Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[query] deprecate can_only_access_owned_queries #9046

Merged
merged 4 commits into from Feb 5, 2020

Conversation

dpgaspar
Copy link
Member

@dpgaspar dpgaspar commented Jan 29, 2020

CATEGORY

  • Bug Fix
  • Enhancement (new features, refinement)
  • Refactor
  • Add tests
  • Build / Development Environment
  • Documentation

SUMMARY

Proposal to deprecate can_only_access_owned_queries in favor of the new all_query_access

The default changes from:

  • all users can view all other user's queries
    to:
  • user's can access only their own queries except Admin users.

all_query_access can be added to existing roles giving their corresponding user's access to everyone's queries

Running superset init is required to create the new permission

ADDITIONAL INFORMATION

  • Has associated issue:
  • Changes UI
  • Requires DB Migration.
  • Confirm DB Migration upgrade and downgrade tested.
  • Introduces new feature or API
  • Removes existing feature or API

REVIEWERS

@willbarrett

@dpgaspar dpgaspar changed the title Fix/api superset queryview list [query] deprecate can_only_access_owned_queries Jan 29, 2020
Copy link
Member

@craig-rueda craig-rueda left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One nit, otherwise LGTM

superset/security/manager.py Outdated Show resolved Hide resolved
@codecov-io
Copy link

codecov-io commented Jan 29, 2020

Codecov Report

Merging #9046 into master will increase coverage by 0.29%.
The diff coverage is n/a.

Impacted file tree graph

@@            Coverage Diff             @@
##           master    #9046      +/-   ##
==========================================
+ Coverage   59.16%   59.45%   +0.29%     
==========================================
  Files         367      369       +2     
  Lines       11680    11747      +67     
  Branches     2863     2888      +25     
==========================================
+ Hits         6910     6984      +74     
+ Misses       4591     4584       -7     
  Partials      179      179
Impacted Files Coverage Δ
.../assets/src/SqlLab/components/AceEditorWrapper.jsx 54.21% <0%> (-1.48%) ⬇️
superset/assets/src/SqlLab/constants.js 100% <0%> (ø) ⬆️
superset/assets/src/chart/chartAction.js 47.94% <0%> (ø) ⬆️
...et/assets/src/components/IndeterminateCheckbox.jsx 100% <0%> (ø)
...rset/assets/src/components/ConfirmStatusChange.tsx 100% <0%> (ø)
superset/assets/src/components/ListView/utils.ts 98.46% <0%> (+0.31%) ⬆️
...uperset/assets/src/SqlLab/components/SqlEditor.jsx 51.94% <0%> (+0.31%) ⬆️
superset/assets/src/components/TableSelector.jsx 78.35% <0%> (+0.32%) ⬆️
...uperset/assets/src/dashboard/components/Header.jsx 42.06% <0%> (+0.93%) ⬆️
...perset/assets/src/components/ListView/ListView.tsx 92.2% <0%> (+1.03%) ⬆️
... and 1 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 22699a2...4e8f617. Read the comment docs.

@@ -538,11 +536,10 @@ def create_custom_permissions(self) -> None:
"""
Create custom FAB permissions.
"""

self.add_permission_view_menu("all_datasource_access", "all_datasource_access")
self.add_permission_view_menu("all_database_access", "all_database_access")
self.add_permission_view_menu(
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is creating the permission tied to the concept of a view and the concept of a menu?

superset/views/core.py Outdated Show resolved Hide resolved
@dpgaspar
Copy link
Member Author

dpgaspar commented Feb 3, 2020

@graceguo-supercat it would be awesome if you could take a look

@dpgaspar dpgaspar merged commit 916d184 into apache:master Feb 5, 2020
@dpgaspar dpgaspar deleted the fix/api-superset-queryview-list branch February 5, 2020 08:58
@mistercrunch mistercrunch added 🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels 🚢 0.36.0 labels Feb 28, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels size/L 🚢 0.36.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

6 participants