset[str]` — static deny-list in mcp_config.py
- `MCP_CHART_PLUGIN_ENABLED_FUNC: Callable[[str], bool] | None` — dynamic hook
  for Harness/Split/per-user targeting; takes precedence over the deny-list
- Both keys are propagated through `get_mcp_config()` defaults

registry.py changes:
- `_PluginFilterConfig` frozen dataclass replaces two bare globals so
  configure() replaces them atomically (no torn reads under concurrency)
- `configure(disabled, enabled_func)` — called at app init; accepts any
  iterable for `disabled`; validates `enabled_func` is callable
- `_is_plugin_enabled()` — reads config once, fails closed on callable exception
- `get()` / `all_types()` / `is_enabled()` apply the filter at lookup time;
  `is_registered()` and `display_name_for_viz_type()` intentionally bypass it
  so callers can distinguish "unknown" vs "disabled" and existing charts still
  resolve display names for disabled viz types

schema_validator.py: two-step pre-check — `is_registered()` for unknown types,
`is_enabled()` for disabled ones, with distinct `DISABLED_CHART_TYPE` error code.

Wiring:
- `SupersetAppInitializer.configure_mcp_chart_registry()` called after
  `configure_feature_flags()` in `init_app()`
- `flask_singleton.py` re-calls `registry.configure()` after the MCP config
  overlay so MCP-specific overrides in `superset_config.py` take effect in
  standalone MCP mode

Tests: 28 cases in test_registry_filters.py covering deny-list, callable hook,
fail-closed on exception, all_types() filtering, display_name bypass, atomic
reconfigure, and configure() with list/tuple/frozenset inputs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-10 23:04:53 +00:00
Amin Ghadersohi
c1d4b454e4 fix(mcp): fix E501 in update_chart.py and update_chart test mocks for column validation
Split an 89-char comment line and an over-limit condition in update_chart.py
to satisfy the ruff E501 rule. Also applied ruff format.

Two TestUpdateChartValidationGate tests expected CHART_VALIDATION_FAILED but
received CHART_DATASET_NOT_FOUND because _validate_update_against_dataset calls
DatasetValidator.validate_against_dataset before validate_and_compile, and the
existing mocks provided a Mock() object for chart.datasource whose .id attribute
is an auto-generated MagicMock (not a real int). Added a patch for
DatasetValidator.validate_against_dataset returning (True, None) so the
column-validation tier is bypassed and the test reaches the mocked
validate_and_compile response as intended.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-10 23:04:09 +00:00
Amin Ghadersohi
760a973c76 refactor(mcp): address Codex review — fix registry bug, DRY schema hints, remove column regex
P1.1 registry.py: move _plugins_loaded=True to after successful import so a
failed load doesn't permanently poison the registry.

P1.3 schemas.py: remove overly restrictive ColumnRef.name / FilterClause.column
/ BigNumberChartConfig.temporal_column regex that blocked valid column names
containing parentheses, slashes, and other SQL-common characters.

P2.3 (DRY): eliminate _CHART_TYPE_ERROR_HINTS second-registry in
schema_validator.py by adding schema_error_hint() to ChartTypePlugin protocol,
BaseChartPlugin default, and all 7 plugin classes. SchemaValidator now delegates
to the plugin registry instead of maintaining a parallel dict.

P3.3 test_registry.py: add full registry unit-test coverage (register, get,
all_types, is_registered, display_name_for_viz_type, proxy methods, duplicate
warning, empty chart_type validation, insertion-order guarantee).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-10 23:04:09 +00:00
Amin Ghadersohi
77dc099da7 fix(mcp): resolve ruff E501 and formatting issues to pass pre-commit
- Split long string literal in schema_validator.py line 202 (E501, 94 > 88 chars)
- Apply ruff format auto-fixes to big_number.py, handlebars.py, and test_get_chart_data.py
2026-06-10 23:04:09 +00:00
Amin Ghadersohi
487f8afc72 refactor(mcp): complete plugin protocol — registry bootstrap, mypy fixes, test repairs
On top of the dead-code elimination in the previous commit:
- Add lazy _ensure_plugins_loaded() bootstrap to ChartTypeRegistry so the
  registry is populated even without importing app.py (fixes isolated test runs)
- Delegate _RegistryProxy methods to module-level functions so bootstrap runs
- Guard register() against empty chart_type strings
- Add generate_name + resolve_viz_type to ChartTypePlugin Protocol and
  BaseChartPlugin; delegate generate_chart_name/_resolve_viz_type in
  chart_utils to the plugin registry
- Add _with_context static helper to BaseChartPlugin (shared by all plugins)
- Fix stale 'five methods' → 'eight methods' docstring in plugin.py
- Add TypeVar _C to normalize_column_names so mypy infers correct return type
- Fix broken tests: update _pre_validate_big_number_config → _pre_validate_chart_type,
  remove deleted TestNormalizeXYConfig/TestNormalizeTableConfig classes,
  update runtime validator tests for removed _validate_format_compatibility /
  _validate_cardinality methods, add x is not None narrowing guards

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-10 23:04:09 +00:00
Evan Rusackas
5a0e3f15ca feat(embedded): add guest token revocation support (#40671)
Co-authored-by: Claude Code <noreply@anthropic.com>
2026-06-10 09:17:30 -07:00
Evan Rusackas
08b8bdecbd fix(charts): tighten chart schema input validation (query_context JSON, prophet/rolling bounds) (#40634)
Co-authored-by: Claude Code <noreply@anthropic.com>
2026-06-10 08:17:12 -07:00
Evan Rusackas
0a1e51f542 fix(schemas): tighten guest dataset fields, external_url protocols, ssh creds, prophet bounds (#40640)
Co-authored-by: Claude Code <noreply@anthropic.com>
2026-06-09 18:30:30 -07:00
Elizabeth Thompson
c0e78f39d7 fix: replace deprecated appbuilder.app with current_app (#40876)
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-09 15:01:43 -07:00
dependabot[bot]
543ad04ca0 chore(deps): bump pyarrow from 20.0.0 to 24.0.0 (#39756)
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Evan <evan@preset.io>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-09 12:51:33 -07:00
Evan Rusackas
00e3682aaf fix(dashboard): URL-encode native_filters in permalink redirect (#40660)
Co-authored-by: Claude Code <noreply@anthropic.com>
2026-06-09 11:37:08 -07:00
Evan Rusackas
004101a752 fix(rls): apply standard datasource access checks in RLS rule commands (#40650)
Co-authored-by: Claude Code <noreply@anthropic.com>
2026-06-09 11:24:12 -07:00
Evan Rusackas
568f34d6d8 fix(mcp): enforce audience, algorithm, issuer binding, and token scopes (strict mode) (#40653)
Co-authored-by: Claude Code <noreply@anthropic.com>
2026-06-09 11:08:20 -07:00
Evan Rusackas
a0cf798409 fix(embedded): add Sec-Fetch-Dest defense-in-depth check on the embedded view (#40667)
Co-authored-by: Claude Code <noreply@anthropic.com>
2026-06-09 11:08:08 -07:00
Evan Rusackas
065578e48a fix(commands,api): enforce command validation, sanitize export filename/token, set cache TTLs (#40655)
Co-authored-by: Claude Code <noreply@anthropic.com>
2026-06-09 10:29:46 -07:00
EMMANUELA OPURUM
6311e2c315 fix: use pd.to_numeric in df_metrics_to_num to handle string-encoded numerics from ClickHouse (#40190)
Co-authored-by: Emmanuela Opurum <youremail@example.com>
Co-authored-by: Đỗ Trọng Hải <41283691+hainenber@users.noreply.github.com>
2026-06-09 10:28:34 -07:00
Evan Rusackas
bf9ad4d2ba fix: set charset via content_type to avoid malformed Content-Type headers (#40658)
Co-authored-by: Claude Code <noreply@anthropic.com>
2026-06-09 10:17:44 -07:00
Evan Rusackas
0133ebc9f2 feat(mcp): log successful JWT authentication events (#40864)
Co-authored-by: Claude Code <noreply@anthropic.com>
2026-06-09 09:34:52 -07:00
Evan Rusackas
b64dd4af4a fix(mcp): handle JWKS fetch network errors during token verification (#40869)
Co-authored-by: Claude Code <noreply@anthropic.com>
2026-06-09 09:34:33 -07:00
Evan Rusackas
7b1e1e5668 fix(charts): route CSV result format through the escaping CSV writer (#40859)
Co-authored-by: Claude Code <noreply@anthropic.com>
2026-06-09 09:33:46 -07:00
Evan Rusackas
9105adc67b fix(mcp): return a generic message when a request is unauthenticated (#40861)
Co-authored-by: Claude Code <noreply@anthropic.com>
2026-06-09 09:19:15 -07:00
Sebastian Mohr
443fd7bcee fix(assets): Support uploading tags using the assets import endpoint (#38343)
Co-authored-by: Sam Firke <sfirke@users.noreply.github.com>
2026-06-09 10:13:28 -04:00
Daniel Vaz Gaspar
2f71771b56 fix(sqllab): prevent corrupted query state from blocking SQL Lab access (#40580)
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Joe Li <joe@preset.io>
2026-06-09 10:51:45 +01:00
Evan Rusackas
3afbb48188 fix(uploads,dao): add zip-safety check to columnar reader and cap DAO page size (#40637)
Co-authored-by: Claude Code <noreply@anthropic.com>
2026-06-08 17:07:57 -07:00
Evan Rusackas
837f41986d fix: reject default guest/async JWT secrets at startup (#40649)
Co-authored-by: Claude Code <noreply@anthropic.com>
2026-06-08 16:53:37 -07:00
Evan Rusackas
