Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: RBAC for can_export for any resource #17527

Merged
merged 12 commits into from
Nov 26, 2021
Merged

fix: RBAC for can_export for any resource #17527

merged 12 commits into from
Nov 26, 2021

Conversation

hughhhh
Copy link
Member

@hughhhh hughhhh commented Nov 23, 2021

SUMMARY

Removing binding for can_export to read_{resource} permissions. This will now allow us to have more control over who can be granted can_export permissions.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

  • Has associated issue:
  • Required feature flags:
  • Changes UI
  • Includes DB Migration (follow approval process in SIP-59)
    • Migration is atomic, supports rollback & is backwards-compatible
    • Confirm DB migration upgrade and downgrade tested
    • Runtime estimates and downtime expectations provided
  • Introduces new feature or API
  • Removes existing feature or API

@hughhhh hughhhh changed the title Update export rbac 2 fix: Update export rbac 2 Nov 23, 2021
@codecov
Copy link

codecov bot commented Nov 23, 2021

Codecov Report

Merging #17527 (ade23b2) into master (7429282) will decrease coverage by 0.14%.
The diff coverage is 100.00%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master   #17527      +/-   ##
==========================================
- Coverage   76.95%   76.81%   -0.15%     
==========================================
  Files        1049     1049              
  Lines       56671    56671              
  Branches     7851     7851              
==========================================
- Hits        43611    43529      -82     
- Misses      12807    12889      +82     
  Partials      253      253              
Flag Coverage Δ
hive ?
javascript 71.09% <100.00%> (-0.03%) ⬇️
mysql 82.02% <ø> (+<0.01%) ⬆️
postgres 82.03% <ø> (+<0.01%) ⬆️
python 82.12% <ø> (-0.26%) ⬇️
sqlite 81.71% <ø> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files Coverage Δ
superset/constants.py 100.00% <ø> (ø)
...perset-frontend/src/views/CRUD/chart/ChartCard.tsx 73.17% <100.00%> (-2.44%) ⬇️
...perset-frontend/src/views/CRUD/chart/ChartList.tsx 73.58% <100.00%> (-0.63%) ⬇️
...rontend/src/views/CRUD/dashboard/DashboardCard.tsx 75.55% <100.00%> (-2.23%) ⬇️
...rontend/src/views/CRUD/dashboard/DashboardList.tsx 69.79% <100.00%> (-1.35%) ⬇️
...tend/src/views/CRUD/data/database/DatabaseList.tsx 78.07% <100.00%> (ø)
...ontend/src/views/CRUD/data/dataset/DatasetList.tsx 65.16% <100.00%> (-1.13%) ⬇️
.../src/views/CRUD/data/savedquery/SavedQueryList.tsx 73.10% <100.00%> (ø)
superset/db_engines/hive.py 0.00% <0.00%> (-85.19%) ⬇️
superset/db_engine_specs/hive.py 70.27% <0.00%> (-16.99%) ⬇️
... and 11 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 7429282...ade23b2. Read the comment docs.

@hughhhh hughhhh changed the title fix: Update export rbac 2 fix: RBAC for export for dashboard viewers Nov 23, 2021
uri = f"api/v1/dataset/export/?q={prison.dumps(argument)}"

self.login(username="gamma")
rv = self.client.get(uri)
assert rv.status_code == 404
assert rv.status_code == 401
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you improve this test, granting can_export to gamma and testing that it can export after that?

I think you can do something like security_manager.add_permission_role("Gamma", "dataset_can_export") here to add the permission.

Copy link
Member

@geido geido left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM with Beto's comment

@hughhhh hughhhh merged commit 2e29f36 into master Nov 26, 2021
@hughhhh hughhhh changed the title fix: RBAC for export for dashboard viewers fix: RBAC for can_export for any resource Nov 29, 2021
@arkonchik
Copy link

arkonchik commented Feb 19, 2022

First of all thanks for this bug fix.
Hi guys, could you help, please?
I've checked this 2e29f36 in the master and it exist and it exist in this tag https://github.com/apache/superset/releases/tag/v0.19.0
But why this changes are missing from 1.4.0 and 1.4.1? How can I get the oldest stable version with this solved issue?
@betodealmeida

@Artem-fb
Copy link

@betodealmeida, @hughhhh , @AAfghahi, hello guys!
Could you please help us to find solution @arkonchik's question above

I've checked this 2e29f36 in the master and it exist and it exist in this tag https://github.com/apache/superset/releases/tag/v0.19.0
But why this changes are missing from 1.4.0 and 1.4.1? How can I get the oldest stable version with this solved issue?

Thanks in advance

@mistercrunch mistercrunch added 🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels 🚢 1.5.0 labels Mar 13, 2024
@mistercrunch mistercrunch deleted the update-export-rbac-2 branch March 26, 2024 18:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels size/M 🚢 1.5.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants