feat(dashboard_rbac): dashboard lists #12680

amitmiran137 · 2021-01-22T08:34:49Z

SUMMARY

Role based dashboard level access with focus on dashboard list APIs

credits also goes to @Ofeknielsen who took part in this months ago

resolves #10408

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

Screen.Recording.2021-01-23.at.14.12.29.mov

Design slide;

https://user-images.githubusercontent.com/4025227/105494222-6302e400-5cb2-11eb-8f0d-6a609d73cc6c.png

TEST PLAN

ff:
DASHBOARD_RBAC: True
ENABLE_REACT_CRUD_VIEWS: False

happy path:

create a new user X with Gamma role
edit a dashboard and add to roles the Gamma role
login as X and see the assigned dashboard

backward compatibility:
check backward compatibility by DASHBOARD_RBAC: False
access should be managed by the data level

code test coverage plan

dashboards list page for the following scenarios both for dataset and RBAC levels
To make sure we keep backward compatibility and new feature alignment on capabilities

an anonymous user
a non-admin (test user: alpha/general)
admin
owner
Published/ non published

Test need to be written in a decoupled approch from existing users/roles/tables/dashboards so other tests suites won't break

ADDITIONAL INFORMATION

codecov-io · 2021-01-22T08:47:21Z

Codecov Report

Merging #12680 (812bb87) into master (017f11f) will increase coverage by 3.85%.
The diff coverage is 60.86%.

@@            Coverage Diff             @@
##           master   #12680      +/-   ##
==========================================
+ Coverage   63.13%   66.98%   +3.85%     
==========================================
  Files        1022     1022              
  Lines       50032    50186     +154     
  Branches     4915     5204     +289     
==========================================
+ Hits        31587    33618    +2031     
+ Misses      18245    16433    -1812     
+ Partials      200      135      -65

Flag	Coverage Δ
cypress	`50.82% <ø> (?)`
javascript	`61.93% <ø> (+0.25%)`	⬆️
python	`63.98% <60.86%> (-0.11%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
superset/config.py	`90.61% <ø> (ø)`
...11ccdd12658_add_roles_relationship_to_dashboard.py	`0.00% <0.00%> (ø)`
superset/views/dashboard/mixin.py	`95.00% <ø> (ø)`
superset/dashboards/filters.py	`97.61% <100.00%> (+0.64%)`	⬆️
superset/models/dashboard.py	`75.74% <100.00%> (+0.24%)`	⬆️
superset/utils/celery.py	`89.65% <0.00%> (-10.35%)`	⬇️
superset/utils/cache.py	`76.34% <0.00%> (-8.77%)`	⬇️
superset/db_engine_specs/presto.py	`82.25% <0.00%> (-6.28%)`	⬇️
...hboard/components/nativeFilters/CascadePopover.tsx	`18.18% <0.00%> (-4.46%)`	⬇️
...terControl/AdhocFilterEditPopoverSqlTabContent.jsx	`63.33% <0.00%> (-2.19%)`	⬇️
... and 217 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 017f11f...812bb87. Read the comment docs.

ktmud

Could you add a test plan and maybe some test cases?

I think we should at least test visiting the dashboards list page as each of the following:

an anonymous user
a non-admin (test user: alpha/general)
admin

superset/dashboards/filters.py

dpgaspar · 2021-01-22T13:04:45Z

I like this approach, IMO we should move to include database, datasets and charts to this pattern also. I personally would like to deprecate string based permissions constructed based on the dataset.name and dataset.id for example.

Recalling a diagram

superset/migrations/versions/11ccdd12658_add_roles_relationship_to_dashboard.py

ktmud · 2021-01-25T05:22:02Z

can you vote please so we can move forward with this in a non-POC approach?

Just saw it has passed. :D Didn't notice you've updated the SIP summary. Thanks for iterating on your proposal and creating this POC!

@dpgaspar's diagram makes perfect sense to me. Looks like things can be even simpler than I original thought. Maybe include the diagram in the SIP as a reference, too?

* master: (52 commits) docs: Updates to Superset Site for 1.0 (apache#12626) test(native-filters): scoping tree in native filters modal (apache#12655) Fix tests errors and warnings - iteration 3 (apache#12212) (apache#12219) Fix tests errors and warnings - iteration 5 (apache#12212) (apache#12224) Fix tests errors and warnings - iteration 6 (apache#12212) (apache#12227) feat(native-filters): apply scoping of native filters to dashboard (apache#12716) Fix tests errors and warnings - iteration 4 (apache#12212) (apache#12223) Fix tests errors and warnings - iteration 7 (apache#12212) (apache#12245) fix: missing select menu background (apache#12759) fix(explore): incorrect missing datasource condition (apache#12758) feat: default timepicker to last week when dataset is changed (apache#12609) feat(explore): allow opening charts with missing dataset (apache#12705) chore: upgrade Cypress to 6.2.1 (apache#12605) refactor(explore): Enhance Dataset and Control panel Collapse components (apache#12218) feat: Adding option to set_database_uri CLI command (apache#12740) docs: Fixed typo on line 348 (apache#12739) Fix tests errors and warnings - iteration 2 (apache#12212) (apache#12214) docs: Remove gatsby-plugin-offline (apache#12693) test: oracle engine spec (apache#12615) test: hive db engine spec (apache#12520) ...