8eda626466 fix: raise random_key entropy and add expiry to async query tokens (#40638)
Co-authored-by: Claude Code <noreply@anthropic.com>
2026-06-08 16:24:06 -07:00
Evan Rusackas
fe9818226d fix(viz): gate stacktrace behind SHOW_STACKTRACE and allowlist resample method (#40636)
Co-authored-by: Claude Code <noreply@anthropic.com>
2026-06-08 16:09:59 -07:00
Evan Rusackas
911bb9dcda fix: harden ZIP safety checks (total-size cap, zero-division guard) and extension path matching (#40664)
Co-authored-by: Claude Code <noreply@anthropic.com>
2026-06-08 14:14:53 -07:00
Evan Rusackas
507cf93687 test(dashboard): API-created dashboards should link charts from position_json (#32966) (#40816)
Co-authored-by: Claude Code <noreply@anthropic.com>
2026-06-08 10:51:25 -07:00
Amin Ghadersohi
ef7379c47e chore(mcp): remove low-value list/info tools that fail agent-native policy (#40690) 2026-06-06 14:57:41 -04:00
Amin Ghadersohi
84aaaaa6b0 fix(mcp): filter sensitive database columns from list_databases loaded-metadata (#40771) 2026-06-06 14:57:21 -04:00
Evan Rusackas
b85a2cdab1 fix: ODPS (MaxCompute) data source table preview failed (#38174)
Co-authored-by: zhutong6688 <zhutong66@163.com>
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
2026-06-05 17:57:44 -07:00
Evan Rusackas
381b99ae84 fix(csv): respect CSV_EXPORT config for decimal separator and delimiter (#38170)
Co-authored-by: Claude <noreply@anthropic.com>
2026-06-05 17:57:21 -07:00
Evan Rusackas
6b0d747939 fix: cache warmup using WebDriver for reliable authentication (#38449)
Co-authored-by: Superset Dev <dev@superset.apache.org>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-05 16:36:30 -07:00
Evan Rusackas
19d01521bf fix(dashboard): replace chartsInScope references at import time (#38171)
Co-authored-by: Rémy Dubois <remy.dubois@komodohealth.com>
Co-authored-by: Claude Code <noreply@anthropic.com>
2026-06-05 11:42:24 -07:00
Evan Rusackas
1623ceda73 fix(result_set): preserve JSON/JSONB data as objects instead of strings (#38172)
Co-authored-by: Claude <noreply@anthropic.com>
2026-06-05 11:41:40 -07:00
madhushreeag
fa42b13eb8 fix(dataset): preserve numeric column types when pydruid infers STRING from first-row value (#40677)
Co-authored-by: madhushree agarwal <madhushree_agarwal@apple.com>
2026-06-05 09:25:57 -07:00
Amin Ghadersohi
aa4092ba68 fix(mcp): add select_columns lean defaults to get_dashboard_info, get_chart_info, get_dataset_info (#40473)
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Co-authored-by: Richard Fogaça <richardfogaca@gmail.com>
2026-06-05 11:10:13 -03:00
Elizabeth Thompson
42367afb25 fix(reports): add per-tile animation wait to prevent partial ECharts renders in tiled screenshots (#40694)
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-04 16:43:34 -07:00
Vitor Avila
7406098708 fix(dashboard-filter): Consider dashboard filters to charts not declared in the dashboard position (#40774) 2026-06-04 16:43:38 -03:00
Evan Rusackas
0d1b702ce8 feat(extensions): static supply-chain controls — denylist + version policy (#40668)
Co-authored-by: Claude Code <noreply@anthropic.com>
2026-06-04 12:29:03 -07:00
Amin Ghadersohi
7d69f76127 fix(mcp): API key authentication for MCP — transport, validation, and RBAC (#39604) 2026-06-04 15:04:43 -04:00
Evan Rusackas
9a31362fa5 fix(reports): stamp email subject date at send time, not import time (#40693)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-04 12:03:28 -07:00
Evan Rusackas
23d18743bd fix(deck.gl): strip all JS-executed form_data keys when JavaScript controls are disabled (#40602)
Co-authored-by: Claude Code <noreply@anthropic.com>
2026-06-04 10:14:33 -07:00
Shaitan
41572dbf9d fix(chart): restrict owner lookup to users with write access (#39304)
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-06-03 23:00:31 +01:00
Evan Rusackas
9d1bc6b2cc fix(i18n): don't flag intentional string deletions as translation regressions (#40716)
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-03 14:47:31 -07:00