feat: RLS for SQL Lab #19999

betodealmeida · 2022-05-09T16:55:26Z

SUMMARY

Add a new feature flag RLS_IN_SQLLAB that when enabled will make Superset apply relevant RLS rules to queries ran in SQL Lab.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

Created a simple RLS on bart_lines:

Confirmed that it works in Explore, as expected:

Ran query in SQL Lab, RLS is also applied:

TESTING INSTRUCTIONS

WIP

ADDITIONAL INFORMATION

Has associated issue:
Required feature flags:
Changes UI
Includes DB Migration (follow approval process in SIP-59)
- Migration is atomic, supports rollback & is backwards-compatible
- Confirm DB migration upgrade and downgrade tested
- Runtime estimates and downtime expectations provided
Introduces new feature or API
Removes existing feature or API

codecov · 2022-05-09T17:11:11Z

Codecov Report

Merging #19999 (aef0026) into master (62e1c34) will decrease coverage by 0.13%.
The diff coverage is 85.97%.

❗ Current head aef0026 differs from pull request most recent head 14848ac. Consider uploading reports for the commit 14848ac to get more accurate results

@@            Coverage Diff             @@
##           master   #19999      +/-   ##
==========================================
- Coverage   66.28%   66.15%   -0.14%     
==========================================
  Files        1712     1713       +1     
  Lines       63968    64071     +103     
  Branches     6731     6731              
==========================================
- Hits        42404    42386      -18     
- Misses      19853    19974     +121     
  Partials     1711     1711

Flag	Coverage Δ
hive	`?`
mysql	`82.04% <95.83%> (+0.04%)`	⬆️
postgres	`82.10% <97.50%> (+0.05%)`	⬆️
presto	`?`
python	`82.14% <97.50%> (-0.34%)`	⬇️
sqlite	`?`
unit	`?`

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
.../plugin-chart-echarts/src/Funnel/transformProps.ts	`71.73% <ø> (ø)`
...lugins/plugin-chart-echarts/src/Gauge/constants.ts	`100.00% <ø> (ø)`
...hart-echarts/src/MixedTimeseries/transformProps.ts	`0.00% <0.00%> (ø)`
...ins/plugin-chart-echarts/src/Pie/transformProps.ts	`55.07% <ø> (ø)`
...s/plugin-chart-echarts/src/Radar/transformProps.ts	`0.00% <ø> (ø)`
...plugin-chart-echarts/src/Treemap/transformProps.ts	`51.51% <ø> (ø)`
...ns/plugin-chart-word-cloud/src/chart/WordCloud.tsx	`0.00% <0.00%> (ø)`
...ins/preset-chart-xy/src/components/Line/Encoder.ts	`100.00% <ø> (ø)`
superset-frontend/src/SqlLab/actions/sqlLab.js	`60.39% <0.00%> (ø)`
...rc/SqlLab/components/ScheduleQueryButton/index.tsx	`20.75% <0.00%> (ø)`
... and 110 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 62e1c34...14848ac. Read the comment docs.

superset/sql_lab.py

betodealmeida · 2022-05-11T02:55:35Z

superset/sql_lab.py

    parsed_query = ParsedQuery(sql_statement)
+    if is_feature_enabled("RLS_IN_SQLLAB"):


This is the core of the PR, the rest is just passing username around.

dpgaspar · 2022-05-11T11:20:57Z

superset/security/manager.py

+        elif username:
+            user = self.find_user(username=username)
+        else:
+            return []


nice if flip, less indentation

villebro

One minor docstring comment. Also, would be nice to have at least minimal tests for this, as this is a fairly central security feature. If it's a lot of work, which I assume it is, I can try to help out!

villebro · 2022-05-11T11:39:14Z

superset/connectors/sqla/models.py

-        self, template_processor: BaseTemplateProcessor
+        self,
+        template_processor: BaseTemplateProcessor,
+        username: Optional[str] = None,


nit: username is missing in the docstring here and in security_manager.get_rls_filters. The main description says it retrieves rls filters for "the current user" - we should perhaps remove that text from both docstrings and state that if username is missing, it will fall back to the current user.

