feat(extensions): import/delete UI and default chatbot selection in ExtensionsList by EnxDev · Pull Request #40450 · apache/superset

EnxDev · 2026-05-26T18:53:03Z

SUMMARY

Adds three new capabilities to the Extensions management page:

Import extension — a download icon button in the SubMenu opens a file picker restricted to .supx files. On selection, the file is uploaded via POST /api/v1/extensions/ (new endpoint), validated (zip integrity + safe-zip check), and persisted to EXTENSIONS_PATH. The list refreshes automatically.
Delete extension — a trash icon in the Actions column (with confirmation dialog) calls DELETE /api/v1/extensions/<publisher>/<name> (new endpoint). Local extensions configured via LOCAL_EXTENSIONS are rejected with a clear error. Uploaded .supx files are removed from EXTENSIONS_PATH.
Set default chatbot — a star icon in the Actions column calls PUT /api/v1/extensions/settings with the selected extension's ID as active_chatbot_id. The filled star indicates the current active chatbot. Clicking the filled star clears the selection. The change is propagated immediately via notifyExtensionSettingsChanged() so ChatbotMount updates without a page reload.

Also includes:

Settings pub/sub (notifyExtensionSettingsChanged / subscribeToExtensionSettings) in src/core/extensions so components can react to admin setting changes without Redux or a page reload.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

Before: Extensions list shows only extension names with no actions.

After: Extensions list has a Publisher column, an import button in the header, and per-row star (default chatbot) and trash (delete) action buttons.

TESTING INSTRUCTIONS

Set EXTENSIONS_PATH in your superset_config.py.
Navigate to Settings → Extensions.
Import: Click the download icon → select a .supx file → the extension appears in the list.
Delete: Click the trash icon on an uploaded extension → confirm → extension is removed from the list.
Default chatbot: Click the star icon on an extension with a chatbot → star fills → chatbot mount updates without a page reload. Click again → star clears → chatbot is deselected.
Verify that clicking the star/delete on a LOCAL_EXTENSIONS entry returns an appropriate error for delete (local extensions cannot be deleted through the UI).

ADDITIONAL INFORMATION

Has associated issue:
Required feature flags:
Changes UI
Includes DB Migration (follow approval process in SIP-59)
Introduces new feature or API
Removes existing feature or API

…sionsList Backend: - POST /api/v1/extensions/ — admin-only upload of .supx bundles (zip validation, safe-zip check, persisted to EXTENSIONS_PATH) - DELETE /api/v1/extensions/<publisher>/<name> — admin-only removal; rejects LOCAL_EXTENSIONS configured entries Frontend: - Import button in SubMenu (file picker, .supx only) calls upload endpoint - Per-row delete action with confirmation dialog - Per-row star action to set/clear default chatbot via PUT /settings; filled star indicates the active chatbot, fires notifyExtensionSettingsChanged so ChatbotMount reacts without a page reload Settings pub/sub (notifyExtensionSettingsChanged / subscribeToExtensionSettings) allows components to react to admin settings changes without a page reload. Also fix scripts/oxlint.sh: [ -n "$output" ] && echo would exit 1 under set -e when output is empty (no lint errors). Use if/fi instead. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

bito-code-review · 2026-05-26T18:53:14Z

Bito Automatic Review Skipped - Branch Excluded

Bito didn't auto-review because the source or target branch is excluded from automatic reviews.
No action is needed if you didn't intend for the agent to review it. Otherwise, to manually trigger a review, type /review in a comment and save.
You can change the branch exclusion settings here, or contact your Bito workspace admin at evan@preset.io.

netlify · 2026-05-26T18:55:53Z

✅ Deploy Preview for superset-docs-preview ready!

Name	Link
🔨 Latest commit	`e40f08a`
🔍 Latest deploy log	https://app.netlify.com/projects/superset-docs-preview/deploys/6a15ec13a02218000804f3af
😎 Deploy Preview	https://deploy-preview-40450--superset-docs-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

codecov · 2026-05-26T19:06:27Z

Codecov Report

❌ Patch coverage is 29.71888% with 175 lines in your changes missing coverage. Please review.
✅ Project coverage is 63.52%. Comparing base (b0d2619) to head (87b3a84).

Files with missing lines	Patch %	Lines
superset/extensions/api.py	0.00%	91 Missing ⚠️
superset/extensions/settings.py	0.00%	48 Missing ⚠️
superset-frontend/src/core/views/index.ts	40.00%	12 Missing ⚠️
...uperset-frontend/src/extensions/ExtensionsList.tsx	86.30%	10 Missing ⚠️
superset/extensions/models.py	0.00%	10 Missing ⚠️
superset-frontend/src/core/extensions/index.ts	42.85%	4 Missing ⚠️

Additional details and impacted files

@@                    Coverage Diff                    @@
##           enxdev/chat-prototype   #40450      +/-   ##
=========================================================
- Coverage                  64.18%   63.52%   -0.66%     
=========================================================
  Files                       2592     2594       +2     
  Lines                     139036   139284     +248     
  Branches                   32282    32324      +42     
=========================================================
- Hits                       89244    88485     -759     
- Misses                     48260    49267    +1007     
  Partials                    1532     1532

Flag	Coverage Δ
javascript	`67.29% <74.00%> (+<0.01%)`	⬆️
unit	`?`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

