[GitHub] [incubator-superset] axelet commented on pull request #9751: feat: Add multiple table filters for Row Level Security

[GitBox <gi...@apache.org>]

axelet commented on pull request #9751:
URL: https://github.com/apache/incubator-superset/pull/9751#issuecomment-638280981


   @villebro Hey, I've made 2 commits and both of them are suitable for records migration. 
   
   The difference is that e73e3ce support only old-fashioned records downgrading ("old-fashioned" - records having 1 table_id per rls_filter_id). The last commit https://github.com/apache/incubator-superset/pull/9751/commits/88d7206a9a059f488eb6eed0723d6e69bf55bc93 supports downgrading new-fashioned records. There is a case when we can have multiple table_ids corresponding to 1 rls_filter_id. So, to downgrade this kind of records we have to add as much filter copies to row_level_security_filters as the rls_filter_tables have records related to the filter. Then we have to make sure roles are pointing to the newly created filters respectively and create new role-filter records in rls_filter_roles if needed.
   
   For example, given the screenshot:
   ![Screenshot 2020-06-03 at 16 34 41](https://user-images.githubusercontent.com/26820950/83651705-74339f00-a5c2-11ea-9920-55776149d37a.png)
   We have 3 flattened (old-fashioned) records and 1 new-fashioned that we have to flatten.
   The new-fashoined record have 2 entries in rls_filter_tables, 1 entry in row_level_security_filters, and 2 entry in rls_filter_roles. To return to old tables structure we lack 1 filter entry row_level_security to be able to populate it by rls_filter_tables's table_id. As we create it and assign a table_id we now have to assign similar roles to the filter. That will add 2 more records to rls_filter_roles to correspond the newly created filter. As for those records that have 1-to-1 table_id to filter_id relations we just move these table_ids to row_level_security_filter table respectively. And there is no need to do anything with roles.
   
   And the result of downgrading will look like this:
   ![Screenshot 2020-06-03 at 16 43 35](https://user-images.githubusercontent.com/26820950/83653217-291a8b80-a5c4-11ea-9061-b0169cd3b154.png)
   


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org