fix: Use RLS clause instead of ID for cache key

superset/security/manager.py

@@ -2083,26 +2083,26 @@ def get_rls_filters(self, table: "BaseDatasource") -> list[SqlaQuery]:
         )
         return query.all()
 
-    def get_rls_ids(self, table: "BaseDatasource") -> list[int]:
+    def get_rls_filters_str(self, table: "BaseDatasource") -> list[str]:
         """
-        Retrieves the appropriate row level security filters IDs for the current user
-        and the passed table.
+        Retrieves the appropriate row level security filters string representation
+        (id concat'ed with clause) for the current user and the passed table.
 
         :param table: The table to check against
-        :returns: A list of IDs
+        :returns: A list of string representations of the user's RLS filters
         """
-        ids = [f.id for f in self.get_rls_filters(table)]
-        ids.sort()  # Combinations rather than permutations
-        return ids
+        filters = self.get_rls_filters(table)
+        filters.sort(key=lambda f: f.id)  # Combinations rather than permutations
+        str_reps = [f"{f.id}-{f.clause}" for f in filters]
+        return str_reps
 
     def get_guest_rls_filters_str(self, table: "BaseDatasource") -> list[str]:
         return [f.get("clause", "") for f in self.get_guest_rls_filters(table)]
 
     def get_rls_cache_key(self, datasource: "BaseDatasource") -> list[str]:
-        rls_ids = []
+        rls_str = []
         if datasource.is_rls_supported:
-            rls_ids = self.get_rls_ids(datasource)
-        rls_str = [str(rls_id) for rls_id in rls_ids]
+            rls_str = self.get_rls_filters_str(datasource)
         guest_rls = self.get_guest_rls_filters_str(datasource)
         return guest_rls + rls_str
 

tests/integration_tests/security/row_level_security_tests.py

@@ -305,6 +305,17 @@ def test_rls_filter_doesnt_alter_admin_birth_names_query(self):
         assert not self.NAMES_Q_REGEX.search(sql)
         assert not self.BASE_FILTER_REGEX.search(sql)
 
+    @pytest.mark.usefixtures("load_birth_names_dashboard_with_slices")
+    def test_get_rls_filter_clauses(self):
+        g.user = self.get_user(username="admin")
+        tbl = self.get_table(name="birth_names")
+        clauses = security_manager.get_rls_filters_str(tbl)
+        assert clauses == []
+
+        g.user = self.get_user(username="gamma")
+        clauses = security_manager.get_rls_filters_str(tbl)
+        assert clauses == [f"{self.rls_entry2.id}-name like 'A%' or name like 'B%'", f"{self.rls_entry3.id}-name like 'Q%'", f"{self.rls_entry4.id}-gender = 'boy'"]
+
 
 class TestRowLevelSecurityCreateAPI(SupersetTestCase):
     @pytest.mark.usefixtures("load_birth_names_dashboard_with_slices")