fix(i18n): make language pack endpoint public for embedded dashboards

[prathamesh04]

Summary

Closes #42433

The /language_pack/<lang>/ endpoint was protected by @has_access, which caused a 302 redirect to /login/ for unauthenticated requests. This silently broke i18n for all embedded dashboards using non-English locales.

Embedded dashboards use a bare fetch() without the guest-token header, so the async language pack fetch in preamble.ts was always blocked. The bootstrap-injected pack path (common_bootstrap_payload) also depends on the JSON catalogs existing on disk - the official Docker image ships only .po files, so when the pack is None the fallback fetch was the only path to load translations, and it was broken.

Root Cause

1. @has_access blocks embedded guest users: The language pack endpoint requires authenticated access. The embedded SPA bare fetch() has no guest-token header so it gets a 302 to /login/
2. Official image lacks compiled catalogs: messages.json files are not shipped, so get_language_pack() returns None, making the bootstrap-injected pack empty/null
3. The async fallback was the only viable path but was blocked by @has_access

Fix

• Remove @has_access from the language_pack endpoint (translation data is non-sensitive)
• Add tests verifying the endpoint is accessible without authentication and rejects invalid language codes

Testing Instructions

1. Run the new unit tests: pytest tests/unit_tests/views/test_base.py::test_language_pack_endpoint_is_public -v
2. Verify all existing tests still pass: pytest tests/unit_tests/views/test_base.py -v

[bito-code-review]

Code Review Agent Run #32e7e7

Actionable Suggestions - 0

Review Details

• Files reviewed - 2 · Commit Range: dc80bb1..dc80bb1

  • superset/views/core.py
  • tests/unit_tests/views/test_base.py
• Files skipped - 0
• Tools

  • MyPy (Static Code Analysis) - ✔︎ Successful
  • Astral Ruff (Static Code Analysis) - ✔︎ Successful
  • Whispers (Secret Scanner) - ✔︎ Successful
  • Detect-secrets (Secret Scanner) - ✔︎ Successful

---

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

• /review - Manually triggers a full AI review.

• /pause - Pauses automatic reviews on this pull request.

• /resume - Resumes automatic reviews.

• /resolve - Marks all Bito-posted review comments as resolved.

• /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

• Customize agent settings
• Review rules
• General documentation
• FAQ

AI Code Review powered by

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 56.60%. Comparing base (ba0900d) to head (dc80bb1).

❗ There is a different number of reports uploaded between BASE (ba0900d) and HEAD (dc80bb1). Click for more details.

HEAD has 103 uploads less than BASE

Flag	BASE (ba0900d)	HEAD (dc80bb1)
python	72	3
presto	12	1
hive	12	1
unit	13	1

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #42438      +/-   ##
==========================================
- Coverage   65.23%   56.60%   -8.63%     
==========================================
  Files        2795     2795              
  Lines      157694   157693       -1     
  Branches    36067    36067              
==========================================
- Hits       102871    89266   -13605     
- Misses      52847    67602   +14755     
+ Partials     1976      825    -1151     

Flag	Coverage Δ
hive	38.39% <ø> (-0.01%)	⬇️
mysql	?
postgres	?
presto	40.31% <ø> (-0.01%)	⬇️
python	41.55% <ø> (-17.47%)	⬇️
sqlite	?
unit	100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.