Users not able to view chart in Explore from dashboard they have access to

[ktmud]

When users don't have edit access to a chart or view access to a dataset, but have access to a dashboard, they will still be able to view the chart in the dashboard, but cannot view the chart in explore. Previously, they can still view the chart in Explore regardless if they have access to the chart to dataset.

This change breaks users' workflow in a couple of ways:

1. If they loose access to a dataset, they will not be able to go to the original chart (which they actually have access to) to point it to a new dataset
2. Users won't be able to explore the data in depth, even when they can actually view the data from dashboards.

How to reproduce the bug

Using the examples data:

1. Login as admin, assign "gamma user" to a dashboard
2. Login as "gamma user", go to the dashboard (do this in an Incognito window to avoid having to logout and login)
3. Try to "Edit chart" from the dashboard
   

Expected results

Users should be able to open the "Edit chart" link regardless if they have access to a chart/dataset. The access should be controlled on the Explore page.

If users cannot see the content of the chart, then the Edit chart link should be removed or disabled.

Actual results

Edit chart is visible but clicking on it shows an error:

Environment

Latest maste (sha: 86f146e)

Checklist

Make sure to follow these steps before submitting your issue - thank you!

• I have checked the superset logs for python stacktraces and included it here as text if there are any.
• I have reproduced the issue with at least the latest released version of superset.
• I have checked the issue tracker for the same issue and I haven't found one similar.

[john-bodley]

One thing which is somewhat perplexing to be is the request is a POST via the /api/v1/explore/form_data route and per the post method it states,

Stores a new form_data.

I would have assumed this would have bee a GET request given we're merely fetching the form-data.

[ktmud]

@john-bodley I believe the intention is to create an enriched Explore URL with more states from dashboards carried over to the Explore page, such as additional filters and current tab selections, etc. But I agree the logics here are probably over-designed. For maximum accessibility, this link should be a simple GET request with all the enriched data as URL parameters---like it used to be, and let the Explore page handle parameter consolidation and new cache key deduplication, etc. If filter data are too large, they can be saved in localStorage and have the Explore page read from it (although I doubt this happens very often).

[bnitesh]

We have noticed this behavior even for users who are owners on the chart. It seems similar to #20135 which was specific to datasets. We are on 1.5.1

[rusackas]

If I'm not crazy, this seems fine in 3.x. If there's a chart I can't edit in the dashboard, I can still click Edit Chart, fiddle around with it, and then Save As when I'm done. Closing this as resolved, but happy to reopen if I'm misunderstanding something.