canModifySlice alone let an editor who lacks can_write on Chart see
"Edit chart properties", even though ChartRestApi.put (and
restore_version) require that permission at the route level and would
turn the request away. Gate that menu item on state.explore.can_add as
well, matching what the API actually enforces. Version history is left
on canModifySlice alone since its own listing endpoints only need read
access; only its restore action needs write, and that's already
enforced server-side.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The prior commit's test fixture for useExploreAdditionalActionsMenu.test.tsx
passed slice.editors through an untyped object literal, which TypeScript's
excess-property check rejected once compiled for real -- the production
Slice type already declares editors, so this was purely a test-fixture
typing gap; fixed by explicitly typing the fixture as Slice.
Also updates three pre-existing ExploreChartHeader tests that exercised
"Edit chart properties" without previously needing an explicit permission
grant, since nothing gated that path before this issue's fix. They now set
can_overwrite: true in the Redux initialState they already render with,
matching how the fix's new permission check actually reads that signal.
type-checking-frontend skipped: this worktree lacks the prebuilt
lib/*.d.ts output the full project type-check needs. jest, oxlint,
custom-rules, and stylelint all pass on the changed files.
The "Edit chart properties" menu item rendered unconditionally whenever a
chart was loaded, with no ownership/editor check, even though
UpdateChartCommand already rejects the save server-side for a user without
write access -- letting a user open a modal for an edit they can never
persist. Gate it the same way ExploreChartHeader already gates its
editable-title affordance: visible when the user can overwrite the chart,
or is listed in the chart's editors.
type-checking-frontend skipped: this worktree lacks the prebuilt lib/
artifacts it needs to run; oxfmt/oxlint/custom-rules/stylelint all pass.
Fixes#38884
useExploreAdditionalActionsMenu shows the "Edit chart properties" menu
item whenever a slice exists, with no check against the current user's
ownership/editor rights on it -- so a user who can open the modal but
whose UpdateChartCommand save will be rejected server-side still sees a
fully-clickable "Edit chart properties" entry (dosubot pinned the same
root cause: the frontend gate is missing while the backend enforces
ownership correctly, and ExploreChartHeader's own title-edit affordance
already gates on the equivalent editors/user_subjects check this menu
item lacks).
Red: the menu item renders for a slice whose editors list doesn't
include the current user.
`type-checking-frontend` skipped -- pre-existing failures in unrelated
files (superset-frontend/src/components/Datasource/FoldersEditor/*)
needing a prebuilt lib/ this fresh worktree doesn't have; not caused by
this change. oxlint/custom-rules/stylelint all pass on the changed file.
