Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(charts): security perm simplification #11981

Merged
merged 15 commits into from
Dec 15, 2020

Conversation

dpgaspar
Copy link
Member

@dpgaspar dpgaspar commented Dec 9, 2020

SUMMARY

security permission simplification. Scope Charts for API and MVC FAB classes.

Existing permissions:

Permission View
can_list SliceModelView
can_show SliceModelView
can_edit SliceModelView
can_delete SliceModelView
can_add SliceModelView
can_download SliceModelView
muldelete SliceModelView
can_mulexport SliceModelView
can_cache_screenshot SliceModelView
can_screenshot SliceModelView
data_from_cache SliceModelView
can_list SliceAsync
muldelete SliceAsync

Future permissions:

Permission View
can_read Chart
can_write Chart

TEST PLAN

ADDITIONAL INFORMATION

  • Has associated issue:
  • Changes UI
  • Requires DB Migration.
  • Confirm DB Migration upgrade and downgrade tested.
  • Introduces new feature or API
  • Removes existing feature or API

@codecov-io
Copy link

codecov-io commented Dec 9, 2020

Codecov Report

Merging #11981 (af4fb92) into master (916f7e9) will decrease coverage by 4.06%.
The diff coverage is 33.33%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master   #11981      +/-   ##
==========================================
- Coverage   67.88%   63.82%   -4.07%     
==========================================
  Files         948      953       +5     
  Lines       46177    46705     +528     
  Branches     4405     4577     +172     
==========================================
- Hits        31348    29809    -1539     
- Misses      14722    16711    +1989     
- Partials      107      185      +78     
Flag Coverage Δ
cypress ?
javascript 62.65% <100.00%> (-0.31%) ⬇️
python 64.53% <21.05%> (-0.05%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files Coverage Δ
superset/constants.py 100.00% <ø> (ø)
.../versions/ccb74baaa89b_security_converge_charts.py 0.00% <0.00%> (ø)
...perset-frontend/src/views/CRUD/chart/ChartCard.tsx 72.22% <100.00%> (-13.89%) ⬇️
...perset-frontend/src/views/CRUD/chart/ChartList.tsx 71.77% <100.00%> (-9.68%) ⬇️
superset/charts/api.py 81.45% <100.00%> (+0.05%) ⬆️
superset/views/chart/views.py 88.09% <100.00%> (+0.59%) ⬆️
superset/views/core.py 75.22% <100.00%> (ø)
superset-frontend/src/SqlLab/App.jsx 0.00% <0.00%> (-100.00%) ⬇️
superset-frontend/src/explore/App.jsx 0.00% <0.00%> (-100.00%) ⬇️
superset-frontend/src/dashboard/App.jsx 0.00% <0.00%> (-100.00%) ⬇️
... and 194 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 916f7e9...af4fb92. Read the comment docs.

Pvm("SliceModelView", "can_download",): (Pvm("Chart", "can_read"),),
Pvm("SliceModelView", "muldelete",): (Pvm("Chart", "can_write"),),
Pvm("SliceModelView", "can_mulexport",): (Pvm("Chart", "can_read"),),
Pvm("SliceModelView", "can_favorite_status",): (Pvm("Chart", "can_write"),),
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hmm...should this be "can_read"? Does favoriting a chart do anything other than create a record of the favorite?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it should, actually that's a GET so it's really a mistake. Very nice catch

@dpgaspar dpgaspar marked this pull request as ready for review December 10, 2020 10:09
@dpgaspar dpgaspar added the risk:db-migration PRs that require a DB migration label Dec 10, 2020
@dpgaspar dpgaspar merged commit f79e52f into apache:master Dec 15, 2020
@dpgaspar dpgaspar deleted the feat/security-converge-charts branch December 15, 2020 11:27
@mistercrunch mistercrunch added 🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels 🚢 1.0.0 labels Mar 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels risk:db-migration PRs that require a DB migration size/L 🚢 1.0.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants