Amin Ghadersohi 9ca3f8ec01 fix(mcp): deny all tools on invalid credentials in search filtering ...

Split the combined except clause in _tool_allowed_for_current_user so
that PermissionError (bad API key) returns False for every tool,
matching RBACToolVisibilityMiddleware's fail-closed behaviour.
ValueError (no auth source configured) retains the existing public-tool
fallback. Adds a test to cover the new deny-all path.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-20 21:49:39 +00:00

..

advanced_data_type

chore: enforce more ruff rules (#31447)

2024-12-18 17:41:34 -08:00

annotation_layers

chore: set up ruff as a new linter/formatter (#28158)

2024-04-24 17:19:53 -07:00

async_events

chore(GAQ): Remove GLOBAL_ASYNC_QUERIES_REDIS_CONFIG (#30284)

2025-01-21 20:03:00 -08:00

charts

fix(charts): set g.form_data for metric() Jinja macro on GET chart data endpoint (#39347)

2026-04-20 19:36:03 -07:00

columns

chore: remove sl_ tables (#28704)

2024-05-29 19:04:37 -07:00

commands

test(reports): regression for alerts CSV missing chart time filters (#25538) (#40232)

2026-05-20 11:42:52 -07:00

common

fix(time-comparison): use chart row_limit instead of instance config in offset queries (#39490)

2026-05-01 16:24:59 -07:00

connectors

test(datasets): regression test for Jinja not rendered on sync columns (#25839) (#40224)

2026-05-20 11:46:36 -07:00

dao

fix(query): restrict query cancellation to the query owner (#39996)

2026-05-15 12:05:38 +01:00

daos

fix(reports): escape SQL LIKE wildcards in find_by_extra_metadata (#38738)

2026-04-09 12:58:06 +03:00

dashboards

fix(dashboard-import): remap chartsInScope on import (#26338) (#40140)

2026-05-20 13:41:14 -07:00

databases

fix: OAuth2 exception should be 403 (#40074)

2026-05-15 14:53:02 -03:00

datasets

fix(dataset): validate datasource access during import (#39998)

2026-05-15 12:06:47 +01:00

datasource

feat: semantic layer extension (#37815)

2026-05-05 12:07:46 -04:00

db_engine_specs

fix: escape SQL identifiers in db engine spec prequeries and metadata queries (#39840)

2026-05-15 09:48:38 -04:00

distributed_lock

feat: add global task framework (#36368)

2026-02-09 10:45:56 -08:00

examples

test(examples): add tests for UUID threading and security bypass (#37557)

2026-02-12 14:12:12 -08:00

explore

chore: enforce more ruff rules (#31447)

2024-12-18 17:41:34 -08:00

extensions

fix(extensions): add cache headers and strip Vary: Cookie for extension static assets (#40120)

2026-05-15 09:23:39 -03:00

fixtures

fix(dev/ci): pre-commit fixes galore (#32352)

2025-02-24 11:26:45 -07:00

importexport

fix(importexport): honor overwrite flag on /api/v1/assets/import (#39502)

2026-05-11 10:24:42 -07:00

key_value

feat: add option for hash algorithms (#35621)

2025-12-09 16:59:07 +00:00

mcp_service

fix(mcp): deny all tools on invalid credentials in search filtering

2026-05-20 21:49:39 +00:00

migrations

refactor: Enable G logging rules and comprehensive ruff improvements (#35081)

2025-09-15 12:42:49 -07:00

models

test(helpers): regression for humanize locale activation (#28331) (#40233)

2026-05-20 11:42:17 -07:00

pandas_postprocessing

test(prophet): pin yhat_lower can be negative for negative series (#21734) (#40141)

2026-05-18 07:21:04 -07:00

queries

fix: Enforce per-user caching on legacy API endpoint (#39789)

2026-04-30 18:04:33 -03:00

reports

fix(reports): enforce server-side recipient on chart/dashboard report subscriptions (#38847)

2026-05-20 10:36:42 -07:00

scripts

chore: enforce more ruff rules (#31447)

2024-12-18 17:41:34 -08:00

security

feat: semantic layer extension (#37815)

2026-05-05 12:07:46 -04:00

semantic_layers

feat: semantic layer extension (#37815)

2026-05-05 12:07:46 -04:00

sql

test(sql-parser): pin WITH+UNION as non-mutating across dialects (#25659) (#40138)

2026-05-20 10:08:21 -07:00

sql_validators

feat(sqllab): syntax validation for sqlite-based DB engine specs (#38698)

2026-04-20 18:29:51 -04:00

tables

chore: remove sl_ tables (#28704)

2024-05-29 19:04:37 -07:00

tags

fix(tags): expire tag relationship after deleting all tagged objects (#38163)

2026-03-04 10:37:19 -03:00

tasks

fix(OAuth2): Support OAuth2 exception with legacy endpoint (#39897)

2026-05-05 21:21:48 -03:00

themes

feat(theming): add per-theme custom font URL support (#36317)

2025-12-08 16:46:01 -08:00

thumbnails

fix(thumbnails): stabilize digest by sorting datasources and charts (#38079)

2026-02-20 09:51:35 +01:00

utils

fix(OAuth2): Re-query the OAuth2 token to avoid stale reference (#40071)

2026-05-18 13:07:54 -03:00

views

fix(rls): align view permission name with REST API canonical name (#33744) (#40145)

2026-05-17 19:57:57 -07:00

__init__.py

…

config_test.py

chore: proper current_app.config proxy usage (#34345)

2025-07-31 19:27:42 -07:00

conftest.py

fix: Bump FAB to 5.X (#33055)

2025-09-12 09:21:37 +01:00

core_tests.py

chore: enforce more ruff rules (#31447)

2024-12-18 17:41:34 -08:00

dataframe_test.py

fix(api): nan is not properly handled for athena connections (#37071)

2026-01-22 18:29:09 +03:00

extension_tests.py

fix(reports): keep body sized so standalone screenshots don't time out (#39944)

2026-05-07 12:26:50 +02:00

feature_flag_test.py

chore: s/MockFixture/MockerFixture/g (#29160)

2024-06-10 12:35:07 -04:00

initialization_test.py

chore: Support specifying app_root via superset_config.py (#38284)

2026-02-28 01:35:08 -03:00

jinja_context_test.py

fix(jinja): drill-to-detail respects remove_filter=True in Jinja templates (#39594)

2026-04-23 16:11:13 -03:00

legacy_tests.py

chore: set up ruff as a new linter/formatter (#28158)

2024-04-24 17:19:53 -07:00

result_set_test.py

fix(SQL Lab): handle columns without names (#38986)

2026-04-06 10:09:16 -04:00

sql_lab_execution_context.py

chore: enforce more ruff rules (#31447)

2024-12-18 17:41:34 -08:00

sql_lab_test.py

fix(rls): prevent double-apply when converting physical dataset to virtual (#39725)

2026-05-14 18:05:48 +03:00

test_viz_cache_key.py

fix: Enforce per-user caching on legacy API endpoint (#39789)

2026-04-30 18:04:33 -03:00

test_viz_get_df_payload.py

fix(OAuth2): Support OAuth2 exception with legacy endpoint (#39897)

2026-05-05 21:21:48 -03:00