fix: correct Security menu case for MySQL deployments by rusackas · Pull Request #40527 · apache/superset

rusackas · 2026-05-29T17:18:06Z

SUMMARY

On MySQL (and MariaDB) with the default case-insensitive collation, the Security menu — containing List Users, List Roles, and List Groups — disappears for admin users after a fresh install or upgrade.

Root cause: Five Superset views (UsersListView, RolesListView, GroupsListView, ActionLogView, UserRegistrationsView) declared class_permission_name = "security" (lowercase). Flask-AppBuilder uses this string as the key to look up or insert a row in the ab_view_menu table. On MySQL, WHERE name = 'security' matches 'Security' (case-insensitive), so whichever casing is inserted first wins. The DB ends up with a lowercase "security" row, while all of Superset's Python comparisons (m.name == "Security", ADMIN_ONLY_VIEW_MENUS, etc.) are case-sensitive — causing them to silently miss the row.

Fix:

Change class_permission_name to "Security" in all five view files so FAB registers the correct name from the start.
Add migration b4a3f2e1d0c9 to normalise existing databases:
- If only "security" exists → rename to "Security".
- If both exist (possible on SQLite/PostgreSQL with old code) → merge ab_permission_view rows into the correctly-cased entry and delete the duplicate.

The workaround documented in discussions (UPDATE ab_view_menu SET name='Security' WHERE name='security') is exactly what this migration automates.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

Not applicable — the Security menu either appears or doesn't; no visual diff available in this environment.

TESTING INSTRUCTIONS

Fresh MySQL install (reproduces the bug):

# 1. Point SUPERSET_CONFIG to a MySQL metadata DB
# 2. superset db upgrade
# 3. superset fab create-admin
# 4. superset init
# 5. Log in as admin → Settings menu should show List Users / List Roles / List Groups

Upgrade path (migration):

superset db upgrade  # runs migration b4a3f2e1d0c9
# Verify: SELECT name FROM ab_view_menu WHERE LOWER(name)='security';
# Should return exactly one row: 'Security'

Unit test:

pytest tests/unit_tests/security/test_security_manager.py -v -k security

ADDITIONAL INFORMATION

Has associated issue: Fixes superset 6.1.0 -Critical Issue , setting menu to handle roles and user is missing . #40330. Closes fix: #33862 – Security menu missing on MySQL due to case mismatch #33864. Fixes Superset V6, Security Menu missing in the settings #37097
Required feature flags:
Changes UI
Includes DB Migration (follow approval process in SIP-59)
- Migration is atomic, supports rollback & is backwards-compatible
- Confirm DB migration upgrade and downgrade tested
- Runtime estimates and downtime expectations provided
Introduces new feature or API
Removes existing feature or API

Migration notes: The migration is a simple UPDATE (or merge) on ab_view_menu. Row count is at most a handful of rows; downtime is zero. Downgrade is a no-op (there is no safe way to restore the original incorrect casing without knowing which state the DB was in).

🤖 Generated with Claude Code

bito-code-review · 2026-05-29T17:18:20Z

Code Review Agent Run #832168

Actionable Suggestions - 0

Review Details

Files reviewed - 6 · Commit Range: 2063484..2063484
- superset/migrations/versions/2026-05-29_00-00_b4a3f2e1d0c9_fix_security_view_menu_case.py
- superset/views/groups.py
- superset/views/logs.py
- superset/views/roles.py
- superset/views/user_registrations.py
- superset/views/users_list.py
Files skipped - 0
Tools
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers a full AI review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

github-actions · 2026-05-29T17:18:34Z

Congrats on making your first PR and thank you for contributing to Superset! 🎉 ❤️

Please read our New Contributor Welcome & Expectations guide.

