feat(rbac): hide unauthorized menu sections and enforce route guards

backend/src/api/routes/__init__.py

@@ -6,7 +6,7 @@
 # @RELATION: DEPENDS_ON -> importlib
 # @INVARIANT: Only names listed in __all__ are importable via __getattr__.
 
-__all__ = ['plugins', 'tasks', 'settings', 'connections', 'environments', 'mappings', 'migration', 'git', 'storage', 'admin', 'reports', 'assistant', 'clean_release']
+__all__ = ['plugins', 'tasks', 'settings', 'connections', 'environments', 'mappings', 'migration', 'git', 'storage', 'admin', 'reports', 'assistant', 'clean_release', 'profile']
 
 
 # [DEF:__getattr__:Function]

backend/src/api/routes/__tests__/test_dashboards.py

@@ -11,9 +11,11 @@ from fastapi.testclient import TestClient
 from src.app import app
 from src.api.routes.dashboards import DashboardsResponse
 from src.dependencies import get_current_user, has_permission, get_config_manager, get_task_manager, get_resource_service, get_mapping_service
+from src.core.database import get_db
 
 # Global mock user for get_current_user dependency overrides
 mock_user = MagicMock()
+mock_user.id = "u-1"
 mock_user.username = "testuser"
 mock_user.roles = []
 admin_role = MagicMock()
@@ -27,11 +29,14 @@ def mock_deps():
     resource_service = MagicMock()
     mapping_service = MagicMock()
     
+    db = MagicMock()
+
     app.dependency_overrides[get_config_manager] = lambda: config_manager
     app.dependency_overrides[get_task_manager] = lambda: task_manager
     app.dependency_overrides[get_resource_service] = lambda: resource_service
     app.dependency_overrides[get_mapping_service] = lambda: mapping_service
     app.dependency_overrides[get_current_user] = lambda: mock_user
+    app.dependency_overrides[get_db] = lambda: db
     
     app.dependency_overrides[has_permission("plugin:migration", "READ")] = lambda: mock_user
     app.dependency_overrides[has_permission("plugin:migration", "EXECUTE")] = lambda: mock_user
@@ -42,7 +47,8 @@ def mock_deps():
         "config": config_manager,
         "task": task_manager,
         "resource": resource_service,
-        "mapping": mapping_service
+        "mapping": mapping_service,
+        "db": db,
     }
     app.dependency_overrides.clear()
 
@@ -495,4 +501,309 @@ def test_get_dashboard_thumbnail_success(mock_deps):
 # [/DEF:test_get_dashboard_thumbnail_success:Function]
 
 
+# [DEF:_build_profile_preference_stub:Function]
+# @PURPOSE: Creates profile preference payload stub for dashboards filter contract tests.
+# @PRE: username can be empty; enabled indicates profile-default toggle state.
+# @POST: Returns object compatible with ProfileService.get_my_preference contract.
+def _build_profile_preference_stub(username: str, enabled: bool):
+    preference = MagicMock()
+    preference.superset_username = username
+    preference.superset_username_normalized = str(username or "").strip().lower() or None
+    preference.show_only_my_dashboards = bool(enabled)
+
+    payload = MagicMock()
+    payload.preference = preference
+    return payload
+# [/DEF:_build_profile_preference_stub:Function]
+
+
+# [DEF:_matches_actor_case_insensitive:Function]
+# @PURPOSE: Applies trim + case-insensitive owners OR modified_by matching used by route contract tests.
+# @PRE: owners can be None or list-like values.
+# @POST: Returns True when bound username matches any owner or modified_by.
+def _matches_actor_case_insensitive(bound_username, owners, modified_by):
+    normalized_bound = str(bound_username or "").strip().lower()
+    if not normalized_bound:
+        return False
+
+    owner_tokens = []
+    for owner in owners or []:
+        token = str(owner or "").strip().lower()
+        if token:
+            owner_tokens.append(token)
+
+    modified_token = str(modified_by or "").strip().lower()
+    return normalized_bound in owner_tokens or bool(modified_token and modified_token == normalized_bound)
+# [/DEF:_matches_actor_case_insensitive:Function]
+
+
+# [DEF:test_get_dashboards_profile_filter_contract_owners_or_modified_by:Function]
+# @TEST: GET /api/dashboards applies profile-default filter with owners OR modified_by trim+case-insensitive semantics.
+# @PRE: Current user has enabled profile-default preference and bound username.
+# @POST: Response includes only matching dashboards and effective_profile_filter metadata.
+def test_get_dashboards_profile_filter_contract_owners_or_modified_by(mock_deps):
+    mock_env = MagicMock()
+    mock_env.id = "prod"
+    mock_deps["config"].get_environments.return_value = [mock_env]
+    mock_deps["task"].get_all_tasks.return_value = []
+    mock_deps["resource"].get_dashboards_with_status = AsyncMock(return_value=[
+        {
+            "id": 1,
+            "title": "Owner Match",
+            "slug": "owner-match",
+            "owners": ["  John_Doe  "],
+            "modified_by": "someone_else",
+        },
+        {
+            "id": 2,
+            "title": "Modifier Match",
+            "slug": "modifier-match",
+            "owners": ["analytics-team"],
+            "modified_by": "  JOHN_DOE ",
+        },
+        {
+            "id": 3,
+            "title": "No Match",
+            "slug": "no-match",
+            "owners": ["another-user"],
+            "modified_by": "nobody",
+        },
+    ])
+
+    with patch("src.api.routes.dashboards.ProfileService") as profile_service_cls:
+        profile_service = MagicMock()
+        profile_service.get_my_preference.return_value = _build_profile_preference_stub(
+            username="  JOHN_DOE  ",
+            enabled=True,
+        )
+        profile_service.matches_dashboard_actor.side_effect = _matches_actor_case_insensitive
+        profile_service_cls.return_value = profile_service
+
+        response = client.get(
+            "/api/dashboards?env_id=prod&page_context=dashboards_main&apply_profile_default=true"
+        )
+
+    assert response.status_code == 200
+    payload = response.json()
+
+    assert payload["total"] == 2
+    assert {item["id"] for item in payload["dashboards"]} == {1, 2}
+    assert payload["effective_profile_filter"]["applied"] is True
+    assert payload["effective_profile_filter"]["source_page"] == "dashboards_main"
+    assert payload["effective_profile_filter"]["override_show_all"] is False
+    assert payload["effective_profile_filter"]["username"] == "john_doe"
+    assert payload["effective_profile_filter"]["match_logic"] == "owners_or_modified_by"
+# [/DEF:test_get_dashboards_profile_filter_contract_owners_or_modified_by:Function]
+
+
+# [DEF:test_get_dashboards_override_show_all_contract:Function]
+# @TEST: GET /api/dashboards honors override_show_all and disables profile-default filter for current page.
+# @PRE: Profile-default preference exists but override_show_all=true query is provided.
+# @POST: Response remains unfiltered and effective_profile_filter.applied is false.
+def test_get_dashboards_override_show_all_contract(mock_deps):
+    mock_env = MagicMock()
+    mock_env.id = "prod"
+    mock_deps["config"].get_environments.return_value = [mock_env]
+    mock_deps["task"].get_all_tasks.return_value = []
+    mock_deps["resource"].get_dashboards_with_status = AsyncMock(return_value=[
+        {"id": 1, "title": "Dash A", "slug": "dash-a", "owners": ["john_doe"], "modified_by": "john_doe"},
+        {"id": 2, "title": "Dash B", "slug": "dash-b", "owners": ["other"], "modified_by": "other"},
+    ])
+
+    with patch("src.api.routes.dashboards.ProfileService") as profile_service_cls:
+        profile_service = MagicMock()
+        profile_service.get_my_preference.return_value = _build_profile_preference_stub(
+            username="john_doe",
+            enabled=True,
+        )
+        profile_service.matches_dashboard_actor.side_effect = _matches_actor_case_insensitive
+        profile_service_cls.return_value = profile_service
+
+        response = client.get(
+            "/api/dashboards?env_id=prod&page_context=dashboards_main&apply_profile_default=true&override_show_all=true"
+        )
+
+    assert response.status_code == 200
+    payload = response.json()
+
+    assert payload["total"] == 2
+    assert {item["id"] for item in payload["dashboards"]} == {1, 2}
+    assert payload["effective_profile_filter"]["applied"] is False
+    assert payload["effective_profile_filter"]["source_page"] == "dashboards_main"
+    assert payload["effective_profile_filter"]["override_show_all"] is True
+    assert payload["effective_profile_filter"]["username"] is None
+    assert payload["effective_profile_filter"]["match_logic"] is None
+    profile_service.matches_dashboard_actor.assert_not_called()
+# [/DEF:test_get_dashboards_override_show_all_contract:Function]
+
+
+# [DEF:test_get_dashboards_profile_filter_no_match_results_contract:Function]
+# @TEST: GET /api/dashboards returns empty result set when profile-default filter is active and no dashboard actors match.
+# @PRE: Profile-default preference is enabled with bound username and all dashboards are non-matching.
+# @POST: Response total is 0 with deterministic pagination and active effective_profile_filter metadata.
+def test_get_dashboards_profile_filter_no_match_results_contract(mock_deps):
+    mock_env = MagicMock()
+    mock_env.id = "prod"
+    mock_deps["config"].get_environments.return_value = [mock_env]
+    mock_deps["task"].get_all_tasks.return_value = []
+    mock_deps["resource"].get_dashboards_with_status = AsyncMock(return_value=[
+        {
+            "id": 101,
+            "title": "Team Dashboard",
+            "slug": "team-dashboard",
+            "owners": ["analytics-team"],
+            "modified_by": "someone_else",
+        },
+        {
+            "id": 102,
+            "title": "Ops Dashboard",
+            "slug": "ops-dashboard",
+            "owners": ["ops-user"],
+            "modified_by": "ops-user",
+        },
+    ])
+
+    with patch("src.api.routes.dashboards.ProfileService") as profile_service_cls:
+        profile_service = MagicMock()
+        profile_service.get_my_preference.return_value = _build_profile_preference_stub(
+            username="john_doe",
+            enabled=True,
+        )
+        profile_service.matches_dashboard_actor.side_effect = _matches_actor_case_insensitive
+        profile_service_cls.return_value = profile_service
+
+        response = client.get(
+            "/api/dashboards?env_id=prod&page_context=dashboards_main&apply_profile_default=true"
+        )
+
+    assert response.status_code == 200
+    payload = response.json()
+
+    assert payload["total"] == 0
+    assert payload["dashboards"] == []
+    assert payload["page"] == 1
+    assert payload["page_size"] == 10
+    assert payload["total_pages"] == 1
+    assert payload["effective_profile_filter"]["applied"] is True
+    assert payload["effective_profile_filter"]["source_page"] == "dashboards_main"
+    assert payload["effective_profile_filter"]["override_show_all"] is False
+    assert payload["effective_profile_filter"]["username"] == "john_doe"
+    assert payload["effective_profile_filter"]["match_logic"] == "owners_or_modified_by"
+# [/DEF:test_get_dashboards_profile_filter_no_match_results_contract:Function]
+
+
+# [DEF:test_get_dashboards_page_context_other_disables_profile_default:Function]
+# @TEST: GET /api/dashboards does not auto-apply profile-default filter outside dashboards_main page context.
+# @PRE: Profile-default preference exists but page_context=other query is provided.
+# @POST: Response remains unfiltered and metadata reflects source_page=other.
+def test_get_dashboards_page_context_other_disables_profile_default(mock_deps):
+    mock_env = MagicMock()
+    mock_env.id = "prod"
+    mock_deps["config"].get_environments.return_value = [mock_env]
+    mock_deps["task"].get_all_tasks.return_value = []
+    mock_deps["resource"].get_dashboards_with_status = AsyncMock(return_value=[
+        {"id": 1, "title": "Dash A", "slug": "dash-a", "owners": ["john_doe"], "modified_by": "john_doe"},
+        {"id": 2, "title": "Dash B", "slug": "dash-b", "owners": ["other"], "modified_by": "other"},
+    ])
+
+    with patch("src.api.routes.dashboards.ProfileService") as profile_service_cls:
+        profile_service = MagicMock()
+        profile_service.get_my_preference.return_value = _build_profile_preference_stub(
+            username="john_doe",
+            enabled=True,
+        )
+        profile_service.matches_dashboard_actor.side_effect = _matches_actor_case_insensitive
+        profile_service_cls.return_value = profile_service
+
+        response = client.get(
+            "/api/dashboards?env_id=prod&page_context=other&apply_profile_default=true"
+        )
+
+    assert response.status_code == 200
+    payload = response.json()
+
+    assert payload["total"] == 2
+    assert {item["id"] for item in payload["dashboards"]} == {1, 2}
+    assert payload["effective_profile_filter"]["applied"] is False
+    assert payload["effective_profile_filter"]["source_page"] == "other"
+    assert payload["effective_profile_filter"]["override_show_all"] is False
+    assert payload["effective_profile_filter"]["username"] is None
+    assert payload["effective_profile_filter"]["match_logic"] is None
+    profile_service.matches_dashboard_actor.assert_not_called()
+# [/DEF:test_get_dashboards_page_context_other_disables_profile_default:Function]
+
+
+# [DEF:test_get_dashboards_profile_filter_matches_display_alias_without_detail_fanout:Function]
+# @TEST: GET /api/dashboards resolves Superset display-name alias once and filters without per-dashboard detail calls.
+# @PRE: Profile-default filter is active, bound username is `admin`, dashboard actors contain display labels.
+# @POST: Route matches by alias (`Superset Admin`) and does not call `SupersetClient.get_dashboard` in list filter path.
+def test_get_dashboards_profile_filter_matches_display_alias_without_detail_fanout(mock_deps):
+    mock_env = MagicMock()
+    mock_env.id = "prod"
+    mock_deps["config"].get_environments.return_value = [mock_env]
+    mock_deps["task"].get_all_tasks.return_value = []
+    mock_deps["resource"].get_dashboards_with_status = AsyncMock(return_value=[
+        {
+            "id": 5,
+            "title": "Alias Match",
+            "slug": "alias-match",
+            "owners": [],
+            "created_by": None,
+            "modified_by": "Superset Admin",
+        },
+        {
+            "id": 6,
+            "title": "Alias No Match",
+            "slug": "alias-no-match",
+            "owners": [],
+            "created_by": None,
+            "modified_by": "Other User",
+        },
+    ])
+
+    with patch("src.api.routes.dashboards.ProfileService") as profile_service_cls, patch(
+        "src.api.routes.dashboards.SupersetClient"
+    ) as superset_client_cls, patch(
+        "src.api.routes.dashboards.SupersetAccountLookupAdapter"
+    ) as lookup_adapter_cls:
+        profile_service = MagicMock()
+        profile_service.get_my_preference.return_value = _build_profile_preference_stub(
+            username="admin",
+            enabled=True,
+        )
+        profile_service.matches_dashboard_actor.side_effect = _matches_actor_case_insensitive
+        profile_service_cls.return_value = profile_service
+
+        superset_client = MagicMock()
+        superset_client_cls.return_value = superset_client
+
+        lookup_adapter = MagicMock()
+        lookup_adapter.get_users_page.return_value = {
+            "items": [
+                {
+                    "environment_id": "prod",
+                    "username": "admin",
+                    "display_name": "Superset Admin",
+                    "email": "admin@example.com",
+                    "is_active": True,
+                }
+            ],
+            "total": 1,
+        }
+        lookup_adapter_cls.return_value = lookup_adapter
+
+        response = client.get(
+            "/api/dashboards?env_id=prod&page_context=dashboards_main&apply_profile_default=true"
+        )
+
+    assert response.status_code == 200
+    payload = response.json()
+    assert payload["total"] == 1
+    assert {item["id"] for item in payload["dashboards"]} == {5}
+    assert payload["effective_profile_filter"]["applied"] is True
+    lookup_adapter.get_users_page.assert_called_once()
+    superset_client.get_dashboard.assert_not_called()
+# [/DEF:test_get_dashboards_profile_filter_matches_display_alias_without_detail_fanout:Function]
+
+
 # [/DEF:backend.src.api.routes.__tests__.test_dashboards:Module]

