diff --git a/superset-frontend/src/dashboard/util/findPermission.test.ts b/superset-frontend/src/dashboard/util/findPermission.test.ts index 1fbb791e3d..f90c2800f4 100644 --- a/superset-frontend/src/dashboard/util/findPermission.test.ts +++ b/superset-frontend/src/dashboard/util/findPermission.test.ts @@ -132,6 +132,13 @@ describe('canUserEditDashboard', () => { it('rejects nonexistent users', () => { expect(canUserEditDashboard(dashboard, null)).toEqual(false); }); + it('rejects missing roles', () => { + // in redux, when there is no user, the user is actually set to an empty object, + // so we need to handle missing roles as well as a missing user.s + expect( + canUserEditDashboard(dashboard, {} as UserWithPermissionsAndRoles), + ).toEqual(false); + }); it('rejects "admins" if the admin role does not have edit rights for some reason', () => { expect( canUserEditDashboard(dashboard, { diff --git a/superset-frontend/src/dashboard/util/findPermission.ts b/superset-frontend/src/dashboard/util/findPermission.ts index 995c5d7967..8f28a03c99 100644 --- a/superset-frontend/src/dashboard/util/findPermission.ts +++ b/superset-frontend/src/dashboard/util/findPermission.ts @@ -48,6 +48,6 @@ export const canUserEditDashboard = ( dashboard: Dashboard, user?: UserWithPermissionsAndRoles | null, ) => - !!user && + !!user?.roles && (isUserAdmin(user) || isUserDashboardOwner(dashboard, user)) && findPermission('can_write', 'Dashboard', user.roles);