Create Dashboard API not working

[akashgiri9975]

Bug description

Getting an issue while calling Dashboard API using guest token.
Error
2024-05-17 18:24:16,603:ERROR:flask_appbuilder.api:'GuestUser' object has no attribute '_sa_instance_state'
Traceback (most recent call last):
File "/venv/lib/python3.11/site-packages/flask_appbuilder/api/init.py", line 111, in wraps
return f(self, *args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^
File "/venv/lib/python3.11/site-packages/superset/views/base_api.py", line 128, in wraps
raise ex
File "/venv/lib/python3.11/site-packages/superset/views/base_api.py", line 122, in wraps
duration, response = time_function(f, self, *args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/venv/lib/python3.11/site-packages/superset/utils/core.py", line 1466, in time_function
response = func(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^
File "/venv/lib/python3.11/site-packages/superset/utils/log.py", line 255, in wrapper
value = f(*args, **kwargs)
^^^^^^^^^^^^^^^^^^
File "/venv/lib/python3.11/site-packages/superset/views/base_api.py", line 93, in wraps
return f(self, *args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^
File "/venv/lib/python3.11/site-packages/superset/dashboards/api.py", line 499, in post
new_model = CreateDashboardCommand(item).run()
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/venv/lib/python3.11/site-packages/superset/commands/dashboard/create.py", line 44, in run
dashboard = DashboardDAO.create(attributes=self.properties, commit=True)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/venv/lib/python3.11/site-packages/superset/daos/base.py", line 158, in create
db.session.add(item)
File "", line 2, in add
File "/venv/lib/python3.11/site-packages/sqlalchemy/orm/session.py", line 2648, in add
self.save_or_update_state(state)
File "/venv/lib/python3.11/site-packages/sqlalchemy/orm/session.py", line 2675, in save_or_update_state
for o, m, st, dct in mapper.cascade_iterator(
File "/venv/lib/python3.11/site-packages/sqlalchemy/orm/mapper.py", line 3309, in cascade_iterator
queue = deque(
^^^^^^
File "/venv/lib/python3.11/site-packages/sqlalchemy/orm/relationships.py", line 1995, in cascade_iterator
tuples = state.manager[self.key].impl.get_all_pending(state, dict)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/venv/lib/python3.11/site-packages/sqlalchemy/orm/attributes.py", line 1417, in get_all_pending
current_states = [
^
File "/venv/lib/python3.11/site-packages/sqlalchemy/orm/attributes.py", line 1418, in
((c is not None) and instance_state(c) or None, c)
^^^^^^^^^^^^^^^^^
AttributeError: 'GuestUser' object has no attribute '_sa_instance_state'
2024-05-17 18:24:16,652:INFO:werkzeug:127.0.0.1 - - [17/May/2024 18:24:16] "POST /api/v1/dashboard/ HTTP/1.1" 500 -

How to reproduce the bug

Call Dashboard API Using Guest token
Either from postman or from browser

Screenshots/recordings

No response

Superset version

4.0.1

Python version

3.11

Node version

18 or greater

Browser

Chrome

Additional context

Got something similar
https://stackoverflow.com/questions/16151729/attributeerror-int-object-has-no-attribute-sa-instance-state?rq=1
But not sure where to make the changes

Checklist

• I have searched Superset docs and Slack and didn't find a solution to my problem.
• I have searched the GitHub issue tracker and didn't find a similar bug report.
• I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

[dosubot]

The error you're encountering with the GuestUser object and the Dashboard API in Superset seems to stem from an issue where the GuestUser is expected to behave like a SQLAlchemy model instance but doesn't meet these expectations. This is likely due to the GuestUser object, which is designed for guest authentication, not being properly integrated with SQLAlchemy for operations that require database interaction.

To address this issue, consider the following steps:

1. Review the Authentication Flow: Ensure the process that handles guest tokens and creates GuestUser objects is correctly implemented, especially in how these objects are used in database operations.

2. Adjust Middleware or Decorators: If there's middleware or decorators involved in user handling based on tokens, make sure they correctly manage guest tokens to avoid database operations expecting a fully-fledged user model.

3. Custom Handling for GuestUser: Implement custom handling in parts of your application where GuestUser objects might lead to issues, ensuring operations that expect database model attributes like _sa_instance_state are properly managed.

4. Check for Similar Issues: A similar issue was noted and resolved in a past version of Superset. Although you're using version 4.0.1, and the issue was noted to be resolved by upgrading to version 3.0.1, it's worth checking the Superset GitHub issues for any related discussions or fixes that might be applicable to your version.

This approach focuses on ensuring that GuestUser objects are handled appropriately within the context of your application's authentication flow and database interactions. If the issue persists, reviewing the implementation of GuestUser and its interaction with SQLAlchemy might provide further insights.

Details

Sources

• 500 'Fatal error' When Creating Dashboard Through Public API
• superset/commands/dashboard/create.py
• superset/security/guest_token.py
• superset/security/manager.py
• tests/integration_tests/security/guest_token_security_tests.py
• superset/security/api.py

About Dosu
This response is meant to be useful and save you time. It is not meant to be a precise solution, but rather a starting point for your own research.

Help me be more useful! Please leave a 👍 if this is helpful and 👎 if it is irrelevant.

To continue the conversation, mention @dosu.