fix: apply object access checks in tag bulk_create and update commands

[sha174n]

SUMMARY

Tag relationships can be created through three command paths: the single-object CreateCustomTagCommand, the bulk CreateCustomTagWithRelationshipsCommand, and UpdateTagCommand. The single-object path already checks that the caller may modify the target object before creating the relationship (added in #40333).

This PR factors that check into a shared current_user_can_modify_object helper in commands/tag/utils.py and applies it across all three paths so they enforce one consistent ownership boundary. Objects are looked up with skip_base_filter=True so the explicit ownership check decides which objects are tagged.

TESTING INSTRUCTIONS

pytest tests/integration_tests/tags/api_tests.py

Adds test_bulk_create_and_update_skip_inaccessible_objects: an object owned by another user is skipped by a non-owner's bulk_create and update calls.

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
• Introduces new feature or API
• Removes existing feature or API

[codecov]

Codecov Report

❌ Patch coverage is 85.71429% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 64.50%. Comparing base (98d0ccd) to head (f26d2a1).

Files with missing lines	Patch %	Lines
superset/commands/tag/update.py	66.66%	2 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #41457      +/-   ##
==========================================
+ Coverage   63.95%   64.50%   +0.55%     
==========================================
  Files        2664     2664              
  Lines      146153   146117      -36     
  Branches    33713    33700      -13     
==========================================
+ Hits        93474    94259     +785     
+ Misses      50964    50140     -824     
- Partials     1715     1718       +3     

Flag	Coverage Δ
hive	39.22% <23.80%> (-0.01%)	⬇️
mysql	57.98% <85.71%> (+<0.01%)	⬆️
postgres	58.04% <85.71%> (+<0.01%)	⬆️
presto	40.79% <23.80%> (-0.01%)	⬇️
python	59.47% <85.71%> (+1.21%)	⬆️
sqlite	57.68% <85.71%> (+<0.01%)	⬆️
unit	100.00% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[bito-code-review]

Code Review Agent Run #1a1e6f

Actionable Suggestions - 0

Additional Suggestions - 1

• superset/commands/tag/update.py - 1

  • Missing exception handling · Line 79-79
    The `to_object_model(object_type, obj_id, skip_base_filter=True)` call on line 79 is not wrapped in exception handling, unlike the equivalent call in `create.py` line 145 which uses a try-except block. If the DAO lookup raises an exception (e.g., database connection error), the validation will crash instead of gracefully catching and reporting the error. This creates inconsistent error handling between the create and update tag paths.

Review Details

• Files reviewed - 4 · Commit Range: 404f9e1..f26d2a1

  • superset/commands/tag/create.py
  • superset/commands/tag/update.py
  • superset/commands/tag/utils.py
  • tests/integration_tests/tags/api_tests.py
• Files skipped - 0
• Tools

  • MyPy (Static Code Analysis) - ✔︎ Successful
  • Astral Ruff (Static Code Analysis) - ✔︎ Successful
  • Whispers (Secret Scanner) - ✔︎ Successful
  • Detect-secrets (Secret Scanner) - ✔︎ Successful

---

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

• /review - Manually triggers a full AI review.

• /pause - Pauses automatic reviews on this pull request.

• /resume - Resumes automatic reviews.

• /resolve - Marks all Bito-posted review comments as resolved.

• /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

• Customize agent settings
• Review rules
• General documentation
• FAQ

AI Code Review powered by

[rusackas]

Thanks @sha174n, this LGTM. Factoring the ownership check into current_user_can_modify_object and looking objects up with skip_base_filter=True closes the gap in the bulk_create and update paths cleanly, and lines up with the single-object path from #40333.

One thing worth pinning before merge: the new test only checks the resulting row counts, so it'd still pass if Gamma ever lost tag-write and the requests 403'd. An assert on the response status would keep it honest about what it's actually exercising.

Also worth grabbing the bot's note on update.py line 79 while you're in there... that to_object_model lookup isn't wrapped the way the create.py one is, so the two paths handle a DAO error differently.