[WiP] [SIP-19] Simplify Superset's set of permissions #7510
[SIP-19] Simplify Superset's permissions
First let's clarify that this is about feature-related permissions, as opposed to data-access permissions. Also note that what I'll refer to as an "atomic permission" is a combination of what FAB calls a "view_menu" and a "permission".
Also note that this change will be powered by recently released FAB features enabling more control over permission definition, as well as migration tools making it straightforward to map and migrate existing role from old to new permission. More information about related FAB features can be found here:
The bulk of feature-related permissions are dynamically generated by Flask App Builder (FAB). For context, FAB generates:
Now Superset overtime has grown to ship with ~280+ permissions. Most of these permissions are unintelligible to users, the UI that exposes them suffers from too much options. In the current state, it almost only makes sense to generate roles programmatically since the cardinality of permissions is so high.
While we want the atomicity of permissions to cover most use cases, we want for permissions to be easy to document and reason about. In cases where it would be unreasonable to have one permission and not another closely related one, we'd like to merge them as a single permission.
First, group ModelView-related permissions into 2 simple permissions:
This assumes that if you can edit, you can also delete or add (
Second, rename and group ModelView names. For clarity drop the "ModelView" suffix and match the Model's name. For examples,
Third, models that are related and tightly coupled, for example every Models living around the connectors should refer to the same set of permissions. DruidDatasource, SqlaTables, and their respective Metric and Column models can all go under
This results in the following mappings (Google Spreadsheet):
Additionally the notion of
Unclear is whether
New or Changed Public Interfaces
Migration Plan and Compatibility
Users will have to run
Related future work