[Harshg999]

Summary

Fixes three authorization findings and drops support for Python versions
below 3.11 (including GitHub Actions fixes).

ISEC-V2026-03: Improper authorization (IDOR) in the configuration API (Medium)

• /desktop/api/configurations/, /user/ and /delete/ did not check ownership or admin role.
  A client-supplied user_id or configuration id was trusted, so any authenticated user could
  read, overwrite or delete another user's editor configuration and change the cluster-wide
  default.
• New desktop/configuration/authorization.py:
  • GET and POST /desktop/api/configurations/ (global and group configuration) require a
    Hue admin.
  • /desktop/api/configurations/user/: non-admins can only use their own user_id. Admins can
    use any valid id.
  • /desktop/api/configurations/delete/: default and group rows require an admin. User rows
    require the owner or an admin.
• CONFIG_SAVE_API in the frontend pointed at a route that does not exist
  (/configurations/save/). It now uses /desktop/api/configurations/user/.

ISEC-V2026-04: Server configuration disclosure via the configuration-check API (Low)

• GET /api/v1/check_config was available to any authenticated user. It returns the Hue
  configuration directory and the validation results, which include internal service endpoints.
• The endpoint now requires a Hue admin and returns HTTP 403 otherwise, with the same is_admin
  check as the legacy /desktop/debug/check_config view.
• available_app_examples and install_app_examples use the same shared helper
  (deny_unless_hue_admin). Their behavior is unchanged.

ISEC-V2026-05: Improper authorization (IDOR) in the indexer save API (Medium)

• POST /indexer/api/importer/save (save_pipeline) had its permission decorator commented out,
  and _save_pipeline loaded the target with Document2.objects.get(id=...) and no write check.
  Any authenticated user could overwrite another user's saved document.
• New notebook/saved_document_auth.py with get_writable_document_for_update(). It resolves the
  document by parentSavedQueryUuid (write permission required) or by id
  (can_write_or_exception), and returns None for a new document.
• @check_document_modify_permission() is re-enabled on save_pipeline. The decorator,
  _save_pipeline and _save_notebook all use the helper, so authorization still holds if a
  view decorator is ever missing.
• A missing document and a denied write return the same message, so document ids cannot be probed.
  Admins keep write access to other users' documents, as before.

Python 3.11 only

• CI (commitflow-py3.yml) runs a single Python 3.11 job, which also fixes the Ubuntu runner
  failure where setup-python could not find CPython 3.9.
• Removed multi-version support from Makefile.vars, generate_requirements.py, the
  tools/cloudera and tools/container build scripts, the Dockerfiles, python_helper.sh and
  runruff. generate_requirements.py now fails clearly on an unsupported Python version.
• Docs updated. Ruff target-version is now py311.

Behavior changes

• A read-only shared document can no longer be saved over. Previously only read access was checked
  for parentSavedQueryUuid.
• check_document_modify_permission also checks parentSavedQueryUuid when no id is sent.
• Non-admins now get an error from the global /desktop/api/configurations/ endpoint.

Other changes in this PR

• indexer/api3.py: the fetch_handle lambda is now a nested function (ruff E306).
• Small ruff cleanups in notebook/api.py, notebook/decorators.py and api_public_tests.py
  (unused imports and bindings, and an undefined SkipTest replaced with pytest.skip).
• Removed test_save_notebook_with_connector_on. It only ran with connectors enabled and used
  an undefined variable. test_save_notebook_with_connector_off remains.

Test plan

Automated:

• New: TestConfigurationAuthorization, TestCheckConfigPublicApi, TestCheckConfigAPI
  (admin and non-admin), TestSavedDocumentAuth (including admin access and the same
  missing-vs-denied message), TestSavePipeline (model and HTTP, cross-user denied, owner
  allowed) and test_save_notebook_denies_cross_user_update.
• hue runruff check passes.
• Local run of the notebook, indexer, configuration and desktop API tests: no failure is
  specific to this branch. The failures that remain also occur on origin/master (HDFS and Hive
  are not configured locally).

Manual (live server, real sessions for an admin and two normal users, 39 of 40 checks pass):

• Configuration API: a non-admin cannot read, save or delete another user's or global
  configuration. Own-user and admin flows work.
• GET /api/v1/check_config: anonymous is rejected, a non-admin gets 403 with no server paths,
  and an admin gets 200.
• Save endpoints: another user cannot overwrite a notebook or pipeline by id or
  parentSavedQueryUuid (database unchanged). Owner save and save-as work. A read-only share
  cannot be saved over and a write share can. An admin can save another user's private query.

[github-actions]

✅ Test files were modified. Ensure that the tests cover all relevant changes. ✅

[github-actions]

UI Code Coverage Report

Lines	Statements	Branches	Functions
	40.15% (31632/78765)	32.06% (14985/46740)	26.4% (2414/9142)

[github-actions]

Warning

Your comment is too long (maximum is 65536 characters), so the coverage report was not added. See the job log for how to reduce it.

[agl29]

LGTM!