backend/src/api/routes/__tests__/test_profile_api.py

@@ -0,0 +1,243 @@
+# [DEF:backend.src.api.routes.__tests__.test_profile_api:Module]
+# @TIER: STANDARD
+# @SEMANTICS: tests, profile, api, preferences, lookup, contract
+# @PURPOSE: Verifies profile API route contracts for preference read/update and Superset account lookup.
+# @LAYER: API
+# @RELATION: TESTS -> backend.src.api.routes.profile
+
+# [SECTION: IMPORTS]
+from datetime import datetime, timezone
+from unittest.mock import MagicMock, patch
+
+from fastapi.testclient import TestClient
+
+from src.app import app
+from src.core.database import get_db
+from src.dependencies import get_config_manager, get_current_user
+from src.schemas.profile import (
+    ProfilePreference,
+    ProfilePreferenceResponse,
+    SupersetAccountCandidate,
+    SupersetAccountLookupResponse,
+)
+from src.services.profile_service import (
+    EnvironmentNotFoundError,
+    ProfileAuthorizationError,
+    ProfileValidationError,
+)
+# [/SECTION]
+
+
+client = TestClient(app)
+
+
+# [DEF:mock_profile_route_dependencies:Function]
+# @PURPOSE: Provides deterministic dependency overrides for profile route tests.
+# @PRE: App instance is initialized.
+# @POST: Dependencies are overridden for current test and restored afterward.
+def mock_profile_route_dependencies():
+    mock_user = MagicMock()
+    mock_user.id = "u-1"
+    mock_user.username = "test-user"
+
+    mock_db = MagicMock()
+    mock_config_manager = MagicMock()
+
+    app.dependency_overrides[get_current_user] = lambda: mock_user
+    app.dependency_overrides[get_db] = lambda: mock_db
+    app.dependency_overrides[get_config_manager] = lambda: mock_config_manager
+
+    return mock_user, mock_db, mock_config_manager
+# [/DEF:mock_profile_route_dependencies:Function]
+
+
+# [DEF:profile_route_deps_fixture:Function]
+# @PURPOSE: Pytest fixture wrapper for profile route dependency overrides.
+# @PRE: None.
+# @POST: Yields overridden dependencies and clears overrides after test.
+import pytest
+
+
+@pytest.fixture(autouse=True)
+def profile_route_deps_fixture():
+    yielded = mock_profile_route_dependencies()
+    yield yielded
+    app.dependency_overrides.clear()
+# [/DEF:profile_route_deps_fixture:Function]
+
+
+# [DEF:_build_preference_response:Function]
+# @PURPOSE: Builds stable profile preference response payload for route tests.
+# @PRE: user_id is provided.
+# @POST: Returns ProfilePreferenceResponse object with deterministic timestamps.
+def _build_preference_response(user_id: str = "u-1") -> ProfilePreferenceResponse:
+    now = datetime.now(timezone.utc)
+    return ProfilePreferenceResponse(
+        status="success",
+        message="Preference loaded",
+        preference=ProfilePreference(
+            user_id=user_id,
+            superset_username="John_Doe",
+            superset_username_normalized="john_doe",
+            show_only_my_dashboards=True,
+            created_at=now,
+            updated_at=now,
+        ),
+    )
+# [/DEF:_build_preference_response:Function]
+
+
+# [DEF:test_get_profile_preferences_returns_self_payload:Function]
+# @PURPOSE: Verifies GET /api/profile/preferences returns stable self-scoped payload.
+# @PRE: Authenticated user context is available.
+# @POST: Response status is 200 and payload contains current user preference.
+def test_get_profile_preferences_returns_self_payload(profile_route_deps_fixture):
+    mock_user, _, _ = profile_route_deps_fixture
+    service = MagicMock()
+    service.get_my_preference.return_value = _build_preference_response(user_id=mock_user.id)
+
+    with patch("src.api.routes.profile._get_profile_service", return_value=service):
+        response = client.get("/api/profile/preferences")
+
+    assert response.status_code == 200
+    payload = response.json()
+    assert payload["status"] == "success"
+    assert payload["preference"]["user_id"] == mock_user.id
+    assert payload["preference"]["superset_username_normalized"] == "john_doe"
+    service.get_my_preference.assert_called_once_with(mock_user)
+# [/DEF:test_get_profile_preferences_returns_self_payload:Function]
+
+
+# [DEF:test_patch_profile_preferences_success:Function]
+# @PURPOSE: Verifies PATCH /api/profile/preferences persists valid payload through route mapping.
+# @PRE: Valid request payload and authenticated user.
+# @POST: Response status is 200 with saved preference payload.
+def test_patch_profile_preferences_success(profile_route_deps_fixture):
+    mock_user, _, _ = profile_route_deps_fixture
+    service = MagicMock()
+    service.update_my_preference.return_value = _build_preference_response(user_id=mock_user.id)
+
+    with patch("src.api.routes.profile._get_profile_service", return_value=service):
+        response = client.patch(
+            "/api/profile/preferences",
+            json={
+                "superset_username": "John_Doe",
+                "show_only_my_dashboards": True,
+            },
+        )
+
+    assert response.status_code == 200
+    payload = response.json()
+    assert payload["status"] == "success"
+    assert payload["preference"]["superset_username"] == "John_Doe"
+    assert payload["preference"]["show_only_my_dashboards"] is True
+    service.update_my_preference.assert_called_once()
+# [/DEF:test_patch_profile_preferences_success:Function]
+
+
+# [DEF:test_patch_profile_preferences_validation_error:Function]
+# @PURPOSE: Verifies route maps domain validation failure to HTTP 422 with actionable details.
+# @PRE: Service raises ProfileValidationError.
+# @POST: Response status is 422 and includes validation messages.
+def test_patch_profile_preferences_validation_error(profile_route_deps_fixture):
+    service = MagicMock()
+    service.update_my_preference.side_effect = ProfileValidationError(
+        ["Superset username is required when default filter is enabled."]
+    )
+
+    with patch("src.api.routes.profile._get_profile_service", return_value=service):
+        response = client.patch(
+            "/api/profile/preferences",
+            json={
+                "superset_username": "",
+                "show_only_my_dashboards": True,
+            },
+        )
+
+    assert response.status_code == 422
+    payload = response.json()
+    assert "detail" in payload
+    assert "Superset username is required when default filter is enabled." in payload["detail"]
+# [/DEF:test_patch_profile_preferences_validation_error:Function]
+
+
+# [DEF:test_patch_profile_preferences_cross_user_denied:Function]
+# @PURPOSE: Verifies route maps domain authorization guard failure to HTTP 403.
+# @PRE: Service raises ProfileAuthorizationError.
+# @POST: Response status is 403 with denial message.
+def test_patch_profile_preferences_cross_user_denied(profile_route_deps_fixture):
+    service = MagicMock()
+    service.update_my_preference.side_effect = ProfileAuthorizationError(
+        "Cross-user preference mutation is forbidden"
+    )
+
+    with patch("src.api.routes.profile._get_profile_service", return_value=service):
+        response = client.patch(
+            "/api/profile/preferences",
+            json={
+                "superset_username": "john_doe",
+                "show_only_my_dashboards": True,
+            },
+        )
+
+    assert response.status_code == 403
+    payload = response.json()
+    assert payload["detail"] == "Cross-user preference mutation is forbidden"
+# [/DEF:test_patch_profile_preferences_cross_user_denied:Function]
+
+
+# [DEF:test_lookup_superset_accounts_success:Function]
+# @PURPOSE: Verifies lookup route returns success payload with normalized candidates.
+# @PRE: Valid environment_id and service success response.
+# @POST: Response status is 200 and items list is returned.
+def test_lookup_superset_accounts_success(profile_route_deps_fixture):
+    service = MagicMock()
+    service.lookup_superset_accounts.return_value = SupersetAccountLookupResponse(
+        status="success",
+        environment_id="dev",
+        page_index=0,
+        page_size=20,
+        total=1,
+        warning=None,
+        items=[
+            SupersetAccountCandidate(
+                environment_id="dev",
+                username="john_doe",
+                display_name="John Doe",
+                email="john@example.local",
+                is_active=True,
+            )
+        ],
+    )
+
+    with patch("src.api.routes.profile._get_profile_service", return_value=service):
+        response = client.get("/api/profile/superset-accounts?environment_id=dev")
+
+    assert response.status_code == 200
+    payload = response.json()
+    assert payload["status"] == "success"
+    assert payload["environment_id"] == "dev"
+    assert payload["total"] == 1
+    assert payload["items"][0]["username"] == "john_doe"
+# [/DEF:test_lookup_superset_accounts_success:Function]
+
+
+# [DEF:test_lookup_superset_accounts_env_not_found:Function]
+# @PURPOSE: Verifies lookup route maps missing environment to HTTP 404.
+# @PRE: Service raises EnvironmentNotFoundError.
+# @POST: Response status is 404 with explicit message.
+def test_lookup_superset_accounts_env_not_found(profile_route_deps_fixture):
+    service = MagicMock()
+    service.lookup_superset_accounts.side_effect = EnvironmentNotFoundError(
+        "Environment 'missing-env' not found"
+    )
+
+    with patch("src.api.routes.profile._get_profile_service", return_value=service):
+        response = client.get("/api/profile/superset-accounts?environment_id=missing-env")
+
+    assert response.status_code == 404
+    payload = response.json()
+    assert payload["detail"] == "Environment 'missing-env' not found"
+# [/DEF:test_lookup_superset_accounts_env_not_found:Function]
+
+# [/DEF:backend.src.api.routes.__tests__.test_profile_api:Module]

backend/src/api/routes/dashboards.py

@@ -34,14 +34,26 @@
 # [SECTION: IMPORTS]
 from fastapi import APIRouter, Depends, HTTPException, Query, Response
 from fastapi.responses import JSONResponse
-from typing import List, Optional, Dict, Any
+from typing import List, Optional, Dict, Any, Literal
 import re
 from urllib.parse import urlparse
 from pydantic import BaseModel, Field
-from ...dependencies import get_config_manager, get_task_manager, get_resource_service, get_mapping_service, has_permission
+from sqlalchemy.orm import Session
+from ...dependencies import (
+    get_config_manager,
+    get_task_manager,
+    get_resource_service,
+    get_mapping_service,
+    get_current_user,
+    has_permission,
+)
+from ...core.database import get_db
 from ...core.logger import logger, belief_scope
 from ...core.superset_client import SupersetClient
+from ...core.superset_profile_lookup import SupersetAccountLookupAdapter
 from ...core.utils.network import DashboardNotFoundError
+from ...models.auth import User
+from ...services.profile_service import ProfileService
 from ...services.resource_service import ResourceService
 # [/SECTION]
 
@@ -79,6 +91,15 @@ class DashboardItem(BaseModel):
     last_task: Optional[LastTask] = None
 # [/DEF:DashboardItem:DataClass]
 
+# [DEF:EffectiveProfileFilter:DataClass]
+class EffectiveProfileFilter(BaseModel):
+    applied: bool
+    source_page: Literal["dashboards_main", "other"] = "dashboards_main"
+    override_show_all: bool = False
+    username: Optional[str] = None
+    match_logic: Optional[Literal["owners_or_modified_by"]] = None
+# [/DEF:EffectiveProfileFilter:DataClass]
+
 # [DEF:DashboardsResponse:DataClass]
 class DashboardsResponse(BaseModel):
     dashboards: List[DashboardItem]
@@ -86,6 +107,7 @@ class DashboardsResponse(BaseModel):
     page: int
     page_size: int
     total_pages: int
+    effective_profile_filter: Optional[EffectiveProfileFilter] = None
 # [/DEF:DashboardsResponse:DataClass]
 
 # [DEF:DashboardChartItem:DataClass]
@@ -242,6 +264,101 @@ def _dashboard_git_filter_value(dashboard: Dict[str, Any]) -> str:
     return "pending"
 # [/DEF:_dashboard_git_filter_value:Function]
 
