You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@superset.apache.org by ru...@apache.org on 2025/12/11 22:59:40 UTC
(superset) branch feat/public-role-builtin created (now 39d1f518d4)
This is an automated email from the ASF dual-hosted git repository.
rusackas pushed a change to branch feat/public-role-builtin
in repository https://gitbox.apache.org/repos/asf/superset.git
at 39d1f518d4 feat(security): add built-in Public role for anonymous dashboard access
This branch includes the following new commits:
new 39d1f518d4 feat(security): add built-in Public role for anonymous dashboard access
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(superset) 01/01: feat(security): add built-in Public role for anonymous dashboard access
Posted by ru...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rusackas pushed a commit to branch feat/public-role-builtin
in repository https://gitbox.apache.org/repos/asf/superset.git
commit 39d1f518d43b2d9365559dda6ce180b8c8c86273
Author: Evan Rusackas <ev...@rusackas.com>
AuthorDate: Thu Dec 11 14:57:08 2025 -0800
feat(security): add built-in Public role for anonymous dashboard access
This PR adds a new built-in "Public" role to Superset, designed for
anonymous/unauthenticated users who need to view dashboards. The Public
role is more restrictive than Gamma and provides sensible defaults for
public-facing dashboard deployments.
Key features:
- New PUBLIC_ROLE_PERMISSIONS set defining minimal dashboard viewing
permissions
- New _is_public_pvm() method to determine Public role permissions
- Public role is now created during sync_role_definitions()
- Users can set PUBLIC_ROLE_LIKE = "Public" to use these safe defaults
The Public role includes:
- Dashboard and chart viewing
- Interactive dashboard filters (read + write filter state)
- Dashboard permalinks
- Embedded dashboard support
- Datasource metadata for chart rendering
The Public role explicitly excludes:
- Write permissions on dashboards, charts, datasets
- SQL Lab access
- Share functionality
- User profile/admin features
- Menu access to most features
This addresses the concerns raised in #36025 where PUBLIC_ROLE_LIKE = "Gamma"
grants excessive permissions including write and delete capabilities that
are inappropriate for public access.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-Authored-By: Claude Opus 4.5 <no...@anthropic.com>
---
RESOURCES/STANDARD_ROLES.md | 378 +++++++++++++++---------------
docs/docs/security/security.mdx | 32 ++-
superset/security/manager.py | 87 ++++++-
tests/integration_tests/security_tests.py | 88 +++++++
4 files changed, 390 insertions(+), 195 deletions(-)
diff --git a/RESOURCES/STANDARD_ROLES.md b/RESOURCES/STANDARD_ROLES.md
index 48c8017445..ea4bfd4396 100644
--- a/RESOURCES/STANDARD_ROLES.md
+++ b/RESOURCES/STANDARD_ROLES.md
@@ -17,192 +17,192 @@ specific language governing permissions and limitations
under the License.
-->
-| |Admin|Alpha|Gamma|SQL_LAB|
-|--------------------------------------------------|---|---|---|---|
-| Permission/role description |Admins have all possible rights, including granting or revoking rights from other users and altering other people’s slices and dashboards.|Alpha users have access to all data sources, but they cannot grant or revoke access from other users. They are also limited to altering the objects that they own. Alpha users can add and alter data sources.|Gamma users have limited access. They can only consume data coming from data sources they have [...]
