Filter Druid Datasources by user permissions. (#1090)

caravel/views.py

@@ -230,6 +230,19 @@ def apply(self, query, value):  # noqa
         return qry
 
 
+class FilterDruidDatasource(CaravelFilter):
+    def apply(self, query, func):  # noqa
+        if any([r.name in ('Admin', 'Alpha') for r in get_user_roles()]):
+            return query
+        perms = self.get_perms()
+        druid_datasources = []
+        for perm in perms:
+            match = re.search(r'\(id:(\d+)\)', perm)
+            druid_datasources.append(match.group(1))
+        qry = query.filter(self.model.id.in_(druid_datasources))
+        return qry
+
+
 def validate_json(form, field):  # noqa
     try:
         json.loads(field.data)
@@ -857,6 +870,7 @@ class DruidDatasourceModelView(CaravelModelView, DeleteMixin):  # noqa
             "Supports <a href='"
             "https://daringfireball.net/projects/markdown/'>markdown</a>"),
     }
+    base_filters = [['id', FilterDruidDatasource, lambda: []]]
     label_columns = {
         'datasource_link': _("Data Source"),
         'cluster': _("Cluster"),

tests/core_tests.py

@@ -280,6 +280,34 @@ def test_druid_sync_from_config(self):
             ["longSum", "sum", "unique"])
         assert resp.status_code == 201
 
+    def test_filter_druid_datasource(self):
+        gamma_ds = DruidDatasource(
+            datasource_name="datasource_for_gamma",
+        )
+        db.session.add(gamma_ds)
+        no_gamma_ds = DruidDatasource(
+            datasource_name="datasource_not_for_gamma",
+        )
+        db.session.add(no_gamma_ds)
+        db.session.commit()
+        utils.merge_perm(sm, 'datasource_access', gamma_ds.perm)
+        utils.merge_perm(sm, 'datasource_access', no_gamma_ds.perm)
+        db.session.commit()
+
+        gamma_ds_permission_view = (
+            db.session.query(ab_models.PermissionView)
+            .join(ab_models.ViewMenu)
+            .filter(ab_models.ViewMenu.name == gamma_ds.perm)
+            .first()
+        )
+        sm.add_permission_role(sm.find_role('Gamma'), gamma_ds_permission_view)
+
+        self.login(username='gamma')
+        url = '/druiddatasourcemodelview/list/'
+        resp = self.client.get(url, follow_redirects=True)
+        assert 'datasource_for_gamma' in resp.data.decode('utf-8')
+        assert 'datasource_not_for_gamma' not in resp.data.decode('utf-8')
+
     def test_gamma(self):
         self.login(username='gamma')
         resp = self.client.get('/slicemodelview/list/')