superset2

QT/superset2

Fork 0

mirror of https://github.com/apache/superset.git synced 2026-09-08 16:25:03 +00:00

Files

T

History

Amin GhadersohiandClaude Fable 5 048cfae595 feat(mcp): per-resource token scopes with user-permission intersection

Adds superset:<resource>:<action> scope support to the MCP service:

- CompositeTokenVerifier now propagates an API key's own ApiKey.scopes
  (via a new SupersetSecurityManager.get_api_key_scopes lookup) instead
  of always stamping the verifier-global required_scopes on the token.
- check_tool_permission/_token_scope_allows accept a per-resource scope
  (e.g. superset:dashboard:read, derived from the tool's
  class_permission_name) as an alternative grant path alongside the
  existing flat superset:read/superset:write scopes, which keep working
  for already-issued tokens.
- SupersetSecurityManager.create_api_key validates requested scopes
  against the issuing user's own RBAC before delegating to FAB
  (intersection rule: a key can never be scoped beyond the user's own
  permissions; flat scopes are Admin-only to self-issue; unknown scopes
  are rejected).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-08-14 16:10:15 +00:00

__init__.py

…

api_test.py

test(security): assert intended trailing-slash behavior of security API (#29934 ) (#41965 )

2026-07-15 22:24:15 -07:00

audit_log_test.py

feat: introduce Subject model and entity editors/viewers (#38831 )

2026-07-08 11:00:03 -07:00

exclude_users_filter_test.py

chore: session enforce sqlalchemy 2.0 (#42365 )

2026-07-26 19:28:42 -07:00