We hope to see you in our Slack community too! Not signed up? Use our Slack App to self-register.

codecov · 2026-05-29T17:45:34Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 64.58%. Comparing base (be46d65) to head (661a061).
⚠️ Report is 30 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #40527      +/-   ##
==========================================
- Coverage   64.60%   64.58%   -0.02%     
==========================================
  Files        2684     2684              
  Lines      148267   148366      +99     
  Branches    34150    34180      +30     
==========================================
+ Hits        95785    95828      +43     
- Misses      50740    50781      +41     
- Partials     1742     1757      +15

Flag	Coverage Δ
hive	`39.19% <100.00%> (-0.04%)`	⬇️
mysql	`57.82% <100.00%> (-0.01%)`	⬇️
postgres	`57.89% <100.00%> (-0.01%)`	⬇️
presto	`40.74% <100.00%> (-0.03%)`	⬇️
python	`59.28% <100.00%> (-0.01%)`	⬇️
sqlite	`57.46% <100.00%> (-0.01%)`	⬇️
unit	`100.00% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

bito-code-review · 2026-05-29T20:32:51Z

Code Review Agent Run #bd40ce

Actionable Suggestions - 0

Review Details

Files reviewed - 1 · Commit Range: 2063484..7f80426
- superset/migrations/versions/2026-05-29_00-00_b4a3f2e1d0c9_fix_security_view_menu_case.py
Files skipped - 0
Tools
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers a full AI review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

bito-code-review · 2026-05-29T23:48:52Z

Code Review Agent Run #446e08

Actionable Suggestions - 0

Review Details

Files reviewed - 1 · Commit Range: 7f80426..95b46bc
- superset/migrations/versions/2026-05-29_00-00_b4a3f2e1d0c9_fix_security_view_menu_case.py
Files skipped - 0
Tools
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers a full AI review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

hainenber · 2026-05-30T04:54:02Z

I haven't heard any cases with non-MySQL metadata database deployment so might be we can limit this migration to such dialect?

For example,

from alembic import op

dialect = op.get_bind().dialect.name
if dialect == "mysql":
   # do migration

rusackas · 2026-06-10T23:22:05Z

@hainenber I'm inclined to keep it dialect-agnostic. That stray lowercase security row can also show up on Postgres/SQLite installs that ran the old code, and the migration no-ops when there's nothing to normalize... so gating on MySQL would skip cleanup that's still needed without buying us much. Does that track for you?

bito-code-review · 2026-06-11T02:23:27Z

Code Review Agent Run #41875b

Actionable Suggestions - 0

Review Details

Files reviewed - 1 · Commit Range: 95b46bc..5e0b430
- superset/migrations/versions/2026-05-29_00-00_b4a3f2e1d0c9_fix_security_view_menu_case.py
Files skipped - 0
Tools
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers a full AI review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

betodealmeida · 2026-06-16T18:26:56Z

 class GroupsListView(BaseSupersetView):
    route_base = "/"
-    class_permission_name = "security"
+    class_permission_name = "Security"


It seems to me that we're changing an internal property just to make the UI work. Can we instead change how the menus are surfaced? Maybe using lower() in the comparison?

The catch is that "security" lowercase in these five views is the actual outlier. Every other view uses its properly cased name, and the ADMIN_ONLY_VIEW_MENUS / PUBLIC_EXCLUDED_VIEW_MENUS both key off "Security". So this isn't inventing a value to please the UI so much as bringing five stragglers in line with the name everything else already expects.

lower() would be tempting, but the case-sensitive comparisons aren't in one place. Some are in our _is_admin_only, but plenty live in FAB itself (the menu builder, add_permission_view_menu...) which we'd have to override as well. Also, normalizing it in the code while the DB stores it in the other casing has the same collation quirk that caused the bug, so it feels more like a ban-aid. Existing installs already have the stray row too, so the migration's needed either way.

netlify · 2026-07-01T21:06:48Z

✅ Deploy Preview for superset-docs-preview ready!

Name	Link
🔨 Latest commit	`e6d5741`
🔍 Latest deploy log	https://app.netlify.com/projects/superset-docs-preview/deploys/6a46a0c5508c530008bbd08c
😎 Deploy Preview	https://deploy-preview-40527--superset-docs-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

bito-code-review · 2026-07-02T00:06:11Z

Code Review Agent Run #a1318e

Actionable Suggestions - 0

Review Details

Files reviewed - 1 · Commit Range: 5e0b430..9b4e0d7
- superset/migrations/versions/2026-05-29_00-00_b4a3f2e1d0c9_fix_security_view_menu_case.py
Files skipped - 0
Tools
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers a full AI review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

