Skip to content

[query] deprecate can_only_access_owned_queries - #9046

Merged
dpgaspar merged 4 commits into
apache:masterfrom
preset-io:fix/api-superset-queryview-list
Feb 5, 2020
Merged

[query] deprecate can_only_access_owned_queries#9046
dpgaspar merged 4 commits into
apache:masterfrom
preset-io:fix/api-superset-queryview-list

Conversation

@dpgaspar

@dpgaspar dpgaspar commented Jan 29, 2020

Copy link
Copy Markdown
Member

CATEGORY

  • Bug Fix
  • Enhancement (new features, refinement)
  • Refactor
  • Add tests
  • Build / Development Environment
  • Documentation

SUMMARY

Proposal to deprecate can_only_access_owned_queries in favor of the new all_query_access

The default changes from:

  • all users can view all other user's queries
    to:
  • user's can access only their own queries except Admin users.

all_query_access can be added to existing roles giving their corresponding user's access to everyone's queries

Running superset init is required to create the new permission

ADDITIONAL INFORMATION

  • Has associated issue:
  • Changes UI
  • Requires DB Migration.
  • Confirm DB Migration upgrade and downgrade tested.
  • Introduces new feature or API
  • Removes existing feature or API

REVIEWERS

@willbarrett

@dpgaspar dpgaspar changed the title Fix/api superset queryview list [query] deprecate can_only_access_owned_queries Jan 29, 2020

@craig-rueda craig-rueda left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One nit, otherwise LGTM

Comment thread superset/security/manager.py Outdated
@codecov-io

codecov-io commented Jan 29, 2020

Copy link
Copy Markdown

Codecov Report

Merging #9046 into master will increase coverage by 0.29%.
The diff coverage is n/a.

Impacted file tree graph

@@            Coverage Diff             @@
##           master    #9046      +/-   ##
==========================================
+ Coverage   59.16%   59.45%   +0.29%     
==========================================
  Files         367      369       +2     
  Lines       11680    11747      +67     
  Branches     2863     2888      +25     
==========================================
+ Hits         6910     6984      +74     
+ Misses       4591     4584       -7     
  Partials      179      179
Impacted Files Coverage Δ
.../assets/src/SqlLab/components/AceEditorWrapper.jsx 54.21% <0%> (-1.48%) ⬇️
superset/assets/src/SqlLab/constants.js 100% <0%> (ø) ⬆️
superset/assets/src/chart/chartAction.js 47.94% <0%> (ø) ⬆️
...et/assets/src/components/IndeterminateCheckbox.jsx 100% <0%> (ø)
...rset/assets/src/components/ConfirmStatusChange.tsx 100% <0%> (ø)
superset/assets/src/components/ListView/utils.ts 98.46% <0%> (+0.31%) ⬆️
...uperset/assets/src/SqlLab/components/SqlEditor.jsx 51.94% <0%> (+0.31%) ⬆️
superset/assets/src/components/TableSelector.jsx 78.35% <0%> (+0.32%) ⬆️
...uperset/assets/src/dashboard/components/Header.jsx 42.06% <0%> (+0.93%) ⬆️
...perset/assets/src/components/ListView/ListView.tsx 92.2% <0%> (+1.03%) ⬆️
... and 1 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 22699a2...4e8f617. Read the comment docs.

Comment thread superset/security/manager.py Outdated
Comment thread superset/security/manager.py Outdated

self.add_permission_view_menu("all_datasource_access", "all_datasource_access")
self.add_permission_view_menu("all_database_access", "all_database_access")
self.add_permission_view_menu(

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is creating the permission tied to the concept of a view and the concept of a menu?

Comment thread superset/views/core.py Outdated
@dpgaspar

dpgaspar commented Feb 3, 2020

Copy link
Copy Markdown
Member Author

@graceguo-supercat it would be awesome if you could take a look

@dpgaspar
dpgaspar merged commit 916d184 into apache:master Feb 5, 2020
@dpgaspar
dpgaspar deleted the fix/api-superset-queryview-list branch February 5, 2020 08:58
@mistercrunch mistercrunch added 🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels 🚢 0.36.0 First shipped in 0.36.0 labels Feb 28, 2024
qfcwell pushed a commit to qfcwell/superset that referenced this pull request May 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels size/L 🚢 0.36.0 First shipped in 0.36.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants