{"record":{"id":"4e13b56ab700255a","repo":"apache/superset","slug":"you-don-t-have-access-to-this-dataset","errorCode":null,"errorMessage":"You don't have access to this dataset.","messagePattern":"You don't have access to this dataset\\.","errorType":"exception","errorClass":"DatasetAccessDeniedError","httpStatus":403,"severity":"error","filePath":"superset/commands/dataset/duplicate.py","lineNumber":135,"sourceCode":"        ]\n        db.session.add_all(metrics)\n        table.metrics = metrics\n\n        return table\n\n    def validate(self) -> None:\n        exceptions: list[ValidationError] = []\n        base_model_id = self._properties[\"base_model_id\"]\n        duplicate_name = self._properties[\"table_name\"]\n\n        base_model = DatasetDAO.find_by_id(base_model_id)\n        if not base_model:\n            exceptions.append(DatasetNotFoundError())\n        else:\n            try:\n                security_manager.raise_for_access(datasource=base_model)\n            except SupersetSecurityException as ex:\n                raise DatasetAccessDeniedError() from ex\n            self._base_model = base_model\n\n        if self._base_model and self._base_model.kind != \"virtual\":\n            exceptions.append(DatasourceTypeInvalidError())\n\n        # Use the shared uniqueness check (same as create/update) rather than a\n        # name-only filtered lookup: it scopes to the base model's\n        # database/schema, is catalog-NULL-aware, and bypasses the soft-delete\n        # visibility filter. A filtered lookup misses a soft-deleted twin, so\n        # the duplicate would proceed and either hit a DB constraint as an\n        # opaque IntegrityError or — where no constraint applies (the\n        # model-level UniqueConstraint is metadata-only and the legacy\n        # _customer_location_uc is NULL-leaky) — create an active twin that\n        # permanently blocks restore of the soft-deleted dataset.\n        if base_model and not DatasetDAO.validate_uniqueness(\n            base_model.database,\n            Table(duplicate_name, base_model.schema, base_model.catalog),\n        ):","sourceCodeStart":117,"sourceCodeEnd":153,"githubUrl":"https://github.com/apache/superset/blob/f4587218dd19d046c3e4d00063e7d27f8a2ed354/superset/commands/dataset/duplicate.py#L117-L153","documentation":"DatasetAccessDeniedError (HTTP 403, \"You don't have access to this dataset.\") is raised by the dataset duplicate command when security_manager.raise_for_access(datasource=base_model) throws. Duplicating reads the base dataset's definition, so the caller needs datasource access to it — not just a valid base_model_id.","triggerScenarios":"POST /api/v1/dataset/duplicate with a base_model_id the caller cannot access (no dataset access grant, no role covering that database, RLS rules aside — this is the datasource gate); scripts guessing dataset ids.","commonSituations":"Gamma users duplicating datasets outside their granted datasources; cross-team copies attempted with read-restricted connections; tokens scoped to other resources.","solutions":["Grant the calling user access to the base dataset (or its database) via roles/ownership, then retry.","Have the dataset's owner or an Admin perform the duplication and transfer ownership of the copy.","Verify access first with GET /api/v1/dataset/<base_model_id> — a 403/404 there predicts this failure."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"# Check datasource access before offering duplication\nfrom superset import security_manager\n\ndef can_duplicate(base_model) -> bool:\n    if base_model is None:\n        return False\n    try:\n        security_manager.raise_for_access(datasource=base_model)\n        return True\n    except Exception:\n        return False","typeGuard":null,"tryCatchPattern":"from superset.commands.dataset.exceptions import DatasetAccessDeniedError\ntry:\n    DuplicateDatasetCommand(base_id, properties).run()\nexcept DatasetAccessDeniedError:\n    # 403: user cannot read the source dataset — route to its owner; never retry\n    request_from_owner(base_id)","preventionTips":["Show the Duplicate action only for datasets the user can access.","For cross-team duplication, have owners duplicate and hand over the copy.","Keep RBAC grants aligned with the datasets exposed in each team's workspace."],"tags":["dataset","authorization","rbac","duplicate","flask-api"],"backgroundTag":null,"analyzedSha":"f4587218dd19d046c3e4d00063e7d27f8a2ed354","analyzedAt":"2026-08-14T22:39:27.425Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}