fix(roles): Add missing SQLLab permissions for estimate and format

[shunki-fujita]

User description

Signed-off-by: shunki-fujita shunki-fujita@cybozu.co.jp

Close: #36261

SUMMARY

In Superset 5.0.0, the built-in sql_lab role does not include the required SQL Lab permissions:

• can estimate query cost on SQLLab
• can format sql on SQLLab

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

---

CodeAnt-AI Description

Grant sql_lab role permission to estimate query cost and format SQL in SQL Lab

What Changed

• Users with the built-in sql_lab role can now estimate query cost in SQL Lab (previously missing)
• Users with the built-in sql_lab role can now format SQL in SQL Lab (previously missing)
• Tests added/updated to enforce these permissions and prevent related permission errors

Impact

✅ Can estimate query cost in SQL Lab
✅ Can auto-format SQL in SQL Lab
✅ Fewer SQL Lab permission errors for users with the built-in sql_lab role

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Example

@codeant-ai ask: Can you suggest a safer alternative to storing this secret?

Preserve Org Learnings with CodeAnt

You can record team preferences so CodeAnt AI applies them in future reviews. Reply directly to the specific CodeAnt AI suggestion (in the same thread) and replace "Your feedback here" with your input:

@codeant-ai: Your feedback here

This helps CodeAnt AI learn and adapt to your team's coding style and standards.

Example

@codeant-ai: Do not flag unused imports.

Retrigger review

Ask CodeAnt AI to review the PR again, by typing:

@codeant-ai: review

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at https://app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

[bito-code-review]

Code Review Agent Run #7faa80

Actionable Suggestions - 0

Review Details

• Files reviewed - 1 · Commit Range: 2aa3f8c..2aa3f8c

  • superset/security/manager.py
• Files skipped - 0
• Tools

  • Whispers (Secret Scanner) - ✔︎ Successful
  • Detect-secrets (Secret Scanner) - ✔︎ Successful
  • MyPy (Static Code Analysis) - ✔︎ Successful
  • Astral Ruff (Static Code Analysis) - ✔︎ Successful

---

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

• /review - Manually triggers a full AI review.

• /pause - Pauses automatic reviews on this pull request.

• /resume - Resumes automatic reviews.

• /resolve - Marks all Bito-posted review comments as resolved.

• /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Default Agent You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

• Customize agent settings
• Review rules
• General documentation
• FAQ

AI Code Review powered by

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 67.97%. Comparing base (062e4a2) to head (b2b9b12).
⚠️ Report is 174 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff             @@
##           master   #36263       +/-   ##
===========================================
+ Coverage        0   67.97%   +67.97%     
===========================================
  Files           0      634      +634     
  Lines           0    46727    +46727     
  Branches        0     5070     +5070     
===========================================
+ Hits            0    31763    +31763     
- Misses          0    13697    +13697     
- Partials        0     1267     +1267     

Flag	Coverage Δ
hive	43.71% <ø> (?)
mysql	67.03% <ø> (?)
postgres	67.08% <ø> (?)
presto	47.35% <ø> (?)
python	67.94% <ø> (?)
sqlite	66.79% <ø> (?)
unit	100.00% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[rusackas]

Looks like pre-commit is failing, which should clear up CI (or at least some of it)

Superset uses Git pre-commit hooks courtesy of pre-commit. To install run the following:

pip3 install -r requirements/development.txt
pre-commit install

A series of checks will now run when you make a git commit.

Alternatively it is possible to run pre-commit by running pre-commit manually:

pre-commit run --all-files

[codeant-ai-for-open-source]

CodeAnt AI is reviewing your PR.

[codeant-ai-for-open-source]

Nitpicks 🔍

🔒 No security issues identified

⚡ Recommended areas for review Permission existence / naming New expected permissions (can_estimate_query_cost, can_format_sql) must exactly match the permission/view-menu names used when creating permissions in the security manager / FAB roles. Validate that the security role definition and permission creation code actually register view-menus with those exact names and spellings; otherwise the test will fail even if permissions exist under a slightly different name.

[codeant-ai-for-open-source]

CodeAnt AI finished reviewing your PR.

[rusackas]

Running CI... if it turns green, I reckon we can merge!