…iews Five views that back the Security menu navbar items declared `class_permission_name = "security"` (lowercase). Flask-AppBuilder uses this name to look up or insert the corresponding `ab_view_menu` row. On MySQL's default case-insensitive collation, the lookup finds whatever row exists first, meaning the DB can end up storing `"security"` instead of `"Security"`. Because Superset's Python comparisons in `sync_role_definitions` and `SupersetSecurityManager` are case-sensitive, `"security" != "Security"` → the Security menu disappears from the UI on MySQL/MariaDB deployments. Fixes: - Change `class_permission_name` to `"Security"` in users_list.py, roles.py, groups.py, logs.py, and user_registrations.py. - Add migration `b4a3f2e1d0c9` that normalises any existing lowercase `"security"` row: renames it to `"Security"` if it is the only row, or merges its `ab_permission_view` entries into the correctly-cased row and deletes the duplicate if both exist. Closes #40330 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…erge - Point down_revision to ce6bd21901ab (the actual current chain head, not a1b2c3d4e5f6 which already had two successors) - In the "both rows exist" merge path, transfer ab_permission_view_role bindings from the lowercase PVM to the surviving uppercase PVM before deleting the duplicate, so no role silently loses a Security permission Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Previous commits used a1b2c3d4e5f6 then ce6bd21901ab, both of which are mid-chain on master. The true head is 33d7e0e21daa (add_semantic_layers). Branching off mid-chain caused 'Multiple head revisions' in CI. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…c05) Master's single head advanced to 31dae2559c05; this migration still pointed at 33d7e0e21daa, making it a sibling and producing multiple alembic heads. Re-point so the chain is linear. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Co-authored-by: Joe Li <joe@preset.io>

…ent head Re-anchor the migration onto the current single head (9e1f3b8c4d2a) to resolve the multiple-heads branch, and add integration tests covering the lowercase-only rename, the duplicate-row merge with role-binding survival, and the clean-install no-op. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bito-code-review · 2026-07-02T20:36:10Z

Code Review Agent Run #1b7a56

Actionable Suggestions - 0

Filtered by Review Rules

Bito filtered these suggestions based on rules created automatically for your feedback. Manage rules.

superset/migrations/versions/2026-05-29_00-00_b4a3f2e1d0c9_fix_security_view_menu_case.py - 1
- Missing commit error handling · Line 116-119

Review Details

Files reviewed - 7 · Commit Range: 60e17f6..e6d5741
- superset/migrations/versions/2026-05-29_00-00_b4a3f2e1d0c9_fix_security_view_menu_case.py
- superset/views/groups.py
- superset/views/logs.py
- superset/views/roles.py
- superset/views/user_registrations.py
- superset/views/users_list.py
- tests/integration_tests/migrations/b4a3f2e1d0c9_fix_security_view_menu_case__tests.py
Files skipped - 0
Tools
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers a full AI review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

…ware MySQL's default case-insensitive collation on ab_view_menu.name means filter_by(name='security') also matches 'Security', and the unique key cannot hold both spellings at once. Assert exact-case names in Python and skip the duplicate-row merge scenario on MySQL, where that state cannot be arranged. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bito-code-review · 2026-07-03T02:27:28Z

Bito Automatic Review Skipped – PR Already Merged

Bito scheduled an automatic review for this pull request, but the review was skipped because this PR was merged before the review could be run.
No action is needed if you didn't intend to review it. To get a review, you can type /review in a comment and save it

@rusackas

… head Master's migration head moved to b4a3f2e1d0c9 (apache#40527) after the last rebase; chaining off it restores the single-head invariant (per @rusackas's review note). No schema change.

@rusackas

… head Master's migration head moved to b4a3f2e1d0c9 (apache#40527) after the last rebase; chaining off it restores the single-head invariant (per @rusackas's review note). No schema change.

