chore(tags): Handle tagging as part of asset update call

[Vitor-Avila]

SUMMARY

Currently, if a change is made to the Tags configuration for an asset via the PropertiesModal, the modification is handled in a separate request. This causes two issues:

• Content owners with write access on $asset_type have the impression they can change the tags configuration (since they can save it).
• The operation silently fails -- no error in the UI.

This PR moves the tag handling to the API call to update asset, providing an error to the user if permissions are missing. The PR also introduces a new permission so that users that don't have can write on Tag can still add existing tags to the assets they own (and have permission to modify).

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

BEFORE

Before.mov

AFTER

Had to add to GDrive due to filesize

https://drive.google.com/file/d/1141h-OqqvOFH4Ok4yXISwKCzIs3TP9gZ/view?usp=sharing

TESTING INSTRUCTIONS

Added both integration and unit tests. For manual testing:

1. Log in with a role that doesn't have can write on Tag but has can write on Dashboard.
2. Edit the properties for a dashboard, changing the Tags config.
3. Validate the change happens in the same network call and that errors are properly displayed.

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

[codecov]

Codecov Report

Attention: Patch coverage is 86.74699% with 11 lines in your changes are missing coverage. Please review.

Project coverage is 70.28%. Comparing base (76d897e) to head (31aeaae).
Report is 209 commits behind head on master.

Files	Patch %	Lines
...src/dashboard/components/PropertiesModal/index.tsx	42.85%	3 Missing and 1 partial ⚠️
...d/src/explore/components/PropertiesModal/index.tsx	40.00%	3 Missing ⚠️
superset/commands/chart/update.py	83.33%	2 Missing ⚠️
superset/commands/dashboard/update.py	83.33%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #28570      +/-   ##
==========================================
+ Coverage   60.48%   70.28%   +9.79%     
==========================================
  Files        1931     1949      +18     
  Lines       76236    77586    +1350     
  Branches     8568     8731     +163     
==========================================
+ Hits        46114    54530    +8416     
+ Misses      28017    20927    -7090     
- Partials     2105     2129      +24     

Flag	Coverage Δ
hive	49.08% <33.80%> (-0.08%)	⬇️
javascript	57.86% <41.66%> (+0.14%)	⬆️
mysql	77.19% <90.14%> (?)
postgres	77.32% <90.14%> (?)
presto	53.63% <33.80%> (-0.18%)	⬇️
python	83.52% <94.36%> (+20.04%)	⬆️
sqlite	76.77% <90.14%> (?)
unit	58.98% <66.19%> (+1.35%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[hughhhh]

Where are we removing the TagSchema reference here?

[Vitor-Avila]

that's a good catch -- I scanned for un-used imports but didn't realize that TagSchema was actually defined in this same file. I'll remove its definition in a follow up commit.

[Vitor-Avila]

I'll hold on committing this change ☝️ until I get your feedback on the other comment.

[hughhhh]

So we should prolly centralize TagSchema somewhere it could be used in all the resource update schemas

[hughhhh]

couldn't this be ENUM of resource CHART || DASHBOARD || QUERY

https://sourcegraph.com/github.com/apache/superset@389d8b5b5daa260d29783b077e6808704fa49c90/-/blob/superset/tags/models.py?L83

[Vitor-Avila]

def could! I was already using ObjectType for the update_tags method, but here thought about going with string because I'm using security_manager.can_access to check if the user has the required perm, which is case sensitive. We have two options here:

1. Create a new enum with:

class AssetTypes(enum.Enum):
    CHART = "Chart"
    DASHBOARD = "Dashboard"

2. Use the existing ObjectType and then call can_access using capitalize():

if not security_manager.can_access("can_tag", object_type.name.capitalize()):

@hughhhh would you have any preferences?

[hughhhh]

Let's go with #2 using ObjectType enum

[hughhhh]

Also @Vitor-Avila we need to update the calls for Query and Dataset to make sure they have the same ability to update the tags as well

[Vitor-Avila]

Also @Vitor-Avila we need to update the calls for Query and Dataset to make sure they have the same ability to update the tags as well

@hughhhh for Saved Queries I'm not sure if it makes sense since you can't really assign a Tag via the UI to a single query -- you can only assign tags to Saved Queries via the BULK SELECT (and in this case I think it makes sense to use the bulk_create approach which is already the case).

Tags are not fully supported with Datasets yet (not sure if the association works, but the Datasets list doesn't show Tags, the Datasets properties modal doesn't show tags, Datasets schemas don't have tags, etc) so this would be a bigger change a bit out of the scope of this PR.

[hughhhh]

🚢 LGTM