-
Notifications
You must be signed in to change notification settings - Fork 13.5k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
chore: deprecate rls base related filters #24128
chore: deprecate rls base related filters #24128
Conversation
Codecov Report
@@ Coverage Diff @@
## master #24128 +/- ##
=======================================
Coverage 68.25% 68.25%
=======================================
Files 1952 1952
Lines 75349 75349
Branches 8204 8205 +1
=======================================
Hits 51433 51433
Misses 21810 21810
Partials 2106 2106
Flags with carried forward coverage won't be shown. Click here to find out more.
📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more |
UPDATING.md
Outdated
@@ -24,6 +24,7 @@ assists people when migrating to a new version. | |||
|
|||
## Next | |||
|
|||
- [24128](https://github.com/apache/superset/pull/24128) The `RLS_BASE_RELATED_FIELD_FILTERS` config parameter has been removed. Now the Tables dropdown will feature the same tables that the user is able to see elsewhere in the application using the standard `DatasourceFilter`, and the Roles dropdown will be filtered using the filter defined in `EXTRA_RELATED_QUERY_FILTERS["role"]`. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Could you move this to the Breaking Changes section?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Oof, good catch!
SUMMARY
This is a follow-up to the work done in #23777, more specifically this discussion: #23777 (comment)
Currently Row Level Security has a dedicated set of related base filters that makes it possible to customize the filters that are applied on the Table and Role models. These are defined on the
RLS_BASE_RELATED_FIELD_FILTERS
config parameter.Having these undefined by default is counter intuitive, as it means that a user that is given RLS access will be able to see ALL datasets under the RLS table dropdown, irrespective of which tables they see under the Datasets menu. To streamline this we should just use the same base filter we use for the dataset list view (
DatasourceFilter
).For roles, the PR #22526 introduced the possibility to define a base filter for Roles. To avoid having duplicated logic and to give the users a unified UX, we can reuse the Role filter that users can define via the
EXTRA_RELATED_QUERY_FILTERS
config flag.SCREENSHOTS
This is the datasets view for a user that is only able to access two datasets on the instance (the Gamma user only has database access to the BurgerKing database, despite there being many other databases/datasets on the instance).
![image](https://private-user-images.githubusercontent.com/33317356/239464671-b2dfc894-a7bc-4854-ba2c-56ae80c3ce56.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjU5ODg3NzksIm5iZiI6MTcyNTk4ODQ3OSwicGF0aCI6Ii8zMzMxNzM1Ni8yMzk0NjQ2NzEtYjJkZmM4OTQtYTdiYy00ODU0LWJhMmMtNTZhZTgwYzNjZTU2LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTAlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEwVDE3MTQzOVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTkyN2NmOTAyZjE5ZDlmZGMwZTc3ZWNlMDY0ZDhiN2EzNjQ1NzI3ODZmMzI5MWJkMjllMzFiNGVkMjg3NzYxNGQmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.JLl4MbQlI8ayItOfg8BFtoOcOHY-S6UqM2eiUTx11hM)
With the
![image](https://private-user-images.githubusercontent.com/33317356/239464978-26a90104-2354-4597-97aa-8a8a4b833c12.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjU5ODg3NzksIm5iZiI6MTcyNTk4ODQ3OSwicGF0aCI6Ii8zMzMxNzM1Ni8yMzk0NjQ5NzgtMjZhOTAxMDQtMjM1NC00NTk3LTk3YWEtOGE4YTRiODMzYzEyLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTAlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEwVDE3MTQzOVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTE0NGU0ZjVjYjlmNjY1YTYxYWQ0ZDAzMDUzNjc3NTJjMjBhYjVkOGU1ZTQ0OTk5YjZiZjZjOTYxY2ZlYmM2ZDMmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.OO70PT0gEQhjez0yA8AT0TNbLBsD3xL6Ax_haXmFyE4)
DASHBOARD_RBAC
feature enabled and a custom Roles filter, the user was only able to see theTeam-BurgerKing
role:Previously, the same user would see all tables and roles on the instance if they had RLS perms. After this change the RLS dropdowns are aligned with what's available elsewhere:
RLS tables:
![image](https://private-user-images.githubusercontent.com/33317356/239464495-9d33ad4a-5836-4d93-94e7-a06af96521c7.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjU5ODg3NzksIm5iZiI6MTcyNTk4ODQ3OSwicGF0aCI6Ii8zMzMxNzM1Ni8yMzk0NjQ0OTUtOWQzM2FkNGEtNTgzNi00ZDkzLTk0ZTctYTA2YWY5NjUyMWM3LnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTAlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEwVDE3MTQzOVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWYyOGUxMjhiMjAzOGMwN2Q5OWE4NjUwMzhkMzI3NGMwZGMyYzdlY2QyNzlhYzYwZDdjMTgyMDE3OTcwYTk2NTYmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.W1wDT6uz-eVynMXweR2BnsgZPj3WFc0Wf2ALUnAOhO0)
RLS roles:
![image](https://private-user-images.githubusercontent.com/33317356/239464587-ffc96f1d-cba1-4fd1-9b18-2d17f2e5376e.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjU5ODg3NzksIm5iZiI6MTcyNTk4ODQ3OSwicGF0aCI6Ii8zMzMxNzM1Ni8yMzk0NjQ1ODctZmZjOTZmMWQtY2JhMS00ZmQxLTliMTgtMmQxN2YyZTUzNzZlLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTAlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEwVDE3MTQzOVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPWNlM2NlNjlmYjRmZTc1NWQwNDZjZTk5MzVhNGI0ZWY5OTI0ZTgzNTM0NTkxMGRmODkyMmFkYzQ0ODY4YmJlNGQmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.2GxFoMFi6FfORElXUqraDJ2iu_j8z96Ql3NBM0rDaOM)
As a bycatch, the "Roles" title is also changed to "Excluded roles" if the filter type is set to "Base" (this is similar to how the list view):
![image](https://private-user-images.githubusercontent.com/33317356/239485232-7ec6b89c-0da1-4ac2-bf07-1b1d97064721.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MjU5ODg3NzksIm5iZiI6MTcyNTk4ODQ3OSwicGF0aCI6Ii8zMzMxNzM1Ni8yMzk0ODUyMzItN2VjNmI4OWMtMGRhMS00YWMyLWJmMDctMWIxZDk3MDY0NzIxLnBuZz9YLUFtei1BbGdvcml0aG09QVdTNC1ITUFDLVNIQTI1NiZYLUFtei1DcmVkZW50aWFsPUFLSUFWQ09EWUxTQTUzUFFLNFpBJTJGMjAyNDA5MTAlMkZ1cy1lYXN0LTElMkZzMyUyRmF3czRfcmVxdWVzdCZYLUFtei1EYXRlPTIwMjQwOTEwVDE3MTQzOVomWC1BbXotRXhwaXJlcz0zMDAmWC1BbXotU2lnbmF0dXJlPTkwMTUyZmQ5Mzg3OGRjYjFiZWY1ODExYmQ2NTM1OTc3MmNiNGUwNWMzMWYwN2QwYTFlNGM1OGZlMzAxYTAwNjQmWC1BbXotU2lnbmVkSGVhZGVycz1ob3N0JmFjdG9yX2lkPTAma2V5X2lkPTAmcmVwb19pZD0wIn0.-KATmo0ZCNWRBejB45jFOhZ8l-HlJ1rrOsIY8NbRp6w)
ADDITIONAL INFORMATION