villebro

Small proposal to improve how the feature flag is handled

superset/dashboards/filters.py

…AC")

villebro

Code LGTM, tested the following:

FF enabled: no roles for dashboard works like before
FF enabled: role specified - only shows up for the roles listed on the dashboard
FF disabled: roles don't affect dashboard visibility

This reverts commit 80c26ae9

ktmud

Looking great! Thanks for the iterations.

junlincc · 2021-01-31T06:38:23Z

Settings menu is missing from the page, is it by design?

junlincc · 2021-01-31T06:44:12Z

Screen.Recording.2021-01-30.at.10.41.59.PM.mov

tested~ for some reason, getting "unexpected errors" on all charts in the dashboard from gamma account. is it something I did wrong? @amitmiran137

amitmiran137 · 2021-01-31T06:59:57Z

Screen.Recording.2021-01-30.at.10.41.59.PM.mov
tested~ for some reason, getting "unexpected errors" on all charts in the dashboard from gamma account. is it something I did wrong? @amitmiran137

thanks for checking this.
this PR focuses on the backend filtering the list of dashboards by the access given to the user.
if a user was given access to the Dashboard, that alone is not enough, and access to the relevant dataset still needs to be provided.
having said that, we plan in a follow-up PR that user will be given temporary read access to all of the datasets within a dashboard as was mentioned in the development milestones in #10408
allow token-based access to /explore_json and API/v1/chart/data to allow reading datasets only by have dashboard access for read-only purpose

junlincc · 2021-01-31T07:05:25Z

having said that, we plan in a follow-up PR that user will be given temporary read access to all of the datasets within a dashboard as was mentioned in the development milestones in #10408

Got it, thanks for adding test plan, and clarifying your plan going forward. we should expect a follow up PR to address both issues mentioned above.

junlincc

Approving as product signoff. thank you so much for your contribution. 🙏

amitmiran137 added 8 commits January 22, 2021 10:33

feat: add dashboard roles to support dashboard level access

ca7e89f

fix: dashboard filter logic

0f1a6db

fix: negate dashboard has any roles

39b6b2e

fix: pre-commit

9884bc3

fix: unused imports

3eb61b3

fix: unused imports and invalid naming

47235a4

fix: hopefully last lint issue

2f13075

fix: adapt to changes

9d26d30

pull-request-size bot added the size/M label Jan 22, 2021

amitmiran137 changed the title ~~Feat/dashboard access roles~~ Feat: dashboard access roles Jan 22, 2021

fix: fix pre-commit

55199ed

ktmud reviewed Jan 22, 2021

View reviewed changes

superset/dashboards/filters.py Outdated Show resolved Hide resolved

superset/dashboards/filters.py Outdated Show resolved Hide resolved

villebro changed the title ~~Feat: dashboard access roles~~ feat: dashboard access roles Jan 22, 2021

amitmiran137 added 2 commits January 22, 2021 13:16

fix: extract id from role

dcc8e66

fix: extract hasNoRoleBasedAccess

c560de8

This comment has been minimized.

Sign in to view

amitmiran137 added 2 commits January 22, 2021 13:49

fix: pylint bad method name casing :)

0b869a2

fix: pre-commit non typed method

27f8fb9

dpgaspar reviewed Jan 22, 2021

View reviewed changes

superset/migrations/versions/11ccdd12658_add_roles_relationship_to_dashboard.py Outdated Show resolved Hide resolved

villebro reviewed Jan 22, 2021

View reviewed changes

superset/migrations/versions/11ccdd12658_add_roles_relationship_to_dashboard.py Outdated Show resolved Hide resolved

superset/migrations/versions/11ccdd12658_add_roles_relationship_to_dashboard.py Outdated Show resolved Hide resolved

fix: remove redundant pass

0223844

junlincc added the dashboard:security:access Related to the security access of the Dashboard label Jan 22, 2021

amitmiran137 added 2 commits January 23, 2021 13:47

feat: allow managing dashboard roles from the viewbased dashboard editor

aa2e53e

fix: pre-commit :)

58b680b

amitmiran137 added 3 commits January 26, 2021 21:58

test: dashboard lists API and view endpoints

8714b8b

chore: update down revision

60e92a3

villebro reviewed Jan 30, 2021

View reviewed changes

superset/dashboards/filters.py Outdated Show resolved Hide resolved

superset/dashboards/filters.py Outdated Show resolved Hide resolved

amitmiran137 added 2 commits January 30, 2021 19:24

chore: is_feature_enabled("DASHBOARD_RBAC") on every usage

d337209

fix: after CR

29a5bc5

villebro requested changes Jan 30, 2021

View reviewed changes

superset/dashboards/filters.py Outdated Show resolved Hide resolved

superset/dashboards/filters.py Outdated Show resolved Hide resolved

fix: roles_based_query inside the if is_feature_enabled("DASHBOARD_RB…

ac45a58

…AC")

villebro approved these changes Jan 30, 2021

View reviewed changes

amitmiran137 added 3 commits January 30, 2021 20:29

fix: replace assert actions with the common assert pattern

594e9f2

feat: FF the dashboard CRUD view with the DASHBOARD_RBAC

80c26ae

Revert "feat: FF the dashboard CRUD view with the DASHBOARD_RBAC"

812bb87

This reverts commit 80c26ae9

ktmud approved these changes Jan 30, 2021

View reviewed changes

junlincc added the hold:testing! On hold for testing label Jan 31, 2021

amitmiran137 changed the title ~~feat: dashboard access roles~~ feat(dashboard-rbac): dashboard lists Jan 31, 2021

junlincc self-requested a review January 31, 2021 07:05

junlincc approved these changes Jan 31, 2021

View reviewed changes

junlincc removed the hold:testing! On hold for testing label Jan 31, 2021

villebro merged commit 9a7fba8 into apache:master Jan 31, 2021

amitmiran137 mentioned this pull request Jan 31, 2021

chore(dashboard_rbac): remove overlapping security tests #12848

Merged

6 tasks

amitmiran137 deleted the feat/dashboard_access_roles branch January 31, 2021 11:54

This was referenced Jan 31, 2021

Dashboard level access control #5099

Closed

[READY] [feature] Added dashboard read only with new Rho role #5845

Closed

Give List and View access to a dashboard without adding it to owner #11654

Closed

srinify changed the title ~~feat(dashboard-rbac): dashboard lists~~ feat(dashboard_rbac): dashboard lists Mar 23, 2021

betodealmeida mentioned this pull request Jul 7, 2021

feat: validate_parameters for GSheets #15578

Merged

8 tasks

dl-lim mentioned this pull request Jul 12, 2021

Implicit Datasource Access for Dashboard RBAC #15632

Closed

mistercrunch added 🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels 🚢 1.2.0 labels Mar 12, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(dashboard_rbac): dashboard lists #12680

feat(dashboard_rbac): dashboard lists #12680

amitmiran137 commented Jan 22, 2021 •

edited

Loading

codecov-io commented Jan 22, 2021 •

edited

Loading

ktmud left a comment

This comment has been minimized.

dpgaspar commented Jan 22, 2021 •

edited

Loading

ktmud commented Jan 25, 2021 •

edited

Loading

villebro left a comment

villebro left a comment •

edited

Loading

ktmud left a comment

junlincc commented Jan 31, 2021

junlincc commented Jan 31, 2021

amitmiran137 commented Jan 31, 2021

junlincc commented Jan 31, 2021

junlincc left a comment

feat(dashboard_rbac): dashboard lists #12680

feat(dashboard_rbac): dashboard lists #12680

Conversation

amitmiran137 commented Jan 22, 2021 • edited Loading

SUMMARY

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

Design slide;

TEST PLAN

code test coverage plan

ADDITIONAL INFORMATION

codecov-io commented Jan 22, 2021 • edited Loading

Codecov Report

ktmud left a comment

Choose a reason for hiding this comment

This comment has been minimized.

dpgaspar commented Jan 22, 2021 • edited Loading

ktmud commented Jan 25, 2021 • edited Loading

villebro left a comment

Choose a reason for hiding this comment

villebro left a comment • edited Loading

Choose a reason for hiding this comment

ktmud left a comment

Choose a reason for hiding this comment

junlincc commented Jan 31, 2021

junlincc commented Jan 31, 2021

amitmiran137 commented Jan 31, 2021

junlincc commented Jan 31, 2021

junlincc left a comment

Choose a reason for hiding this comment

amitmiran137 commented Jan 22, 2021 •

edited

Loading

codecov-io commented Jan 22, 2021 •

edited

Loading

dpgaspar commented Jan 22, 2021 •

edited

Loading

ktmud commented Jan 25, 2021 •

edited

Loading

villebro left a comment •

edited

Loading