You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "LevisNgigi (via GitHub)" <gi...@apache.org> on 2025/02/17 11:16:50 UTC
[PR] feat(roles): Add SqlLabPermalinkRestApi as default sqlab roles. [superset]
LevisNgigi opened a new pull request, #32284:
URL: https://github.com/apache/superset/pull/32284
feat(roles): Add SqlLabPermalinkRestApi as default sqlab roles.
### SUMMARY
This PR ensures that SQL Lab users automatically receive can_read and can_write permissions on SqlLabPermalinkRestApi by default when superset init runs.
Previously, these permissions were missing, requiring manual assignment. Now, they are included in the SupersetSecurityManager, making setup more seamless.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
N/A
### TESTING INSTRUCTIONS
1)Run superset init after applying this patch.
2)Go to Security → List Roles → SQL Lab.
3)Confirm that:
a.can_read on SqlLabPermalinkRestApi is assigned.
b.can_write on SqlLabPermalinkRestApi is assigned.
4)Log in as a SQL Lab user and verify that permissions are applied.
### ADDITIONAL INFORMATION
<!--- Check any relevant boxes with "x" -->
<!--- HINT: Include "Fixes #nnn" if you are fixing an existing issue -->
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(roles): Add SqlLabPermalinkRestApi as default sqlab roles. [superset]
Posted by "sadpandajoe (via GitHub)" <gi...@apache.org>.
sadpandajoe commented on PR #32284:
URL: https://github.com/apache/superset/pull/32284#issuecomment-2748518479
> > @LevisNgigi I see... I am on the 5.0.0rc1 docker image [here](https://hub.docker.com/layers/apache/superset/5.0.0rc1/images/sha256-1191d03e7fd206794272ebe9d730d2a6d7a515ed5633951bed97d48d04d3c4a7), any plan to release a new image or backport this to 4.1.2? The issue is very annoying when team collaboration is needed.
>
> @pang-wu This is a new feature that comes with v5.0. Not sure whether it will be backported. Maybe @sadpandajoe can clarify on that.
This won't be backported as part of 4.1 since don't pull in features to minor releases. As for a new docker image, we'll probably have a 5.0.0rc2 which will have this fix
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(roles): Add SqlLabPermalinkRestApi as default sqlab roles. [superset]
Posted by "sadpandajoe (via GitHub)" <gi...@apache.org>.
sadpandajoe commented on PR #32284:
URL: https://github.com/apache/superset/pull/32284#issuecomment-2675937293
@michael-s-molina it's a fix to help with https://github.com/apache/superset/pull/31421 which is already in 5.0.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(roles): Add SqlLabPermalinkRestApi as default sqlab roles. [superset]
Posted by "LevisNgigi (via GitHub)" <gi...@apache.org>.
LevisNgigi commented on PR #32284:
URL: https://github.com/apache/superset/pull/32284#issuecomment-3469745891
> Should the [STANDARD_ROLES](https://github.com/apache/superset/blob/5.0/RESOURCES/STANDARD_ROLES.md) be updated?
Yes I think they should,will try raise a pr for the same
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(roles): Add SqlLabPermalinkRestApi as default sqlab roles. [superset]
Posted by "LevisNgigi (via GitHub)" <gi...@apache.org>.
LevisNgigi commented on PR #32284:
URL: https://github.com/apache/superset/pull/32284#issuecomment-2666561482
> Could you attach the access error without the new role? Otherwise the permalink should be working with the existing (sqllab, can_read/write) roles
> Could you attach the access error without the new role? Otherwise the permalink should be working with the existing (sqllab, can_read/write) roles
@justinpark so without manually adding the permissions via the ui,("can_read", "SqlLabPermalinkRestApi"),,("can_write", "SqlLabPermalinkRestApi"),one gets the error that "there was an error generating the permalink" when copying the query link despite having the sqllab role.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(roles): Add SqlLabPermalinkRestApi as default sqlab roles. [superset]
Posted by "LevisNgigi (via GitHub)" <gi...@apache.org>.
LevisNgigi commented on PR #32284:
URL: https://github.com/apache/superset/pull/32284#issuecomment-2747300261
> we tested this in 5.0 but it doesn't work -- we have all permission added to the role. Here's the process to reproduce the problem:
>
> * Click "Copy Query URL" in saved Queries, we got something like `https://[superset hosting address]/sqllab/?key=xx`
> * Close all tabs in SQLLab to make sure there is no confusion.
> * Past the copied link in the same browser: There is nothing show up.
>
> Any thoughts?
Hey @pang-wu are you on the latest version of 5.0?I can see the issue is how your url is being built which was fixed by this [pr](https://github.com/apache/superset/pull/32154). The generated url should look something like this https://[superset hosting address]/sqllab/p/k34OzpRjqWB
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(roles): Add SqlLabPermalinkRestApi as default sqlab roles. [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas merged PR #32284:
URL: https://github.com/apache/superset/pull/32284
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(roles): Add SqlLabPermalinkRestApi as default sqlab roles. [superset]
Posted by "pang-wu (via GitHub)" <gi...@apache.org>.
pang-wu commented on PR #32284:
URL: https://github.com/apache/superset/pull/32284#issuecomment-2747204761
we tested this in 5.0 but it doesn't work -- we have all permission added to the role. Here's the process to reproduce the problem:
- Click "Copy Query URL" in saved Queries.