-| can read on SavedQuery |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|
-| can write on SavedQuery |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|
-| can read on CssTemplate |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can write on CssTemplate |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can read on ReportSchedule |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can write on ReportSchedule |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can read on Chart |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can write on Chart |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can read on Annotation |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can write on Annotation |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can read on Dataset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can write on Dataset |:heavy_check_mark:|:heavy_check_mark:|O|O|
-| can read on Log |:heavy_check_mark:|O|O|O|
-| can write on Log |:heavy_check_mark:|O|O|O|
-| can read on Dashboard |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can write on Dashboard |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can read on Database |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|
-| can write on Database |:heavy_check_mark:|O|O|O|
-| can read on Query |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|
-| can this form get on ResetPasswordView |:heavy_check_mark:|O|O|O|
-| can this form post on ResetPasswordView |:heavy_check_mark:|O|O|O|
-| can this form get on ResetMyPasswordView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can this form post on ResetMyPasswordView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can this form get on UserInfoEditView |:heavy_check_mark:|O|O|O|
-| can this form post on UserInfoEditView |:heavy_check_mark:|O|O|O|
-| can show on UserDBModelView |:heavy_check_mark:|O|O|O|
-| can edit on UserDBModelView |:heavy_check_mark:|O|O|O|
-| can delete on UserDBModelView |:heavy_check_mark:|O|O|O|
-| can add on UserDBModelView |:heavy_check_mark:|O|O|O|
-| can list on UserDBModelView |:heavy_check_mark:|O|O|O|
-| can userinfo on UserDBModelView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| resetmypassword on UserDBModelView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| resetpasswords on UserDBModelView |:heavy_check_mark:|O|O|O|
-| userinfoedit on UserDBModelView |:heavy_check_mark:|O|O|O|
-| can show on RoleModelView |:heavy_check_mark:|O|O|O|
-| can edit on RoleModelView |:heavy_check_mark:|O|O|O|
-| can delete on RoleModelView |:heavy_check_mark:|O|O|O|
-| can add on RoleModelView |:heavy_check_mark:|O|O|O|
-| can list on RoleModelView |:heavy_check_mark:|O|O|O|
-| copyrole on RoleModelView |:heavy_check_mark:|O|O|O|
-| can get on OpenApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can show on SwaggerView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can get on MenuApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can list on AsyncEventsRestApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can invalidate on CacheRestApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can csv upload on Database |:heavy_check_mark:|O|O|O|
-| can excel upload on Database |:heavy_check_mark:|O|O|O|
-| can query form data on Api |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can query on Api |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can time range on Api |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can external metadata on Datasource |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can save on Datasource |:heavy_check_mark:|:heavy_check_mark:|O|O|
-| can get on Datasource |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can my queries on SqlLab |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|
-| can log on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can import dashboards on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can schemas on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can sqllab history on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|
-| can publish on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can csv on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|
-| can slice on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can sync druid source on Superset |:heavy_check_mark:|O|O|O|
-| can explore on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can approve on Superset |:heavy_check_mark:|O|O|O|
-| can explore json on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can fetch datasource metadata on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can csrf token on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can sqllab on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|
-| can select star on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can warm up cache on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can sqllab table viz on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|
-| can available domains on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can request access on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can dashboard on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can post on TableSchemaView |:heavy_check_mark:|O|O|:heavy_check_mark:|
-| can expanded on TableSchemaView |:heavy_check_mark:|O|O|:heavy_check_mark:|
-| can delete on TableSchemaView |:heavy_check_mark:|O|O|:heavy_check_mark:|
-| can get on TabStateView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|
-| can post on TabStateView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|
-| can delete query on TabStateView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|
-| can migrate query on TabStateView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|
-| can activate on TabStateView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|
-| can delete on TabStateView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|
-| can put on TabStateView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|
-| can read on SecurityRestApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|
-| menu access on Security |:heavy_check_mark:|O|O|O|
-| menu access on List Users |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| menu access on List Roles |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| menu access on Action Log |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| menu access on Manage |:heavy_check_mark:|:heavy_check_mark:|O|O|
-| menu access on Annotation Layers |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| menu access on CSS Templates |:heavy_check_mark:|:heavy_check_mark:|O|O|
-| menu access on Import Dashboards |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| menu access on Data |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| menu access on Databases |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| menu access on Datasets |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| menu access on Charts |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| menu access on Dashboards |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| menu access on SQL Lab |:heavy_check_mark:|O|O|:heavy_check_mark:|
-| menu access on SQL Editor |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|
-| menu access on Saved Queries |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|
-| menu access on Query Search |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|
-| all datasource access on all_datasource_access |:heavy_check_mark:|:heavy_check_mark:|O|O|
-| all database access on all_database_access |:heavy_check_mark:|:heavy_check_mark:|O|O|
-| all query access on all_query_access |:heavy_check_mark:|O|O|O|
-| can write on DynamicPlugin |:heavy_check_mark:|O|O|O|
-| can edit on DynamicPlugin |:heavy_check_mark:|O|O|O|
-| can list on DynamicPlugin |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can show on DynamicPlugin |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can download on DynamicPlugin |:heavy_check_mark:|O|O|O|
-| can add on DynamicPlugin |:heavy_check_mark:|O|O|O|
-| can delete on DynamicPlugin |:heavy_check_mark:|O|O|O|
-| can external metadata by name on Datasource |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can get value on KV |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can store on KV |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can tagged objects on TagView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can suggestions on TagView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can get on TagView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can post on TagView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can delete on TagView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can edit on DashboardEmailScheduleView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can list on DashboardEmailScheduleView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can show on DashboardEmailScheduleView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can add on DashboardEmailScheduleView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can delete on DashboardEmailScheduleView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| muldelete on DashboardEmailScheduleView |:heavy_check_mark:|:heavy_check_mark:|O|O|
-| can edit on SliceEmailScheduleView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can list on SliceEmailScheduleView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can show on SliceEmailScheduleView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can add on SliceEmailScheduleView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can delete on SliceEmailScheduleView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| muldelete on SliceEmailScheduleView |:heavy_check_mark:|:heavy_check_mark:|O|O|
-| can edit on AlertModelView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can list on AlertModelView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can show on AlertModelView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can add on AlertModelView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can delete on AlertModelView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can list on AlertLogModelView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can show on AlertLogModelView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can list on AlertObservationModelView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can show on AlertObservationModelView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| menu access on Row Level Security |:heavy_check_mark:|O|O|O|
-| menu access on Access requests |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| menu access on Home |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| menu access on Plugins |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| menu access on Dashboard Email Schedules |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| menu access on Chart Emails |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| menu access on Alerts |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| menu access on Alerts & Report |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| menu access on Scan New Datasources |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can share dashboard on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can share chart on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can this form get on ColumnarToDatabaseView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can this form post on ColumnarToDatabaseView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can export on Chart |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can write on DashboardFilterStateRestApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can read on DashboardFilterStateRestApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can write on DashboardPermalinkRestApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can read on DashboardPermalinkRestApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can delete embedded on Dashboard |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can set embedded on Dashboard |:heavy_check_mark:|O|O|O|
-| can export on Dashboard |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can get embedded on Dashboard |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can export on Database |:heavy_check_mark:|O|O|O|
-| can export on Dataset |:heavy_check_mark:|:heavy_check_mark:|O|O|
-| can write on ExploreFormDataRestApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can read on ExploreFormDataRestApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can write on ExplorePermalinkRestApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can read on ExplorePermalinkRestApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can export on ImportExportRestApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can import on ImportExportRestApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can export on SavedQuery |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|
-| can dashboard permalink on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can grant guest token on SecurityRestApi |:heavy_check_mark:|O|O|O|
-| can read on AdvancedDataType |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can read on EmbeddedDashboard |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can duplicate on Dataset |:heavy_check_mark:|:heavy_check_mark:|O|O|
-| can read on Explore |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can samples on Datasource |:heavy_check_mark:|:heavy_check_mark:|O|O|
-| can read on AvailableDomains |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
-| can get or create dataset on Dataset |:heavy_check_mark:|:heavy_check_mark:|O|O|
-| can get column values on Datasource |:heavy_check_mark:|:heavy_check_mark:|O|O|
-| can export csv on SQLLab |:heavy_check_mark:|O|O|:heavy_check_mark:|
-| can get results on SQLLab |:heavy_check_mark:|O|O|:heavy_check_mark:|
-| can execute sql query on SQLLab |:heavy_check_mark:|O|O|:heavy_check_mark:|
-| can recent activity on Log |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
+| |Admin|Alpha|Gamma|Public|SQL_LAB|
+|--------------------------------------------------|---|---|---|---|---|
+| Permission/role description |Admins have all possible rights, including granting or revoking rights from other users and altering other people's slices and dashboards.|Alpha users have access to all data sources, but they cannot grant or revoke access from other users. They are also limited to altering the objects that they own. Alpha users can add and alter data sources.|Gamma users have limited access. They can only consume data coming from data sources they have [...]
