Superset Dev 13af5cc865 fix(security): make user-registrations API admin-only and read-only ...

The REST counterpart of the "User Registrations" FAB view was never
added to ADMIN_ONLY_VIEW_MENUS, so role sync granted its list/get/
delete permissions to stock Gamma and Alpha, exposing pending
registrants' PII and letting non-admins cancel registrations. Add
"UserRegistrationsRestAPI" to the admin-only allowlist and restrict
the API to its GET/GET_LIST/INFO routes so write handlers are never
registered at all, even if the allowlist entry regresses later.

2026-08-21 00:44:50 -07:00

..

__init__.py

…

api_test.py

fix(security): make user-registrations API admin-only and read-only

2026-08-21 00:44:50 -07:00

audit_log_test.py

feat: introduce Subject model and entity editors/viewers (#38831)

2026-07-08 11:00:03 -07:00

exclude_users_filter_test.py

chore: Unset future flag in engines and sessions. (#43273)

2026-08-20 10:58:37 -07:00

guest_rls_test.py

feat(mcp): chart type plugin registry for extensible generate_chart (#39922)

2026-07-02 00:31:19 -04:00

guest_token_audit_test.py

feat(security): record audit metadata on guest token issuance (#41305)

2026-06-23 11:25:44 -07:00

guest_token_revocation_test.py

feat(embedded): add guest token revocation support (#40671)

2026-06-10 09:17:30 -07:00

manager_test.py

fix(api): improved request handling and embedded dashboard scoping (#42930)

2026-08-17 23:50:25 -07:00

test_api_key_scopes.py

feat(mcp): per-resource token scopes with user-permission intersection (#42297)

2026-08-18 13:11:27 -04:00

test_audit_event_metrics.py

feat(subjects): scope principal listings and default new assets to creator groups (#42472)

2026-07-29 14:36:45 +02:00

test_embedded_guest_chart_access.py

fix(embedded): restore chart rendering for guest dashboards (#43095)

2026-08-13 05:38:57 -07:00

test_granular_export_permissions.py

fix(mcp): API key authentication for MCP — transport, validation, and RBAC (#39604)

2026-06-04 15:04:43 -04:00

test_guest_token_dataset_allowlist.py

fix(embedding): add optional dataset allowlist to guest tokens (#39302)

2026-06-03 12:55:09 +01:00

test_guest_token_revocation.py

feat: support guest-token revocation per embedded dashboard (#40676)

2026-06-11 19:37:22 -07:00

test_password_change_session_invalidation.py

fix(security): harden account password-change and session-invalidation handling (#42934)

2026-08-18 17:40:08 +01:00

test_password_change.py

feat(security): force password change on first use (opt-in) (#40669)

2026-06-11 22:23:10 -07:00

test_password_complexity.py

feat(security): enforce password complexity policy (min length + common-password blocklist) (#40670)

2026-06-13 16:31:23 -07:00

test_permission_hooks.py

feat: introduce Subject model and entity editors/viewers (#38831)

2026-07-08 11:00:03 -07:00

test_permission_instructions_link.py

feat(security): actionable, request-access-aware data permission errors (#41843)

2026-08-08 11:51:15 -07:00

test_session_invalidation.py

feat: terminate active sessions when an account is disabled (#40695)

2026-06-11 19:37:13 -07:00

test_superset_user_api_subject_sync.py

fix(security): harden account password-change and session-invalidation handling (#42934)

2026-08-18 17:40:08 +01:00