… head Master's migration head moved to b4a3f2e1d0c9 (apache#40527); chaining off it restores the single-head invariant. Note: if the charts sibling (apache#40129) merges first, this needs one final re-point onto 7c4a8d09ca37. No schema change.

rusackas requested review from betodealmeida, eschutho, michael-s-molina, mistercrunch and sadpandajoe as code owners May 29, 2026 17:18

pull-request-size Bot added the size/L label May 29, 2026

dosubot Bot added the change:backend Requires changing the backend label May 29, 2026

github-actions Bot added the risk:db-migration PRs that require a DB migration label May 29, 2026

rusackas mentioned this pull request May 29, 2026

docs: add note for mitigation of missing Security menu when used MySQL in Superset 6 #40388

Closed

9 tasks

codeant-ai-for-open-source Bot reviewed May 29, 2026

View reviewed changes

Comment thread superset/migrations/versions/2026-05-29_00-00_b4a3f2e1d0c9_fix_security_view_menu_case.py Outdated

Comment thread superset/migrations/versions/2026-05-29_00-00_b4a3f2e1d0c9_fix_security_view_menu_case.py Outdated

rusackas requested review from hainenber and villebro June 1, 2026 18:49

rusackas changed the title ~~fix(security): correct Security menu case for MySQL deployments~~ fix: correct Security menu case for MySQL deployments Jun 2, 2026

github-actions Bot added the preset-io label Jun 2, 2026

rusackas mentioned this pull request Jun 16, 2026

fix: #33862 – Security menu missing on MySQL due to case mismatch #33864

Closed

betodealmeida reviewed Jun 16, 2026

View reviewed changes

sadpandajoe reviewed Jun 29, 2026

View reviewed changes

Comment thread superset/migrations/versions/2026-05-29_00-00_b4a3f2e1d0c9_fix_security_view_menu_case.py Outdated

sadpandajoe reviewed Jul 1, 2026

View reviewed changes

Comment thread superset/migrations/versions/2026-05-29_00-00_b4a3f2e1d0c9_fix_security_view_menu_case.py Outdated

sadpandajoe reviewed Jul 1, 2026

View reviewed changes

Comment thread superset/migrations/versions/2026-05-29_00-00_b4a3f2e1d0c9_fix_security_view_menu_case.py Outdated

sadpandajoe approved these changes Jul 1, 2026

View reviewed changes

sadpandajoe added the merge-if-green If approved and tests are green, please go ahead and merge it for me label Jul 1, 2026

rusackas and others added 6 commits July 2, 2026 10:14

update down revision

3f5b48d

Co-authored-by: Joe Li <joe@preset.io>

rusackas force-pushed the fix/security-menu-case-mysql branch from 9b4e0d7 to e6d5741 Compare July 2, 2026 17:29

rusackas merged commit 47bc3e2 into master Jul 3, 2026
60 checks passed

rusackas deleted the fix/security-menu-case-mysql branch July 3, 2026 00:23

mikebridge mentioned this pull request Jul 6, 2026

feat(charts): soft-delete and restore #40129

Merged

9 tasks

Uh oh!

Conversation

rusackas commented May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

SUMMARY

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

Uh oh!

bito-code-review Bot commented May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #832168

Uh oh!

github-actions Bot commented May 29, 2026

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

bito-code-review Bot commented May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #bd40ce

Uh oh!

bito-code-review Bot commented May 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #446e08

Uh oh!

hainenber commented May 30, 2026

Uh oh!

rusackas commented Jun 10, 2026

Uh oh!

bito-code-review Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #41875b

Uh oh!

betodealmeida Jun 16, 2026

Choose a reason for hiding this comment

Uh oh!

rusackas Jun 18, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

netlify Bot commented Jul 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for superset-docs-preview ready!

Uh oh!

bito-code-review Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #a1318e

Uh oh!

bito-code-review Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #1b7a56

Uh oh!

Uh oh!

bito-code-review Bot commented Jul 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

rusackas commented May 29, 2026 •

edited

Loading

bito-code-review Bot commented May 29, 2026 •

edited

Loading

codecov Bot commented May 29, 2026 •

edited

Loading

bito-code-review Bot commented May 29, 2026 •

edited

Loading

bito-code-review Bot commented May 29, 2026 •

edited

Loading

bito-code-review Bot commented Jun 11, 2026 •

edited

Loading

netlify Bot commented Jul 1, 2026 •

edited

Loading

bito-code-review Bot commented Jul 2, 2026 •

edited

Loading

bito-code-review Bot commented Jul 2, 2026 •

edited

Loading