+| can read on SavedQuery |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|:heavy_check_mark:|
+| can write on SavedQuery |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|:heavy_check_mark:|
+| can read on CssTemplate |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
+| can write on CssTemplate |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can read on ReportSchedule |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can write on ReportSchedule |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can read on Chart |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
+| can write on Chart |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can read on Annotation |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can write on Annotation |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can read on Dataset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can write on Dataset |:heavy_check_mark:|:heavy_check_mark:|O|O|O|
+| can read on Log |:heavy_check_mark:|O|O|O|O|
+| can write on Log |:heavy_check_mark:|O|O|O|O|
+| can read on Dashboard |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
+| can write on Dashboard |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can read on Database |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|:heavy_check_mark:|
+| can write on Database |:heavy_check_mark:|O|O|O|O|
+| can read on Query |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|:heavy_check_mark:|
+| can this form get on ResetPasswordView |:heavy_check_mark:|O|O|O|O|
+| can this form post on ResetPasswordView |:heavy_check_mark:|O|O|O|O|
+| can this form get on ResetMyPasswordView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can this form post on ResetMyPasswordView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can this form get on UserInfoEditView |:heavy_check_mark:|O|O|O|O|
+| can this form post on UserInfoEditView |:heavy_check_mark:|O|O|O|O|
+| can show on UserDBModelView |:heavy_check_mark:|O|O|O|O|
+| can edit on UserDBModelView |:heavy_check_mark:|O|O|O|O|
+| can delete on UserDBModelView |:heavy_check_mark:|O|O|O|O|
+| can add on UserDBModelView |:heavy_check_mark:|O|O|O|O|
+| can list on UserDBModelView |:heavy_check_mark:|O|O|O|O|
+| can userinfo on UserDBModelView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| resetmypassword on UserDBModelView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| resetpasswords on UserDBModelView |:heavy_check_mark:|O|O|O|O|
+| userinfoedit on UserDBModelView |:heavy_check_mark:|O|O|O|O|
+| can show on RoleModelView |:heavy_check_mark:|O|O|O|O|
+| can edit on RoleModelView |:heavy_check_mark:|O|O|O|O|
+| can delete on RoleModelView |:heavy_check_mark:|O|O|O|O|
+| can add on RoleModelView |:heavy_check_mark:|O|O|O|O|
+| can list on RoleModelView |:heavy_check_mark:|O|O|O|O|
+| copyrole on RoleModelView |:heavy_check_mark:|O|O|O|O|
+| can get on OpenApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
+| can show on SwaggerView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can get on MenuApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
+| can list on AsyncEventsRestApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can invalidate on CacheRestApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can csv upload on Database |:heavy_check_mark:|O|O|O|O|
+| can excel upload on Database |:heavy_check_mark:|O|O|O|O|
+| can query form data on Api |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
+| can query on Api |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
+| can time range on Api |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
+| can external metadata on Datasource |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
+| can save on Datasource |:heavy_check_mark:|:heavy_check_mark:|O|O|O|
+| can get on Datasource |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
+| can my queries on SqlLab |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|:heavy_check_mark:|
+| can log on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can import dashboards on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can schemas on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can sqllab history on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|:heavy_check_mark:|
+| can publish on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can csv on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|:heavy_check_mark:|
+| can slice on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
+| can sync druid source on Superset |:heavy_check_mark:|O|O|O|O|
+| can explore on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can approve on Superset |:heavy_check_mark:|O|O|O|O|
+| can explore json on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
+| can fetch datasource metadata on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can csrf token on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can sqllab on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|:heavy_check_mark:|
+| can select star on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can warm up cache on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can sqllab table viz on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|:heavy_check_mark:|
+| can available domains on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can request access on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can dashboard on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
+| can post on TableSchemaView |:heavy_check_mark:|O|O|O|:heavy_check_mark:|
+| can expanded on TableSchemaView |:heavy_check_mark:|O|O|O|:heavy_check_mark:|
+| can delete on TableSchemaView |:heavy_check_mark:|O|O|O|:heavy_check_mark:|
+| can get on TabStateView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|:heavy_check_mark:|