The ExtensionsList delete URL and Publisher column require a publisher field from the API, but build_extension_data did not include it. Add manifest.publisher to the response payload so the frontend can build /api/v1/extensions/<publisher>/<name> correctly. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…ensions The star (set as default chatbot) action in ExtensionsList is now only rendered for extensions that have registered a view at superset.chatbot. - Add subscribeToLocation / getRegisteredViewIds / getViewProvider to src/core/views/index.ts so callers can query and subscribe to the runtime view registry without depending on base-branch-only modules - ExtensionsList initialises chatbotExtensionIds from getRegisteredViewIds on mount and keeps it live via subscribeToLocation, so the star appears as soon as a chatbot extension loads without a page refresh - The star action is conditionally rendered only when isChatbot is true Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

The oxlint.sh fix (set -e / [ -n "" ] false-positive exit) is unrelated to extension import/delete and should not be in this PR. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

- api.py: add _validate_segment() to block path-traversal in publisher/name params; enforce EXTENSIONS_MAX_UPLOAD_SIZE; return 409 on LOCAL_EXTENSIONS collision; comment explains manifest-derived dest filename - ExtensionsList.tsx: unique Tooltip ids per row (id={`...-${original.id}`}); onKeyDown Enter/Space on star and delete role=button spans; data-test attrs for testability; remove stale loading from columns useMemo deps - ExtensionsList.test.tsx: 10 new tests covering upload validation, delete confirm flow, star toggle, and keyboard interaction - tests/unit_tests/extensions/test_api.py: 19 unit tests for POST/DELETE endpoints covering auth, validation, zip-slip, size, collision, and happy paths Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…sal, tests, useCallback - Add Alembic migration for extension_settings and extension_enabled tables - Validate manifest.id segments before building dest_file path to prevent crafted bundles from escaping EXTENSIONS_PATH (defence in depth) - Add hostile manifest.id test (manifest.id='../../tmp/evil' → 400) - Add sqlite-backed round-trip tests for settings.py upsert logic - Add HTTP tests for GET/PUT /api/v1/extensions/settings endpoints - Wrap handleDelete in useCallback; add to columns useMemo deps - Fix MySQL comment drift in _upsert_settings_row (read-then-update, not merge) - Add intentional no-admin-gate comment to get_settings endpoint Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

… registry API - Add deletable field to mock EXTENSIONS data - Update mock for subscribeToRegistry/getRegistryVersion replacing subscribeToLocation - Add mock for src/views/contributions CHATBOT_LOCATION - Assert delete button shown only for deletable extensions - Relax PUT settings assertion to use objectContaining Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

EnxDev requested review from betodealmeida, craig-rueda, dpgaspar, eschutho, geido, hainenber, kgabryje, michael-s-molina, mistercrunch, nytai, rusackas, sadpandajoe and villebro as code owners May 26, 2026 18:53

pull-request-size Bot added the size/L label May 26, 2026

dosubot Bot added api Related to the REST API change:backend Requires changing the backend change:frontend Requires changing the frontend labels May 26, 2026

github-actions Bot added the risk:ci-script PR modifies scripts that execute in CI (supply chain risk) label May 26, 2026

codeant-ai-for-open-source Bot reviewed May 26, 2026

View reviewed changes

Comment thread superset-frontend/src/extensions/ExtensionsList.tsx Outdated

Comment thread superset/extensions/api.py

codeant-ai-for-open-source Bot reviewed May 26, 2026

View reviewed changes

Comment thread superset-frontend/src/extensions/ExtensionsList.tsx Outdated

Comment thread superset/extensions/api.py

EnxDev and others added 2 commits May 26, 2026 21:09

pull-request-size Bot added size/XL and removed size/L labels May 26, 2026

revert(scripts): remove oxlint.sh change from import/delete PR

b5d0b60

The oxlint.sh fix (set -e / [ -n "" ] false-positive exit) is unrelated to extension import/delete and should not be in this PR. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

github-actions Bot removed the risk:ci-script PR modifies scripts that execute in CI (supply chain risk) label May 26, 2026

pull-request-size Bot added size/XXL and removed size/XL labels May 28, 2026

github-actions Bot added the risk:db-migration PRs that require a DB migration label May 28, 2026

EnxDev changed the base branch from enxdev/chat-prototype to enxdev/feat/chatbot-context-sharing May 28, 2026 14:09

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(extensions): import/delete UI and default chatbot selection in ExtensionsList#40450

feat(extensions): import/delete UI and default chatbot selection in ExtensionsList#40450
EnxDev wants to merge 7 commits into
enxdev/feat/chatbot-context-sharingfrom
enxdev/feat/extension-import-delete

EnxDev commented May 26, 2026 •

edited

Loading

Uh oh!

bito-code-review Bot commented May 26, 2026 •

edited

Loading

Uh oh!

netlify Bot commented May 26, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented May 26, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

EnxDev commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

SUMMARY

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

Uh oh!

bito-code-review Bot commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify Bot commented May 26, 2026

✅ Deploy Preview for superset-docs-preview ready!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

codecov Bot commented May 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

EnxDev commented May 26, 2026 •

edited

Loading

bito-code-review Bot commented May 26, 2026 •

edited

Loading

codecov Bot commented May 26, 2026 •

edited

Loading