test(tags): make TemplateError regression test hermetic, no DB dependency

The regression test let the real security_manager.raise_for_access(query=...)
run, which opens a live DB connection to introspect table-level perms before
reaching the Jinja parse. That only passed locally because a DB was up; the
unit_tests CI sandbox has no Postgres, so it failed there.

Mock raise_for_access directly to raise TemplateError instead. This still
proves what matters: except (SupersetSecurityException, TemplateError) in
create.py catches it and surfaces as TagInvalidError rather than escaping.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

superset/commands/tag/create.py

@@ -18,6 +18,8 @@ import logging
 from functools import partial
 from typing import Any
 
+from jinja2.exceptions import TemplateError
+
 from superset import security_manager
 from superset.commands.base import BaseCommand, CreateMixin
 from superset.commands.tag.exceptions import TagCreateFailedError, TagInvalidError
@@ -97,9 +99,14 @@ class CreateCustomTagCommand(CreateMixin, BaseCommand):
                         f"Access validation not supported for {object_type}"
                     )
                 )
-        except SupersetSecurityException:
+        except (SupersetSecurityException, TemplateError):
+            # A TemplateError can surface when authorizing a saved query whose
+            # Jinja-templated SQL must be parsed to resolve table references; a
+            # malformed template is a validation failure, not an unhandled 500.
             exceptions.append(
-                TagCreateFailedError(f"Access denied for {object_type} {object_id}")
+                TagCreateFailedError(
+                    f"Could not validate access for {object_type} {object_id}"
+                )
             )
 
 

tests/unit_tests/tags/commands/create_test.py

@@ -108,6 +108,40 @@ def test_create_command_success(session_with_data: Session, mocker: MockerFixtur
         )
 
 
+def test_validate_object_access_query_malformed_jinja(
+    session_with_data: Session, mocker: MockerFixture
+):
+    """A saved query whose Jinja-templated SQL fails to parse during access
+    checks must surface as a validation error, not an unhandled
+    ``jinja2.TemplateError`` escaping as a 500.
+
+    When ``raise_for_access(query=...)`` authorizes a saved query via
+    per-table permissions it parses the query's Jinja SQL (e.g. an unclosed
+    ``{% if %}`` block raises ``TemplateSyntaxError``). Mock that call to raise
+    the ``TemplateError`` directly so the test stays hermetic and does not open
+    a live DB connection to introspect table-level perms.
+    """
+    from jinja2.exceptions import TemplateError
+
+    from superset.commands.tag.create import CreateCustomTagCommand
+    from superset.commands.tag.exceptions import TagInvalidError
+    from superset.models.sql_lab import SavedQuery
+    from superset.tags.models import ObjectType
+
+    query = db.session.query(SavedQuery).first()
+
+    mocker.patch("superset.commands.tag.create.to_object_model", return_value=query)
+    mocker.patch(
+        "superset.commands.tag.create.security_manager.raise_for_access",
+        side_effect=TemplateError("unclosed {% if %}"),
+    )
+
+    command = CreateCustomTagCommand(ObjectType.query, query.id, ["tag"])
+
+    with pytest.raises(TagInvalidError):
+        command.validate()
+
+
 def test_create_command_success_clear(
     session_with_data: Session, mocker: MockerFixture
 ):