+| can post on TabStateView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|:heavy_check_mark:|
+| can delete query on TabStateView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|:heavy_check_mark:|
+| can migrate query on TabStateView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|:heavy_check_mark:|
+| can activate on TabStateView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|:heavy_check_mark:|
+| can delete on TabStateView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|:heavy_check_mark:|
+| can put on TabStateView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|:heavy_check_mark:|
+| can read on SecurityRestApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|
+| menu access on Security |:heavy_check_mark:|O|O|O|O|
+| menu access on List Users |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| menu access on List Roles |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| menu access on Action Log |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| menu access on Manage |:heavy_check_mark:|:heavy_check_mark:|O|O|O|
+| menu access on Annotation Layers |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| menu access on CSS Templates |:heavy_check_mark:|:heavy_check_mark:|O|O|O|
+| menu access on Import Dashboards |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| menu access on Data |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| menu access on Databases |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| menu access on Datasets |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| menu access on Charts |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| menu access on Dashboards |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| menu access on SQL Lab |:heavy_check_mark:|O|O|O|:heavy_check_mark:|
+| menu access on SQL Editor |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|:heavy_check_mark:|
+| menu access on Saved Queries |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|:heavy_check_mark:|
+| menu access on Query Search |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|:heavy_check_mark:|
+| all datasource access on all_datasource_access |:heavy_check_mark:|:heavy_check_mark:|O|O|O|
+| all database access on all_database_access |:heavy_check_mark:|:heavy_check_mark:|O|O|O|
+| all query access on all_query_access |:heavy_check_mark:|O|O|O|O|
+| can write on DynamicPlugin |:heavy_check_mark:|O|O|O|O|
+| can edit on DynamicPlugin |:heavy_check_mark:|O|O|O|O|
+| can list on DynamicPlugin |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can show on DynamicPlugin |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can download on DynamicPlugin |:heavy_check_mark:|O|O|O|O|
+| can add on DynamicPlugin |:heavy_check_mark:|O|O|O|O|
+| can delete on DynamicPlugin |:heavy_check_mark:|O|O|O|O|
+| can external metadata by name on Datasource |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
+| can get value on KV |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can store on KV |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can tagged objects on TagView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can suggestions on TagView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can get on TagView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can post on TagView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can delete on TagView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can edit on DashboardEmailScheduleView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can list on DashboardEmailScheduleView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can show on DashboardEmailScheduleView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can add on DashboardEmailScheduleView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can delete on DashboardEmailScheduleView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| muldelete on DashboardEmailScheduleView |:heavy_check_mark:|:heavy_check_mark:|O|O|O|
+| can edit on SliceEmailScheduleView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can list on SliceEmailScheduleView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can show on SliceEmailScheduleView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can add on SliceEmailScheduleView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can delete on SliceEmailScheduleView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| muldelete on SliceEmailScheduleView |:heavy_check_mark:|:heavy_check_mark:|O|O|O|
+| can edit on AlertModelView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can list on AlertModelView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can show on AlertModelView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can add on AlertModelView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can delete on AlertModelView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can list on AlertLogModelView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can show on AlertLogModelView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can list on AlertObservationModelView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can show on AlertObservationModelView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| menu access on Row Level Security |:heavy_check_mark:|O|O|O|O|
