fix(deckgl): emit usable cross-filter values from polygon and geojson clicks

[alex-poor]

SUMMARY

deck.gl Polygon and Geojson charts emit cross-filters whose values cannot match anything in receiving charts. Clicking a region produces a chip with a long polygon-coordinate JSON string, and any receiving chart filtered by it shows "No data". The emitted SQL clause is:

REPLACE(<geometry_column>, ' ', '') == '<JSON.stringify(picked path)>'

…which compares a bare coordinate path to a column that typically stores a full GeoJSON Feature. It can never match.

This PR adds a new optional Cross-filter column control (cross_filter_column) to deck_polygon and deck_geojson. When set, clicking a feature emits a clean dimension filter:

sa3_name == 'Christchurch West'

…which other charts on the dashboard match by column name and renders as a readable chip.

Resolution paths for the dimension value:

• deck_polygon: read from data.object[col] (groupby/columns are spread onto the picked feature by addPropertiesToFeature), falling back to data.object.extraProps[col] for js_columns overlap. The control is added to the chart's query in buildQuery.ts so the column actually comes back in records.
• deck_geojson: read from data.object.properties[col] — the standard non-spatial location on a GeoJSON Feature.

When cross_filter_column is unset (or its value is missing on the picked feature), behavior falls back to the legacy filter so existing dashboards keep working. A console.warn flags the fallback case so users know to re-save.

Bonus fix: deck.gl v9 event-shape regression

While testing locally I found that left-click on any deck.gl chart with cross-filtering enabled has been silently emitting nothing since the deck.gl v9 upgrade. The handler in commonLayerProps was checking event.leftButton / event.rightButton, which deck.gl v9 no longer provides:

if (event.leftButton && setDataMask !== undefined && crossFilters) { ... }
else if (event.rightButton && onContextMenu !== undefined) { ... }

Both flags are undefined in v9; the actual event shape is { type, offsetCenter, srcEvent, tapCount }. Dispatch now uses event.type and srcEvent.button (standard MouseEvent semantics — button === 0 is left, === 2 is right). This restores left-click filter emission and right-click context menus across all deck.gl chart types, not just the polygon/geojson cases above.

This fix is included in scope because the cross-filter feature is unobservably broken without it — even verifying the original bug locally requires the click handler to fire at all.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

N/A — text-only diff. Symptom is described in detail above.

TESTING INSTRUCTIONS

1. Build a deck.gl Polygon chart with Polygon Column = geojson (any dataset whose geometry column stores GeoJSON Features will do).
2. Add it to a dashboard alongside another chart whose dataset shares a non-spatial dimension (e.g. sa3_name).
3. Enable cross-filtering on the dashboard and on the chart.
4. Without the fix: clicking a polygon does nothing visible (left-click event not gated correctly) or, if the click handler ran, would emit a polygon-JSON chip and "No data" in the receiving chart.
5. With the fix, cross_filter_column unset: clicking emits the legacy broken filter (chip = polygon JSON), which is what older charts expect. Backwards-compatible.
6. With the fix, cross_filter_column = 'sa3_name' (set under Customize → Advanced → Cross-filter column, then re-run the chart so the column lands in records, then save): clicking emits sa3_name == '<region>'. Chip reads sa3_name: <region>. Receiving chart filters correctly.
7. Right-click on a polygon should now open the standard context menu (Drill / Filter) — same fix as Query component: limit_spec is not valid for query type: groupBy.The list of valid #4.
8. Same flow works for deck.gl Geojson, where the dimension column must exist inside each Feature's properties object.

Automated tests

• crossFiltersDataMask.test.ts extended with 6 new cases: polygon w/ top-level dimension, polygon w/ extraProps fallback, polygon w/ legacy fallback when value missing (validates the warn), polygon legacy path (no cross_filter_column), geojson w/ properties, geojson legacy path.
• All 256 tests in preset-chart-deckgl pass; tsc and prettier clean.

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

This supersedes #28262 (open since April 2024, marked stale by maintainers, targets the now-removed legacy-preset-chart-deckgl/ path, predates the merged cross-filter feature in #33789).

[bito-code-review]

The flagged issue is correct: adding the cross_filter_column control to GeoJSON without updating the query to include the selected column causes a mismatch, leading to fallback filters. To resolve, update Geojson/buildQuery.ts to include cross_filter_column in queried columns, similar to Polygon layer. No other comments found in the PR.

superset-frontend/plugins/preset-chart-deckgl/src/layers/Geojson/buildQuery.ts

export interface DeckGeojsonFormData extends SqlaFormData {
  // ... existing fields
  cross_filter_column?: string | null;
}

export default function buildQuery(formData: DeckGeojsonFormData) {
  const {
    // ... existing destructuring
    cross_filter_column,
  } = formData;
  // ... existing code
  if (cross_filter_column && !columns.includes(cross_filter_column)) {
    columns.push(cross_filter_column);
  }
  // ... rest
}

[bito-code-review]

Code Review Agent Run #7bad6c

Actionable Suggestions - 2

• superset-frontend/plugins/preset-chart-deckgl/src/utils/crossFiltersDataMask.ts - 2

  • CWE-1321: Object injection vulnerability via dynamic property access · Line 424-424
  • CWE-1321: Object injection vulnerability in GeoJSON properties access · Line 488-488

Review Details

• Files reviewed - 7 · Commit Range: 2d7bdfb..2d7bdfb

  • superset-frontend/plugins/preset-chart-deckgl/src/layers/Geojson/controlPanel.ts
  • superset-frontend/plugins/preset-chart-deckgl/src/layers/Polygon/buildQuery.ts
  • superset-frontend/plugins/preset-chart-deckgl/src/layers/Polygon/controlPanel.ts
  • superset-frontend/plugins/preset-chart-deckgl/src/layers/common.tsx
  • superset-frontend/plugins/preset-chart-deckgl/src/utilities/Shared_DeckGL.tsx
  • superset-frontend/plugins/preset-chart-deckgl/src/utils/crossFiltersDataMask.test.ts
  • superset-frontend/plugins/preset-chart-deckgl/src/utils/crossFiltersDataMask.ts
• Files skipped - 0
• Tools

  • Whispers (Secret Scanner) - ✔︎ Successful
  • Detect-secrets (Secret Scanner) - ✔︎ Successful
  • Eslint (Linter) - ✔︎ Successful

---

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

• /review - Manually triggers a full AI review.

• /pause - Pauses automatic reviews on this pull request.

• /resume - Resumes automatic reviews.

• /resolve - Marks all Bito-posted review comments as resolved.

• /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

• Customize agent settings
• Review rules
• General documentation
• FAQ

AI Code Review powered by

[bito-code-review]

Code Review Agent Run #d9b4fb

Actionable Suggestions - 2

• superset-frontend/plugins/preset-chart-deckgl/src/layers/Geojson/transformProps.ts - 1

  • CWE-1321: Prototype Pollution in Feature Properties Assignment · Line 47-51
• superset-frontend/plugins/preset-chart-deckgl/src/layers/Geojson/buildQuery.ts - 1

  • Incorrect duplicate detection · Line 66-68

Review Details

• Files reviewed - 2 · Commit Range: 2d7bdfb..cd83850

  • superset-frontend/plugins/preset-chart-deckgl/src/layers/Geojson/buildQuery.ts
  • superset-frontend/plugins/preset-chart-deckgl/src/layers/Geojson/transformProps.ts
• Files skipped - 0
• Tools

  • Whispers (Secret Scanner) - ✔︎ Successful
  • Detect-secrets (Secret Scanner) - ✔︎ Successful
  • Eslint (Linter) - ✔︎ Successful

---

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

• /review - Manually triggers a full AI review.

• /pause - Pauses automatic reviews on this pull request.

• /resume - Resumes automatic reviews.

• /resolve - Marks all Bito-posted review comments as resolved.

• /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

• Customize agent settings
• Review rules
• General documentation
• FAQ

AI Code Review powered by