+# [DEF:_normalize_actor_alias_token:Function]
+# @PURPOSE: Normalize actor alias token to comparable trim+lower text.
+# @PRE: value can be scalar/None.
+# @POST: Returns normalized token or None.
+def _normalize_actor_alias_token(value: Any) -> Optional[str]:
+    token = str(value or "").strip().lower()
+    return token or None
+# [/DEF:_normalize_actor_alias_token:Function]
+
+
+# [DEF:_resolve_profile_actor_aliases:Function]
+# @PURPOSE: Resolve stable actor aliases for profile filtering without per-dashboard detail fan-out.
+# @PRE: bound username is available and env is valid.
+# @POST: Returns at least normalized username; may include Superset display-name alias.
+# @SIDE_EFFECT: Performs at most one Superset users-lookup request.
+def _resolve_profile_actor_aliases(env: Any, bound_username: str) -> List[str]:
+    normalized_bound = _normalize_actor_alias_token(bound_username)
+    if not normalized_bound:
+        return []
+
+    aliases: List[str] = [normalized_bound]
+    try:
+        client = SupersetClient(env)
+        adapter = SupersetAccountLookupAdapter(
+            network_client=client.network,
+            environment_id=str(getattr(env, "id", "")),
+        )
+        lookup_payload = adapter.get_users_page(
+            search=normalized_bound,
+            page_index=0,
+            page_size=20,
+            sort_column="username",
+            sort_order="asc",
+        )
+        lookup_items = (
+            lookup_payload.get("items", [])
+            if isinstance(lookup_payload, dict)
+            else []
+        )
+
+        matched_item: Optional[Dict[str, Any]] = None
+        for item in lookup_items:
+            if not isinstance(item, dict):
+                continue
+            if _normalize_actor_alias_token(item.get("username")) == normalized_bound:
+                matched_item = item
+                break
+
+        if matched_item is None:
+            for item in lookup_items:
+                if isinstance(item, dict):
+                    matched_item = item
+                    break
+
+        display_alias = _normalize_actor_alias_token(
+            (matched_item or {}).get("display_name")
+        )
+        if display_alias and display_alias not in aliases:
+            aliases.append(display_alias)
+
+        logger.reflect(
+            "[REFLECT] Resolved profile actor aliases "
+            f"(env={getattr(env, 'id', None)}, bound_username={normalized_bound!r}, "
+            f"lookup_items={len(lookup_items)}, aliases={aliases!r})"
+        )
+    except Exception as alias_error:
+        logger.explore(
+            "[EXPLORE] Failed to resolve profile actor aliases via Superset users lookup "
+            f"(env={getattr(env, 'id', None)}, bound_username={normalized_bound!r}): {alias_error}"
+        )
+    return aliases
+# [/DEF:_resolve_profile_actor_aliases:Function]
+
+
+# [DEF:_matches_dashboard_actor_aliases:Function]
+# @PURPOSE: Apply profile actor matching against multiple aliases (username + optional display name).
+# @PRE: actor_aliases contains normalized non-empty tokens.
+# @POST: Returns True when any alias matches owners OR modified_by.
+def _matches_dashboard_actor_aliases(
+    profile_service: ProfileService,
+    actor_aliases: List[str],
+    owners: Optional[Any],
+    modified_by: Optional[str],
+) -> bool:
+    for actor_alias in actor_aliases:
+        if profile_service.matches_dashboard_actor(
+            bound_username=actor_alias,
+            owners=owners,
+            modified_by=modified_by,
+        ):
+            return True
+    return False
+# [/DEF:_matches_dashboard_actor_aliases:Function]
+
+
 # [DEF:get_dashboards:Function]
 # @PURPOSE: Fetch list of dashboards from a specific environment with Git status and last task status
 # @PRE: env_id must be a valid environment ID
@@ -249,6 +366,7 @@ def _dashboard_git_filter_value(dashboard: Dict[str, Any]) -> str:
 # @PRE: page_size must be between 1 and 100 if provided
 # @POST: Returns a list of dashboards with enhanced metadata and pagination info
 # @POST: Response includes pagination metadata (page, page_size, total, total_pages)
+# @POST: Response includes effective profile filter metadata for main dashboards page context
 # @PARAM: env_id (str) - The environment ID to fetch dashboards from
 # @PARAM: search (Optional[str]) - Filter by title/slug
 # @PARAM: page (Optional[int]) - Page number (default: 1)
@@ -261,6 +379,9 @@ async def get_dashboards(
     search: Optional[str] = None,
     page: int = 1,
     page_size: int = 10,
+    page_context: Literal["dashboards_main", "other"] = Query(default="dashboards_main"),
+    apply_profile_default: bool = Query(default=True),
+    override_show_all: bool = Query(default=False),
     filter_title: Optional[List[str]] = Query(default=None),
     filter_git_status: Optional[List[str]] = Query(default=None),
     filter_llm_status: Optional[List[str]] = Query(default=None),
@@ -269,26 +390,73 @@ async def get_dashboards(
     config_manager=Depends(get_config_manager),
     task_manager=Depends(get_task_manager),
     resource_service=Depends(get_resource_service),
+    current_user: User = Depends(get_current_user),
+    db: Session = Depends(get_db),
     _ = Depends(has_permission("plugin:migration", "READ"))
 ):
-    with belief_scope("get_dashboards", f"env_id={env_id}, search={search}, page={page}, page_size={page_size}"):
-        # Validate pagination parameters
+    with belief_scope(
+        "get_dashboards",
+        (
+            f"env_id={env_id}, search={search}, page={page}, page_size={page_size}, "
+            f"page_context={page_context}, apply_profile_default={apply_profile_default}, "
+            f"override_show_all={override_show_all}"
+        ),
+    ):
         if page < 1:
             logger.error(f"[get_dashboards][Coherence:Failed] Invalid page: {page}")
             raise HTTPException(status_code=400, detail="Page must be >= 1")
         if page_size < 1 or page_size > 100:
             logger.error(f"[get_dashboards][Coherence:Failed] Invalid page_size: {page_size}")
             raise HTTPException(status_code=400, detail="Page size must be between 1 and 100")
-        
-        # Validate environment exists
+
         environments = config_manager.get_environments()
         env = next((e for e in environments if e.id == env_id), None)
         if not env:
             logger.error(f"[get_dashboards][Coherence:Failed] Environment not found: {env_id}")
             raise HTTPException(status_code=404, detail="Environment not found")
-        
+
+        profile_service = ProfileService(db=db, config_manager=config_manager)
+        bound_username: Optional[str] = None
+        can_apply_profile_filter = False
+        effective_profile_filter = EffectiveProfileFilter(
+            applied=False,
+            source_page=page_context,
+            override_show_all=bool(override_show_all),
+            username=None,
+            match_logic=None,
+        )
+
+        try:
+            profile_preference = profile_service.get_my_preference(current_user).preference
+            normalized_username = str(
+                getattr(profile_preference, "superset_username_normalized", None) or ""
+            ).strip().lower()
+            raw_username = str(
+                getattr(profile_preference, "superset_username", None) or ""
+            ).strip().lower()
+            bound_username = normalized_username or raw_username or None
+
+            can_apply_profile_filter = (
+                page_context == "dashboards_main"
+                and bool(apply_profile_default)
+                and not bool(override_show_all)
+                and bool(getattr(profile_preference, "show_only_my_dashboards", False))
+                and bool(bound_username)
+            )
+
+            effective_profile_filter = EffectiveProfileFilter(
+                applied=bool(can_apply_profile_filter),
+                source_page=page_context,
+                override_show_all=bool(override_show_all),
+                username=bound_username if can_apply_profile_filter else None,
+                match_logic="owners_or_modified_by" if can_apply_profile_filter else None,
+            )
+        except Exception as profile_error:
+            logger.explore(
+                f"[EXPLORE] Profile preference unavailable; continuing without profile-default filter: {profile_error}"
+            )
+
         try:
-            # Get all tasks for status lookup
             all_tasks = task_manager.get_all_tasks()
             title_filters = _normalize_filter_values(filter_title)
             git_filters = _normalize_filter_values(filter_git_status)
@@ -304,9 +472,9 @@ async def get_dashboards(
                     actor_filters,
                 )
             )
+            needs_full_scan = has_column_filters or bool(can_apply_profile_filter)
 