+| menu access on Access requests |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| menu access on Home |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| menu access on Plugins |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| menu access on Dashboard Email Schedules |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| menu access on Chart Emails |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| menu access on Alerts |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| menu access on Alerts & Report |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| menu access on Scan New Datasources |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can share dashboard on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can share chart on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can this form get on ColumnarToDatabaseView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can this form post on ColumnarToDatabaseView |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can export on Chart |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can write on DashboardFilterStateRestApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
+| can read on DashboardFilterStateRestApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
+| can write on DashboardPermalinkRestApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can read on DashboardPermalinkRestApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
+| can delete embedded on Dashboard |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can set embedded on Dashboard |:heavy_check_mark:|O|O|O|O|
+| can export on Dashboard |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can get embedded on Dashboard |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can export on Database |:heavy_check_mark:|O|O|O|O|
+| can export on Dataset |:heavy_check_mark:|:heavy_check_mark:|O|O|O|
+| can write on ExploreFormDataRestApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can read on ExploreFormDataRestApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can write on ExplorePermalinkRestApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can read on ExplorePermalinkRestApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can export on ImportExportRestApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can import on ImportExportRestApi |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can export on SavedQuery |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|:heavy_check_mark:|
+| can dashboard permalink on Superset |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
+| can grant guest token on SecurityRestApi |:heavy_check_mark:|O|O|O|O|
+| can read on AdvancedDataType |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can read on EmbeddedDashboard |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|
+| can duplicate on Dataset |:heavy_check_mark:|:heavy_check_mark:|O|O|O|
+| can read on Explore |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can samples on Datasource |:heavy_check_mark:|:heavy_check_mark:|O|O|O|
+| can read on AvailableDomains |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
+| can get or create dataset on Dataset |:heavy_check_mark:|:heavy_check_mark:|O|O|O|
+| can get column values on Datasource |:heavy_check_mark:|:heavy_check_mark:|O|O|O|
+| can export csv on SQLLab |:heavy_check_mark:|O|O|O|:heavy_check_mark:|
+| can get results on SQLLab |:heavy_check_mark:|O|O|O|:heavy_check_mark:|
+| can execute sql query on SQLLab |:heavy_check_mark:|O|O|O|:heavy_check_mark:|
+| can recent activity on Log |:heavy_check_mark:|:heavy_check_mark:|:heavy_check_mark:|O|O|
diff --git a/docs/docs/security/security.mdx b/docs/docs/security/security.mdx
index fa59981560..bd82355b0a 100644
--- a/docs/docs/security/security.mdx
+++ b/docs/docs/security/security.mdx
@@ -46,12 +46,34 @@ to all databases by default, both **Alpha** and **Gamma** users need to be given
### Public
-To allow logged-out users to access some Superset features, you can use the `PUBLIC_ROLE_LIKE` config setting and assign it to another role whose permissions you want passed to this role.
+The **Public** role is the most restrictive built-in role, designed specifically for anonymous/unauthenticated
+users who need to view dashboards. It provides minimal read-only access for:
-For example, by setting `PUBLIC_ROLE_LIKE = "Gamma"` in your `superset_config.py` file, you grant
-public role the same set of permissions as for the **Gamma** role. This is useful if one
-wants to enable anonymous users to view dashboards. Explicit grant on specific datasets is
-still required, meaning that you need to edit the **Public** role and add the public data sources to the role manually.
+- Viewing dashboards and charts
+- Using interactive dashboard filters
+- Accessing dashboard permalinks
+- Reading embedded dashboards
+
+The Public role explicitly excludes:
+- Any write permissions on dashboards, charts, or datasets
+- SQL Lab access
+- Share functionality
+- User profile or admin features
+- Menu access to most Superset features
+
+To allow logged-out users to access Superset features, use the `PUBLIC_ROLE_LIKE` config setting
+to copy permissions from any built-in role to the actual public/anonymous role:
+
+```python
+# Recommended: Use the new Public role for minimal, secure public access
+PUBLIC_ROLE_LIKE = "Public"
+
+# Alternative: Use Gamma for broader access (includes create/edit permissions)
+# PUBLIC_ROLE_LIKE = "Gamma"
+```
+
+**Important:** Explicit grants on specific datasets are still required. You need to edit the
+public role in the Superset UI and add the public data sources to the role manually.
### Managing Data Source Access for Gamma Roles
diff --git a/superset/security/manager.py b/superset/security/manager.py
index 8490c049e3..a2772da9a7 100644
--- a/superset/security/manager.py
+++ b/superset/security/manager.py
@@ -389,6 +389,61 @@ class SupersetSecurityManager( # pylint: disable=too-many-public-methods
("can_read", "Database"),
}
+ # Permissions for the Public role - minimal read-only access for viewing
+ # dashboards without authentication. This is more restrictive than Gamma.
+ # Users can set PUBLIC_ROLE_LIKE = "Public" to use these sensible defaults.
+ PUBLIC_ROLE_PERMISSIONS = {
+ # Core dashboard viewing
+ ("can_read", "Dashboard"),
+ ("can_read", "Chart"),
+ ("can_dashboard", "Superset"),
+ ("can_slice", "Superset"),
+ ("can_explore_json", "Superset"),
+ ("can_dashboard_permalink", "Superset"),
+ ("can_read", "DashboardPermalinkRestApi"),
+ # Dashboard filter interactions
+ ("can_read", "DashboardFilterStateRestApi"),
+ ("can_write", "DashboardFilterStateRestApi"),
+ # API access for chart rendering
+ ("can_time_range", "Api"),
+ ("can_query_form_data", "Api"),
+ ("can_query", "Api"),
+ # CSS for dashboard styling
+ ("can_read", "CssTemplate"),
+ # Embedded dashboard support
+ ("can_read", "EmbeddedDashboard"),
+ # Datasource metadata for chart rendering
+ ("can_get", "Datasource"),
+ ("can_external_metadata", "Datasource"),
+ ("can_external_metadata_by_name", "Datasource"),
+ # Security API for CSRF tokens
+ ("can_read", "SecurityRestApi"),
+ # Menu and OpenAPI access
+ ("can_get", "OpenApi"),
+ ("can_get", "MenuApi"),
+ }
+
+ # View menus that Public role should NOT have access to
+ PUBLIC_EXCLUDED_VIEW_MENUS = {
+ "SQL Lab",
+ "SQL Editor",
+ "Saved Queries",
+ "Query Search",
+ "Queries",
+ "Security",
+ "List Users",
+ "List Roles",
+ "Row Level Security",
+ "Row Level Security Filters",
+ "Access Requests",
+ "Action Log",
+ "Manage",
+ "Import dashboards",
+ "Annotation Layers",
+ "CSS Templates",
+ "Alerts & Report",
+ }
+
data_access_permissions = (
"database_access",
"schema_access",
@@ -1202,9 +1257,11 @@ class SupersetSecurityManager( # pylint: disable=too-many-public-methods
self.set_role("Admin", self._is_admin_pvm, pvms)
self.set_role("Alpha", self._is_alpha_pvm, pvms)
self.set_role("Gamma", self._is_gamma_pvm, pvms)
+ self.set_role("Public", self._is_public_pvm, pvms)
self.set_role("sql_lab", self._is_sql_lab_pvm, pvms)
- # Configure public role
+ # Configure public role - allows copying permissions from any role
+ # (including the new "Public" role) to the actual public/anonymous role
if get_conf()["PUBLIC_ROLE_LIKE"]:
self.copy_role(
get_conf()["PUBLIC_ROLE_LIKE"],
@@ -1427,6 +1484,34 @@ class SupersetSecurityManager( # pylint: disable=too-many-public-methods
in self.SQLLAB_EXTRA_PERMISSION_VIEWS
)
+ def _is_public_pvm(self, pvm: PermissionView) -> bool:
+ """
+ Return True if the FAB permission/view is appropriate for the Public role,
+ False otherwise.
+
+ The Public role is designed for anonymous/unauthenticated users who need
+ to view dashboards. It provides minimal read-only access - more restrictive
+ than Gamma - suitable for public-facing dashboard deployments.
+
+ :param pvm: The FAB permission/view
+ :returns: Whether the FAB object is appropriate for Public role
+ """
+ # Explicitly allow permissions in the PUBLIC_ROLE_PERMISSIONS set
+ if (pvm.permission.name, pvm.view_menu.name) in self.PUBLIC_ROLE_PERMISSIONS:
+ return True
+
+ # Exclude any view menus in the excluded list
+ if pvm.view_menu.name in self.PUBLIC_EXCLUDED_VIEW_MENUS:
+ return False
+
+ # Exclude user-defined permissions (datasource_access, schema_access, etc.)
+ # These must be explicitly granted to the Public role
+ if self._is_user_defined_permission(pvm):
+ return False
+
+ # Exclude all other permissions not explicitly allowed
+ return False
+
def database_after_insert(
self,
mapper: Mapper,
diff --git a/tests/integration_tests/security_tests.py b/tests/integration_tests/security_tests.py
index 96b2cb3e20..5cc0cad088 100644
--- a/tests/integration_tests/security_tests.py
+++ b/tests/integration_tests/security_tests.py
@@ -1438,6 +1438,94 @@ class TestRolePermission(SupersetTestCase):
security_manager.find_permission_view_menu("can_read", "Dataset")
)
+ def test_is_public_pvm(self):
+ """Test that _is_public_pvm correctly identifies Public role permissions."""
+ # Should include core dashboard viewing permissions
+ assert security_manager._is_public_pvm(
+ security_manager.find_permission_view_menu("can_read", "Dashboard")
+ )
+ assert security_manager._is_public_pvm(
+ security_manager.find_permission_view_menu("can_read", "Chart")
+ )
+ assert security_manager._is_public_pvm(
+ security_manager.find_permission_view_menu("can_dashboard", "Superset")
+ )
+ assert security_manager._is_public_pvm(
+ security_manager.find_permission_view_menu("can_explore_json", "Superset")
+ )
+
+ # Should NOT include write permissions on core objects
+ assert not security_manager._is_public_pvm(
+ security_manager.find_permission_view_menu("can_write", "Dashboard")
+ )
+ assert not security_manager._is_public_pvm(
+ security_manager.find_permission_view_menu("can_write", "Chart")
+ )
+
+ # Should NOT include admin/alpha permissions
+ assert not security_manager._is_public_pvm(
+ security_manager.find_permission_view_menu(
+ "all_datasource_access", "all_datasource_access"
+ )
+ )
+
+ def test_public_role_permissions(self):
+ """Test that Public role has the expected minimal permissions."""
+ public_perm_set = get_perm_tuples("Public")
+
+ # Core dashboard viewing - should be present
+ assert ("can_read", "Dashboard") in public_perm_set
+ assert ("can_read", "Chart") in public_perm_set
+ assert ("can_dashboard", "Superset") in public_perm_set
+ assert ("can_slice", "Superset") in public_perm_set
+ assert ("can_explore_json", "Superset") in public_perm_set
+ assert ("can_dashboard_permalink", "Superset") in public_perm_set
+
+ # Filter state for interactive dashboards
+ assert ("can_read", "DashboardFilterStateRestApi") in public_perm_set
+ assert ("can_write", "DashboardFilterStateRestApi") in public_perm_set
+
+ # Should NOT have write permissions on core objects
+ assert ("can_write", "Dashboard") not in public_perm_set
+ assert ("can_write", "Chart") not in public_perm_set
+ assert ("can_write", "Dataset") not in public_perm_set
+
+ # Should NOT have share permissions
+ assert ("can_share_dashboard", "Superset") not in public_perm_set
+ assert ("can_share_chart", "Superset") not in public_perm_set
+
+ # Should NOT have SQL Lab access
+ assert ("can_sqllab", "Superset") not in public_perm_set
+ assert ("menu_access", "SQL Lab") not in public_perm_set
+
+ # Should NOT have admin permissions
+ assert (
+ "all_datasource_access",
+ "all_datasource_access",
+ ) not in public_perm_set
+ assert ("all_database_access", "all_database_access") not in public_perm_set
+
+ # Should NOT have user management access
+ assert ("can_userinfo", "UserDBModelView") not in public_perm_set
+
+ def test_public_role_more_restrictive_than_gamma(self):
+ """Test that Public role is more restrictive than Gamma."""
+ public_perm_set = get_perm_tuples("Public")
+ gamma_perm_set = get_perm_tuples("Gamma")
+
+ # Public should be a subset of Gamma (more restrictive)
+ # Note: Public has filter state write which Gamma also has
+ public_only = public_perm_set - gamma_perm_set
+
+ # Any permissions Public has that Gamma doesn't should be intentional
+ # (there shouldn't be any in the current design)
+ assert (
+ len(public_only) == 0
+ ), f"Public has permissions Gamma doesn't: {public_only}"
+
+ # Public should have significantly fewer permissions than Gamma
+ assert len(public_perm_set) < len(gamma_perm_set)
+
def test_gamma_permissions_basic(self):
self.assert_can_gamma(get_perm_tuples("Gamma"))
self.assert_cannot_alpha(get_perm_tuples("Gamma"))