feat(themes): add per-theme editors (Subject model)#42404
Draft
yousoph wants to merge 2 commits into
Draft
Conversation
Introduce per-theme editors so any principal with Theme write can create themes and only a theme's editors (or an admin) can edit or delete it, mirroring the ReportSchedule editors-only pattern. - Add a theme_editors junction table and Theme.editors relationship, with a migration that creates the table (no backfill; themes had no owners). - Route theme creation through a new CreateThemeCommand that auto-adds the creator as an editor and prevents self-lockout. - Gate UpdateThemeCommand/DeleteThemeCommand on editorship (editorship checked before applying the editors payload); keep system-theme protections. - Expose editors on the Theme API (schemas, list/show columns, and the related/editors picker endpoint) and guard theme import overwrites on editorship. - Add SUBJECTS_RELATED_TYPES_THEMES config for the editor picker. - Frontend: add an Editors column and editor field to the theme list and modal, with a read-only view for non-editors. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
yousoph
requested review from
betodealmeida,
eschutho,
michael-s-molina,
mistercrunch,
rusackas and
sadpandajoe
as code owners
July 24, 2026 23:30
dosubot
Bot
added
api
github-actions
Bot
added
risk:db-migration
Contributor
|
Bito Review Skipped - Source Branch Not Found |
yousoph
marked this pull request as draft
July 24, 2026 23:36
The Editors field in the theme modal no longer blocks Save and no longer shows a required asterisk. An empty editors list is valid and simply means admin-only, matching how charts and dashboards treat their owners/editors. The backend still auto-adds the creator on an empty list and prevents a non-admin from removing themselves as the last editor, so no extra front-end guard is needed. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SUMMARY
Extends the Subject model / entity editors introduced in #38831 to Themes. Themes previously had no ownership concept and were editable only by admins. This PR adds a per-theme
editorslist (Subjects) so edit access can be scoped per theme instead of all-or-nothing, following the same editors-only pattern already used by alerts/reports (no viewers for themes).Key behaviors:
theme_editorsjunction table and aTheme.editorsrelationship (mirrorsreport_schedule_editors).CreateThemeCommand; the creating user is automatically added as an editor.PUT/DELETE/bulk-delete now enforceraise_for_editorshipon the theme (admins always pass). System themes and the system default/dark themes keep their existing admin-only protections.editors(create/update schemas +list/showcolumns) and a/api/v1/theme/related/editorsendpoint, with a new optionalSUBJECTS_RELATED_TYPES_THEMESconfig to control which subject types appear in the picker (falls back to the global default).Backwards compatibility: no feature flag and no data backfill — existing themes have no editors, which means only admins can edit them (unchanged behavior). Theme visibility is deliberately unchanged: the list endpoint has no new access filter, so every user who can read themes today still can, and themes applied to a dashboard continue to render for anyone who can view that dashboard.
BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
Themes list gains an "Editors" column; the theme modal gains an "Editors" picker. UI screenshots to follow.
TESTING INSTRUCTIONS
superset db upgradecreates thetheme_editorstable (migrationf7e8d9c0b1a2).can_writeonTheme: create a theme → you are automatically its editor and can edit it; you cannot edit a theme you are not an editor of (403); you cannot add yourself as editor viaPUTto gain access.tests/integration_tests/themes/test_theme_editors.py,tests/unit_tests/migrations/test_add_theme_editors.py, plusThemeList/ThemeModaljest tests.ADDITIONAL INFORMATION
Documents the behavior change in
UPDATING.md. Builds on #38831.🤖 Generated with Claude Code