[mikebridge]

SUMMARY

TL;DR: When SEMANTIC_LAYERS was off, the semantic-layer APIs returned 404 before checking login or permissions, so callers without access could tell whether the feature was enabled. Check permissions first: callers without access get the usual 401/403 in both states, and permitted callers still get 404 while the feature is off. This follows #45061, which is not yet in a release.

Replace the blueprint before_request availability check introduced by #45061 with one decorator immediately beneath each endpoint's existing protect() or protect_read() decorator. All sixteen exposed handlers are defined in these APIs; the SemanticView inclusion list excludes inherited ModelRestApi routes. API registration, startup configuration, and resource permissions remain unchanged. Remove ten redundant inline checks so each handler relies on the shared guard and evaluates availability once before entering its body. The feature decision still comes from the feature flag manager on each permitted request.

Public-role grants continue to work through FAB: anonymous callers with can_read on SemanticView can request a view's structure, subject to its datasource permissions. Flask's automatic OPTIONS responses return the same 200 and Allow header in either feature state, without entering a semantic handler.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

No UI changes. Before: an anonymous caller without a Public grant received 401 when enabled and 404 when disabled; a signed-in caller without permission received 403 versus 404. After: those callers receive 401 or 403 respectively in both states. Permitted requests retain 200 when enabled and 404 when disabled, and resource-level refusals remain in place.

TESTING INSTRUCTIONS

Run:

python -m pytest -q tests/unit_tests/semantic_layers/api_guard_order_test.py tests/unit_tests/semantic_layers/test_runtime_flag.py tests/unit_tests/semantic_layers/api_test.py tests/unit_tests/semantic_layers/connections_access_test.py tests/unit_tests/semantic_layers/test_access.py tests/unit_tests/semantic_layers/simple_cache_clear_test.py

The tests use registered Flask routes and real FAB permission checks, with in-memory principals and isolated metadata/provider lookups. They cover every exposed route, implicit HEAD, automatic OPTIONS, anonymous/Public-role/signed-in/guest callers, runtime toggle changes through the host callback, object-level refusals, and mixed bulk deletion. Removing the shared guard from each of the sixteen handlers, one at a time, makes the registered-route matrix fail. The tests do not exercise external identity providers or live semantic providers.

ADDITIONAL INFORMATION

• Has associated issue: follow-up to #45061
• Required feature flags: SEMANTIC_LAYERS
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

[netlify]

✅ Deploy Preview for superset-docs-preview ready!

Name	Link
🔨 Latest commit	ae1dc36
🔍 Latest deploy log	https://app.netlify.com/projects/superset-docs-preview/deploys/6ae8dc72b335d3192f262e84
😎 Deploy Preview	https://deploy-preview-45959--superset-docs-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.87%. Comparing base (11bf663) to head (5fb3354).
⚠️ Report is 15 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #45959      +/-   ##
==========================================
+ Coverage   84.79%   84.87%   +0.08%     
==========================================
  Files        3074     3075       +1     
  Lines      206435   207805    +1370     
  Branches    48651    48962     +311     
==========================================
+ Hits       175047   176376    +1329     
+ Misses      28089    28068      -21     
- Partials     3299     3361      +62     

Flag	Coverage Δ
hive	34.25% <90.62%> (-0.24%)	⬇️
mysql	52.27% <100.00%> (?)
postgres	52.28% <100.00%> (-0.34%)	⬇️
presto	35.96% <90.62%> (-0.26%)	⬇️
python	87.87% <100.00%> (+0.11%)	⬆️
sqlite	52.03% <100.00%> (-0.34%)	⬇️
unit	82.69% <100.00%> (+0.16%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[codeant-ai-for-open-source]

  CodeAnt PR Risk

🟢  Low Risk

• The PR appears safe to merge; no actionable issues were identified in the review.

Assessed commit: 5fb335498529