Set favorite chart is only possible for the chart owners

[brenot-a]

Bug description

1. Create chart with a user
2. Log with another user which has access to the chart
3. On welcome page, try to set chart as favorite

A 403 error occurs. When i look into the code, it's because i'm not the owner https://github.com/apache/superset/blob/5.0/superset/commands/chart/fave.py#L53. But shouldn't someone with access rights, but who is not an owner, be able to add it to their favorites ?

Screenshots/recordings

Try to set favorite with a user which is not the owner:

Error :

Superset version

5.0.0

Python version

3.11

Node version

18 or greater

Browser

Chrome

Additional context

No response

Checklist

• I have searched Superset docs and Slack and didn't find a solution to my problem.
• I have searched the GitHub issue tracker and didn't find a similar bug report.
• I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

[dosubot]

Hi @brenot-a! I'm Dosu and I’m helping the superset team.

In Superset 5.0.0, only chart owners (or admins) can favorite a chart because the backend explicitly checks for ownership in the AddFavoriteChartCommand by calling security_manager.raise_for_ownership(chart). If you're not an owner, this raises a forbidden error and blocks the action, even if you have access to view the chart. This is not configurable via roles or permissions and appears to be an intentional design choice in the current codebase, similar to how draft dashboards are restricted to owners for privacy and curation reasons see code reference.

If you want to allow users with access (not just owners) to favorite charts, you would need to modify the code to use raise_for_access instead of raise_for_ownership in the relevant command. This would let anyone with access to the chart's datasource favorite it, not just owners. Be aware that relaxing this restriction could have privacy or curation implications, depending on your organization's needs.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[rusackas]

Is this still the case in master/6.0.0rc3?

[rusackas]

One day we should replace the Favorites API/table in favor of Tags, and just have specialized tags for use cases like this. Anyone wanna open a SIP? ;)