fix(explore): hide Superset annotation source for users without annotation access - #43006
Open
endimonan wants to merge 2 commits into
Open
fix(explore): hide Superset annotation source for users without annotation access#43006endimonan wants to merge 2 commits into
endimonan wants to merge 2 commits into
Conversation
The annotation layer popover offered the "Superset annotation" source to everyone, but listing native annotation layers requires can_read on Annotation, which Gamma users don't have by default. The result was a raw "Forbidden" message inside the layer dropdown after several clicks (apache#34904). The option is now only offered when the user holds the permission, the same approach apache#34293 took for the SQL Lab button in ViewQuery. A layer that was already saved with the native source keeps the option visible so the saved configuration stays intact, but its layer selector is disabled with a short explanation and the known-forbidden requests are skipped entirely. Formula and chart-based annotations are unaffected. The applied-layer fetch also gains a catch handler, it used to be an unhandled rejection.
✅ Deploy Preview for superset-docs-preview ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #43006 +/- ##
==========================================
+ Coverage 66.41% 66.42% +0.01%
==========================================
Files 2858 2858
Lines 161446 161455 +9
Branches 37190 37197 +7
==========================================
+ Hits 107222 107246 +24
+ Misses 52187 52172 -15
Partials 2037 2037
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
endimonan
marked this pull request as ready for review
August 10, 2026 18:56
dosubot
Bot
added
authentication:access-control
rusackas
requested review from
EnxDev and
rusackas
and removed request for
rusackas
August 10, 2026 19:50
Contributor
Code Review Agent Run #1cebc0Actionable Suggestions - 0Review Details
Bito Usage GuideCommands Type the following command in the pull request comment and save the comment.
Refer to the documentation for additional commands. Configuration This repository uses Documentation & Help AI Code Review powered by |
rusackas
approved these changes
Aug 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SUMMARY
Fixes #34904. A Gamma user can create a chart but has no
can_readonAnnotation(intentional since #24826), so when they picked the "Superset annotation" source in the annotation layer popover, the layer dropdown fetched/api/v1/annotation_layer/, got a 403 and rendered a raw "Forbidden" message as if it were content.This hides the "Superset annotation" option from the annotation source select when the user doesn't hold the permission, which is the same approach #34293 took for the "View in SQL Lab" button in the same directory. The permission is computed in the connected control via
findPermission('can_read', 'Annotation', user.roles), mirroring the API gate, and passed down as a prop.mapStateToPropsis exported so the permission wiring itself is unit tested, since a missing state prop would silently fall through to untyped ownProps and hide the option for everyone.One special case: a chart may already have a saved native annotation layer, and those keep rendering for viewers today. For that case the source option stays visible so the saved configuration isn't invalidated, but the layer selector renders disabled with "You don't have permission to view annotation layers." and the known-forbidden requests (the listing and the fetch by id) are never fired. The user can still remove the layer, tweak its display settings or switch it to a chart-based source, and re-applying preserves the saved reference as is. Once switched away, the native option is gone.
Formula and chart-based annotation sources don't touch the annotation API and are unaffected. The fetch of the applied native layer also gains a catch handler, it used to be an unhandled promise rejection.
BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
Before (Gamma user): picking the "Superset annotation" source ends in a raw Forbidden error inside the layer dropdown.
After (same Gamma user): the source select no longer offers "Superset annotation" and chart sources keep working.
Admins keep the option.
TESTING INSTRUCTIONS
As a Gamma user (no
can_readonAnnotation), open a line chart in Explore, add an annotation layer of type Event or Interval and open the "Annotation source" select: "Superset annotation" should not be listed, while chart sources and Formula keep working. As Admin, the option is still there. To check the preserved case, have an Admin save a chart with a native annotation layer, then open it as Gamma: the layer still renders on the chart, and in the popover the source shows "Superset annotation" with the layer selector disabled and a permission note instead of the old Forbidden error.ADDITIONAL INFORMATION