fix(roles): allow Public role to read themes

[sfirke]

SUMMARY

Fixes #37294

In #36548 a canned set of permissions for a Public role was added. This is great! We need to also add can read Theme, as without that, a dashboard becomes un-Public if it is assigned a theme.

TESTING INSTRUCTIONS

Create a public dashboard and verify it's accessible to unauthenticated user
Assign it a theme
Verify it's accessible (after this fix is applied) and inaccessible in Superset 6.0.0.

[codeant-ai-for-open-source]

CodeAnt AI is reviewing your PR.

---

Thanks for using CodeAnt! 🎉

We're free for open-source projects. if you're enjoying it, help us grow by sharing.

Share on X ·
Reddit ·
LinkedIn

[bito-code-review]

Code Review Agent Run #a8245c

Actionable Suggestions - 0

Review Details

• Files reviewed - 1 · Commit Range: bb26b5e..bb26b5e

  • superset/security/manager.py
• Files skipped - 0
• Tools

  • Whispers (Secret Scanner) - ✔︎ Successful
  • Detect-secrets (Secret Scanner) - ✔︎ Successful
  • MyPy (Static Code Analysis) - ✔︎ Successful
  • Astral Ruff (Static Code Analysis) - ✔︎ Successful

---

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

• /review - Manually triggers a full AI review.

• /pause - Pauses automatic reviews on this pull request.

• /resume - Resumes automatic reviews.

• /resolve - Marks all Bito-posted review comments as resolved.

• /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

• Customize agent settings
• Review rules
• General documentation
• FAQ

AI Code Review powered by

[codeant-ai-for-open-source]

Sequence Diagram

Shows the added permission check that lets unauthenticated (Public) users access a dashboard's theme so public dashboards remain viewable when a theme is assigned.

sequenceDiagram
    participant Unauthenticated User
    participant Web App
    participant SupersetSecurityManager
    participant Storage

    Unauthenticated User->>Web App: Request public dashboard
    Web App->>SupersetSecurityManager: Authorize as Public (check can_read Theme)
    SupersetSecurityManager-->>Web App: Allowed (can_read Theme)
    Web App->>Storage: Fetch dashboard and associated theme
    Storage-->>Web App: Dashboard + Theme
    Web App-->>Unauthenticated User: 200 OK (themed dashboard)

Loading

---

Generated by CodeAnt AI

[codeant-ai-for-open-source]

CodeAnt AI finished reviewing your PR.

[netlify]

✅ Deploy Preview for superset-docs-preview ready!

Name	Link
🔨 Latest commit	bb26b5e
🔍 Latest deploy log	https://app.netlify.com/projects/superset-docs-preview/deploys/696ff6701322b100082cf320
😎 Deploy Preview	https://deploy-preview-37295--superset-docs-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[Copilot]

Pull request overview

This PR fixes a bug where public dashboards become inaccessible when assigned a theme. The fix adds the can_read permission on Theme to the built-in Public role's permission set, enabling unauthenticated users to view dashboards with themes applied.

Changes:

• Added ("can_read", "Theme") permission to PUBLIC_ROLE_PERMISSIONS
• Updated comment to reflect that both CSS and themes are for dashboard styling

Comments suppressed due to low confidence (3)

superset/security/manager.py:1262

• Testing for None should use the 'is' operator.

                PermissionView.permission  # pylint: disable=singleton-comparison
                == None,  # noqa: E711

superset/security/manager.py:1264

• Testing for None should use the 'is' operator.

                PermissionView.view_menu  # pylint: disable=singleton-comparison
                == None,  # noqa: E711

superset/security/manager.py:261

• Nested for statement uses loop variable 'key' of enclosing for statement.

                for key in equivalent:

[Copilot]

Consider adding a test assertion for the Theme permission in the existing test_public_role_permissions method (e.g., assert ("can_read", "Theme") in public_perm_set). This would ensure the Theme permission is explicitly verified alongside CssTemplate and other styling-related permissions, providing better regression protection for the fix in issue #37294.

[bito-code-review]

The suggestion to add a test assertion for the Theme permission in test_public_role_permissions aligns with the PR's addition of Theme to public permissions, enhancing regression protection for issue #37294. It ensures Theme is verified alongside CssTemplate.