[anuj-kumary]

Describe your changes

Glossary.spec.ts › Verify Glossary Deny Permission and Verify Glossary Term Deny Permission time out on every retry, on both MySQL and PostgreSQL, in nightly AUT run 41934979088. They passed in the previous main nightly (image om-27a4fb14).

Cause: #36952 made list endpoints leave out rows that a deny rule refuses (ADR:2026-11-03-a-listing-returns-only-rows-the-caller-may-read). Both tests tag the entity with a deny All tag rule and then went through the list:

• Glossary test: waited for the glossary in the left panel. The page snapshot shows it missing from the 63 listed glossaries.
• Term test: clicked the term in the glossary's terms table. The table now shows the empty state.

The product works as intended; the tests were out of date.

Fix (tests only):

• Open the denied glossary or term by its URL. The 403 sends the user to /403, which shows permission-error-placeholder.
• In the term test, also check through the API that the data consumer's GET /glossaryTerms?glossary=<id> leaves the denied term out. That pins the new listing behaviour without a not.toBeVisible check, which would pass even if nothing loaded.

Type of change

• Bug fix (test)

Test evidence

• ESLint and Prettier pass on the changed spec. The 2 warnings are pre-existing.
• Not run locally: the local server is an older build without fix(security): third batch of backend security-hardening fixes #36952. Validate with a Playwright dispatch on this branch.

🤖 Generated with Claude Code

[github-actions]

❌ PR checklist incomplete

This PR cannot be merged until the following are addressed on its linked issue:

• No GitHub issue is linked. Link an issue in the Development section of the PR (or add Fixes #12345 to the description). For a same-org cross-repo issue, add Fixes open-metadata/<repo>#123 to the description.

The fields live on the linked issue in the Shipping project (open the issue → right sidebar → Projects). After you set them, re-run this check (or push a commit) — issue/project changes do not re-trigger it automatically.

Maintainers can bypass this check by adding the skip-pr-checks label.

[github-actions]

Hi there 👋 Thanks for your contribution!

The OpenMetadata team will review the PR shortly! Once it has been labeled as safe to test, the CI workflows
will start executing and we'll be able to make sure everything is working as expected.

Let us know if you need any help!

[gitar-bot]

Code Review ✅ Approved

🟢 Low risk · Changes only Playwright permission tests to access denied glossary records directly and assert listing omission; executable product behavior remains unchanged.

Updates the Glossary deny-permission and term deny-permission Playwright tests to open the denied glossary or term by URL, expecting the /403 placeholder, and adds an API check that GET /glossaryTerms?glossary=<id> omits the denied term. No issues found.

Verification

Rules No rules evaluated

Functional validation Not enabled

Set up

Auto-approval Not enabled

Set up

_{For more verification details, comment gitar display:verbose.}

Options

Display: compact → Showing compact verification results.

Comment with these commands to change the behavior for this request:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}