Ah, good catch and good point, @villebro! Let me fix the docstrings and add tests.

villebro

LGTM with a very minor non-blocking nit. This is really great, as it will open up SQL Lab to RLS users 🚀

superset/connectors/sqla/models.py

* feat: RLS for SQL Lab * Small fixes * Pass username to security manager * Update docstrings * Add tests * Remove type from docstring

pull-request-size bot added the size/S label May 9, 2022

betodealmeida force-pushed the rls_sqllab branch 2 times, most recently from dd10848 to 37058a5 Compare May 9, 2022 18:38

pull-request-size bot added size/M and removed size/S labels May 9, 2022

betodealmeida requested review from villebro and lilykuang May 9, 2022 18:39

betodealmeida commented May 9, 2022

View reviewed changes

superset/sql_lab.py Outdated Show resolved Hide resolved

feat: RLS for SQL Lab

c84c99f

betodealmeida force-pushed the rls_sqllab branch from 37058a5 to c84c99f Compare May 9, 2022 19:07

Small fixes

ab419a1

betodealmeida force-pushed the rls_sqllab branch from 2d6bf52 to ab419a1 Compare May 10, 2022 01:58

dpgaspar reviewed May 10, 2022

View reviewed changes

superset/sql_lab.py Outdated Show resolved Hide resolved

pull-request-size bot added size/L and removed size/M labels May 10, 2022

betodealmeida requested a review from dpgaspar May 10, 2022 15:24

betodealmeida force-pushed the rls_sqllab branch from 00c970b to 740613e Compare May 10, 2022 15:37

Pass username to security manager

b2b4612

betodealmeida force-pushed the rls_sqllab branch from 740613e to b2b4612 Compare May 10, 2022 15:57

betodealmeida commented May 11, 2022

View reviewed changes

dpgaspar reviewed May 11, 2022

View reviewed changes

dpgaspar approved these changes May 11, 2022

View reviewed changes

villebro reviewed May 11, 2022

View reviewed changes

Update docstrings

12737e2

betodealmeida force-pushed the rls_sqllab branch from 239fc07 to 27dc2f9 Compare May 12, 2022 01:17

Add tests

394a814

betodealmeida force-pushed the rls_sqllab branch from 27dc2f9 to 394a814 Compare May 12, 2022 01:35

villebro approved these changes May 12, 2022

View reviewed changes

superset/connectors/sqla/models.py Outdated Show resolved Hide resolved

Remove type from docstring

14848ac

betodealmeida merged commit f2881e5 into apache:master May 12, 2022

betodealmeida mentioned this pull request May 17, 2022

feat: a native SQLAlchemy dialect for Superset #14225

Merged

8 tasks

philipher29 pushed a commit to ValtechMobility/superset that referenced this pull request Jun 9, 2022

feat: RLS for SQL Lab (apache#19999)

308159e

* feat: RLS for SQL Lab * Small fixes * Pass username to security manager * Update docstrings * Add tests * Remove type from docstring

john-bodley mentioned this pull request Jun 10, 2022

chore(rls): Remove passing global username #20344

Merged

9 tasks

mistercrunch added 🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels 🚢 2.0.0 labels Mar 13, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: RLS for SQL Lab #19999

feat: RLS for SQL Lab #19999

betodealmeida commented May 9, 2022 •

edited by yousoph

codecov bot commented May 9, 2022 •

edited

betodealmeida May 11, 2022

dpgaspar May 11, 2022

villebro left a comment

villebro May 11, 2022

betodealmeida May 11, 2022

villebro left a comment

		parsed_query = ParsedQuery(sql_statement)
		if is_feature_enabled("RLS_IN_SQLLAB"):

feat: RLS for SQL Lab #19999

feat: RLS for SQL Lab #19999

Conversation

betodealmeida commented May 9, 2022 • edited by yousoph

SUMMARY

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

codecov bot commented May 9, 2022 • edited

Codecov Report

betodealmeida May 11, 2022

Choose a reason for hiding this comment

dpgaspar May 11, 2022

Choose a reason for hiding this comment

villebro left a comment

Choose a reason for hiding this comment

villebro May 11, 2022

Choose a reason for hiding this comment

betodealmeida May 11, 2022

Choose a reason for hiding this comment

villebro left a comment

Choose a reason for hiding this comment

betodealmeida commented May 9, 2022 •

edited by yousoph

codecov bot commented May 9, 2022 •

edited