-            # Fast path: real ResourceService -> one Superset page call per API request.
-            if isinstance(resource_service, ResourceService) and not has_column_filters:
+            if isinstance(resource_service, ResourceService) and not needs_full_scan:
                 try:
                     page_payload = await resource_service.get_dashboards_page_with_status(
                         env,
@@ -333,9 +501,9 @@ async def get_dashboards(
                     if search:
                         search_lower = search.lower()
                         dashboards = [
-                            d for d in dashboards 
-                            if search_lower in d.get('title', '').lower() 
-                            or search_lower in d.get('slug', '').lower()
+                            d for d in dashboards
+                            if search_lower in d.get("title", "").lower()
+                            or search_lower in d.get("slug", "").lower()
                         ]
 
                     total = len(dashboards)
@@ -343,13 +511,52 @@ async def get_dashboards(
                     start_idx = (page - 1) * page_size
                     end_idx = start_idx + page_size
                     paginated_dashboards = dashboards[start_idx:end_idx]
-            elif isinstance(resource_service, ResourceService) and has_column_filters:
+            else:
                 dashboards = await resource_service.get_dashboards_with_status(
                     env,
                     all_tasks,
                     include_git_status=bool(git_filters),
                 )
 
+                if can_apply_profile_filter and bound_username:
+                    actor_aliases = _resolve_profile_actor_aliases(env, bound_username)
+                    if not actor_aliases:
+                        actor_aliases = [bound_username]
+                    logger.reason(
+                        "[REASON] Applying profile actor filter "
+                        f"(env={env_id}, bound_username={bound_username}, actor_aliases={actor_aliases!r}, "
+                        f"dashboards_before={len(dashboards)})"
+                    )
+                    filtered_dashboards: List[Dict[str, Any]] = []
+                    max_actor_samples = 15
+                    for index, dashboard in enumerate(dashboards):
+                        owners_value = dashboard.get("owners")
+                        created_by_value = dashboard.get("created_by")
+                        modified_by_value = dashboard.get("modified_by")
+                        matches_actor = _matches_dashboard_actor_aliases(
+                            profile_service=profile_service,
+                            actor_aliases=actor_aliases,
+                            owners=owners_value,
+                            modified_by=modified_by_value,
+                        )
+                        if index < max_actor_samples:
+                            logger.reflect(
+                                "[REFLECT] Profile actor filter sample "
+                                f"(env={env_id}, dashboard_id={dashboard.get('id')}, "
+                                f"bound_username={bound_username!r}, actor_aliases={actor_aliases!r}, "
+                                f"owners={owners_value!r}, created_by={created_by_value!r}, "
+                                f"modified_by={modified_by_value!r}, matches={matches_actor})"
+                            )
+                        if matches_actor:
+                            filtered_dashboards.append(dashboard)
+
+                    logger.reflect(
+                        "[REFLECT] Profile actor filter summary "
+                        f"(env={env_id}, bound_username={bound_username!r}, "
+                        f"dashboards_before={len(dashboards)}, dashboards_after={len(filtered_dashboards)})"
+                    )
+                    dashboards = filtered_dashboards
+
                 if search:
                     search_lower = search.lower()
                     dashboards = [
@@ -376,13 +583,21 @@ async def get_dashboards(
                         return False
 
                     changed_on_raw = str(dashboard.get("last_modified") or "").strip().lower()
-                    changed_on_prefix = changed_on_raw[:10] if len(changed_on_raw) >= 10 else changed_on_raw
-                    if changed_on_filters and changed_on_raw not in changed_on_filters and changed_on_prefix not in changed_on_filters:
+                    changed_on_prefix = (
+                        changed_on_raw[:10] if len(changed_on_raw) >= 10 else changed_on_raw
+                    )
+                    if (
+                        changed_on_filters
+                        and changed_on_raw not in changed_on_filters
+                        and changed_on_prefix not in changed_on_filters
+                    ):
                         return False
 
                     owners = dashboard.get("owners") or []
                     if isinstance(owners, list):
-                        actor_value = ", ".join(str(item).strip() for item in owners if str(item).strip()).lower()
+                        actor_value = ", ".join(
+                            str(item).strip() for item in owners if str(item).strip()
+                        ).lower()
                     else:
                         actor_value = str(owners).strip().lower()
                     if not actor_value:
@@ -391,44 +606,29 @@ async def get_dashboards(
                         return False
                     return True
 
-                dashboards = [d for d in dashboards if _matches_dashboard_filters(d)]
-                total = len(dashboards)
-                total_pages = (total + page_size - 1) // page_size if total > 0 else 1
-                start_idx = (page - 1) * page_size
-                end_idx = start_idx + page_size
-                paginated_dashboards = dashboards[start_idx:end_idx]
-            else:
-                # Compatibility path for mocked services in route tests.
-                dashboards = await resource_service.get_dashboards_with_status(
-                    env,
-                    all_tasks,
-                    include_git_status=False,
-                )
-
-                if search:
-                    search_lower = search.lower()
-                    dashboards = [
-                        d for d in dashboards 
-                        if search_lower in d.get('title', '').lower() 
-                        or search_lower in d.get('slug', '').lower()
-                    ]
+                if has_column_filters:
+                    dashboards = [d for d in dashboards if _matches_dashboard_filters(d)]
 
                 total = len(dashboards)
                 total_pages = (total + page_size - 1) // page_size if total > 0 else 1
                 start_idx = (page - 1) * page_size
                 end_idx = start_idx + page_size
                 paginated_dashboards = dashboards[start_idx:end_idx]
-            
-            logger.info(f"[get_dashboards][Coherence:OK] Returning {len(paginated_dashboards)} dashboards (page {page}/{total_pages}, total: {total})")
-            
+
+            logger.info(
+                f"[get_dashboards][Coherence:OK] Returning {len(paginated_dashboards)} dashboards "
+                f"(page {page}/{total_pages}, total: {total}, profile_filter_applied={effective_profile_filter.applied})"
+            )
+
             return DashboardsResponse(
                 dashboards=paginated_dashboards,
                 total=total,
                 page=page,
                 page_size=page_size,
-                total_pages=total_pages
+                total_pages=total_pages,
+                effective_profile_filter=effective_profile_filter,
             )
-            
+
         except Exception as e:
             logger.error(f"[get_dashboards][Coherence:Failed] Failed to fetch dashboards: {e}")
             raise HTTPException(status_code=503, detail=f"Failed to fetch dashboards: {str(e)}")

backend/src/api/routes/profile.py

@@ -0,0 +1,136 @@
+# [DEF:backend.src.api.routes.profile:Module]
+#
+# @TIER:      CRITICAL
+# @SEMANTICS: api, profile, preferences, self-service, account-lookup
+# @PURPOSE:   Exposes self-scoped profile preference endpoints and environment-based Superset account lookup.
+# @LAYER:     API
+# @RELATION:  DEPENDS_ON -> backend.src.services.profile_service
+# @RELATION:  DEPENDS_ON -> backend.src.dependencies.get_current_user
+# @RELATION:  DEPENDS_ON -> backend.src.core.database.get_db
+#
+# @INVARIANT: Endpoints are self-scoped and never mutate another user preference.
+# @UX_STATE: ProfileLoad -> Returns stable ProfilePreferenceResponse for authenticated user.
+# @UX_STATE: Saving -> Validation errors map to actionable 422 details.
+# @UX_STATE: LookupLoading -> Returns success/degraded Superset lookup payload.
+# @UX_FEEDBACK: Stable status/message/warning payloads support profile page feedback.
+# @UX_RECOVERY: Lookup degradation keeps manual username save path available.
+
+# [SECTION: IMPORTS]
+from typing import Optional
+
+from fastapi import APIRouter, Depends, HTTPException, Query
+from sqlalchemy.orm import Session
+
+from ...core.database import get_db
+from ...core.logger import logger, belief_scope
+from ...dependencies import get_config_manager, get_current_user
+from ...models.auth import User
+from ...schemas.profile import (
+    ProfilePreferenceResponse,
+    ProfilePreferenceUpdateRequest,
+    SupersetAccountLookupRequest,
+    SupersetAccountLookupResponse,
+)
+from ...services.profile_service import (
+    EnvironmentNotFoundError,
+    ProfileAuthorizationError,
+    ProfileService,
+    ProfileValidationError,
+)
+# [/SECTION]
+
+router = APIRouter(prefix="/api/profile", tags=["profile"])
+
+
+# [DEF:_get_profile_service:Function]
+# @PURPOSE: Build profile service for current request scope.
+# @PRE: db session and config manager are available.
+# @POST: Returns a ready ProfileService instance.
+def _get_profile_service(db: Session, config_manager) -> ProfileService:
+    return ProfileService(db=db, config_manager=config_manager)
+# [/DEF:_get_profile_service:Function]
+
+
+# [DEF:get_preferences:Function]
+# @PURPOSE: Get authenticated user's dashboard filter preference.
+# @PRE: Valid JWT and authenticated user context.
+# @POST: Returns preference payload for current user only.
+@router.get("/preferences", response_model=ProfilePreferenceResponse)
+async def get_preferences(
+    current_user: User = Depends(get_current_user),
+    db: Session = Depends(get_db),
+    config_manager=Depends(get_config_manager),
+):
+    with belief_scope("profile.get_preferences", f"user_id={current_user.id}"):
+        logger.reason("[REASON] Resolving current user preference")
+        service = _get_profile_service(db, config_manager)
+        return service.get_my_preference(current_user)
+# [/DEF:get_preferences:Function]
+
+
+# [DEF:update_preferences:Function]
+# @PURPOSE: Update authenticated user's dashboard filter preference.
+# @PRE: Valid JWT and valid request payload.
+# @POST: Persists normalized preference for current user or raises validation/authorization errors.
+@router.patch("/preferences", response_model=ProfilePreferenceResponse)
+async def update_preferences(
+    payload: ProfilePreferenceUpdateRequest,
+    current_user: User = Depends(get_current_user),
+    db: Session = Depends(get_db),
+    config_manager=Depends(get_config_manager),
+):
+    with belief_scope("profile.update_preferences", f"user_id={current_user.id}"):
+        service = _get_profile_service(db, config_manager)
+        try:
+            logger.reason("[REASON] Attempting preference save")
+            return service.update_my_preference(current_user=current_user, payload=payload)
+        except ProfileValidationError as exc:
+            logger.reflect("[REFLECT] Preference validation failed")
+            raise HTTPException(status_code=422, detail=exc.errors) from exc
+        except ProfileAuthorizationError as exc:
+            logger.explore("[EXPLORE] Cross-user mutation guard blocked request")
+            raise HTTPException(status_code=403, detail=str(exc)) from exc
+# [/DEF:update_preferences:Function]
+
+
+# [DEF:lookup_superset_accounts:Function]
+# @PURPOSE: Lookup Superset account candidates in selected environment.
+# @PRE: Valid JWT, authenticated context, and environment_id query parameter.
+# @POST: Returns success or degraded lookup payload with stable shape.
+@router.get("/superset-accounts", response_model=SupersetAccountLookupResponse)
+async def lookup_superset_accounts(
+    environment_id: str = Query(...),
+    search: Optional[str] = Query(default=None),
+    page_index: int = Query(default=0, ge=0),
+    page_size: int = Query(default=20, ge=1, le=100),
+    sort_column: str = Query(default="username"),
+    sort_order: str = Query(default="desc"),
+    current_user: User = Depends(get_current_user),
+    db: Session = Depends(get_db),
+    config_manager=Depends(get_config_manager),
+):
+    with belief_scope(
+        "profile.lookup_superset_accounts",
+        f"user_id={current_user.id}, environment_id={environment_id}",
+    ):
+        service = _get_profile_service(db, config_manager)
+        lookup_request = SupersetAccountLookupRequest(
+            environment_id=environment_id,
+            search=search,
+            page_index=page_index,
+            page_size=page_size,
+            sort_column=sort_column,
+            sort_order=sort_order,
+        )
+        try:
+            logger.reason("[REASON] Executing Superset account lookup")
+            return service.lookup_superset_accounts(
+                current_user=current_user,
+                request=lookup_request,
+            )
+        except EnvironmentNotFoundError as exc:
+            logger.explore("[EXPLORE] Lookup request references unknown environment")
+            raise HTTPException(status_code=404, detail=str(exc)) from exc
+# [/DEF:lookup_superset_accounts:Function]
+
+# [/DEF:backend.src.api.routes.profile:Module]