- Close all tabs in SQLLab to make sure there is no confusion.
- Past the copied link in the same browser: There is nothing show up.
Any thoughts?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(roles): Add SqlLabPermalinkRestApi as default sqlab roles. [superset]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #32284:
URL: https://github.com/apache/superset/pull/32284#issuecomment-2662823977
## [Codecov](https://app.codecov.io/gh/apache/superset/pull/32284?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
All modified and coverable lines are covered by tests :white_check_mark:
> Project coverage is 65.52%. Comparing base [(`76d897e`)](https://app.codecov.io/gh/apache/superset/commit/76d897eaa2f9e137102bc194c2e3109c29d0348f?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) to head [(`b341919`)](https://app.codecov.io/gh/apache/superset/commit/b341919dee008d21a9f040df158bf82541760024?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
> Report is 1452 commits behind head on master.
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## master #32284 +/- ##
==========================================
+ Coverage 60.48% 65.52% +5.03%
==========================================
Files 1931 546 -1385
Lines 76236 39097 -37139
Branches 8568 0 -8568
==========================================
- Hits 46114 25617 -20497
+ Misses 28017 13480 -14537
+ Partials 2105 0 -2105
```
| [Flag](https://app.codecov.io/gh/apache/superset/pull/32284/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [hive](https://app.codecov.io/gh/apache/superset/pull/32284/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `48.49% <ø> (-0.67%)` | :arrow_down: |
| [javascript](https://app.codecov.io/gh/apache/superset/pull/32284/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [presto](https://app.codecov.io/gh/apache/superset/pull/32284/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `53.02% <ø> (-0.78%)` | :arrow_down: |
| [python](https://app.codecov.io/gh/apache/superset/pull/32284/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `65.52% <ø> (+2.03%)` | :arrow_up: |
| [unit](https://app.codecov.io/gh/apache/superset/pull/32284/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `61.06% <ø> (+3.44%)` | :arrow_up: |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>
[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/apache/superset/pull/32284?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(roles): Add SqlLabPermalinkRestApi as default sqlab roles. [superset]
Posted by "pang-wu (via GitHub)" <gi...@apache.org>.
pang-wu commented on PR #32284:
URL: https://github.com/apache/superset/pull/32284#issuecomment-2747897983
@LevisNgigi I see... I am on the 5.0.0rc1 docker image [here](https://hub.docker.com/layers/apache/superset/5.0.0rc1/images/sha256-1191d03e7fd206794272ebe9d730d2a6d7a515ed5633951bed97d48d04d3c4a7), any plan to release a new image or backport this to 4.1.2? The issue is very annoying when team collaboration is needed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(roles): Add SqlLabPermalinkRestApi as default sqlab roles. [superset]
Posted by "LevisNgigi (via GitHub)" <gi...@apache.org>.
LevisNgigi commented on PR #32284:
URL: https://github.com/apache/superset/pull/32284#issuecomment-2747950801
> @LevisNgigi I see... I am on the 5.0.0rc1 docker image [here](https://hub.docker.com/layers/apache/superset/5.0.0rc1/images/sha256-1191d03e7fd206794272ebe9d730d2a6d7a515ed5633951bed97d48d04d3c4a7), any plan to release a new image or backport this to 4.1.2? The issue is very annoying when team collaboration is needed.
@pang-wu This is a new feature that comes with v5.0. Not sure whether it will be backported. Maybe @sadpandajoe can clarify on that.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(roles): Add SqlLabPermalinkRestApi as default sqlab roles. [superset]
Posted by "justinpark (via GitHub)" <gi...@apache.org>.
justinpark commented on code in PR #32284:
URL: https://github.com/apache/superset/pull/32284#discussion_r1960278050
##########
superset/security/manager.py:
##########
@@ -330,6 +330,8 @@ class SupersetSecurityManager( # pylint: disable=too-many-public-methods
("menu_access", "SQL Editor"),
("menu_access", "Saved Queries"),
("menu_access", "Query Search"),
+ ("can_read", "SqlLabPermalinkRestApi"),
+ ("can_write", "SqlLabPermalinkRestApi"),
Review Comment:
The permalink rest api follows `sqllab` resource ([here](https://github.com/apache/superset/pull/29163/files#diff-c4e8d9dc9eec6a02dbb7e8689350aaa761339f1ef0814ec9cfa0758757f34ebdR40)) so it's unnecessary to add this new role.
Additionally, this is where additional permissions related to view access are defined, and the permalink does not have a menu either.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(roles): Add SqlLabPermalinkRestApi as default sqlab roles. [superset]
Posted by "michael-s-molina (via GitHub)" <gi...@apache.org>.
michael-s-molina commented on PR #32284:
URL: https://github.com/apache/superset/pull/32284#issuecomment-2666478508
If these permissions are required, it would be a good idea to use the `fix` prefix for this PR so it can be cherry-picked into 5.0.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(roles): Add SqlLabPermalinkRestApi as default sqlab roles. [superset]
Posted by "marianysilva (via GitHub)" <gi...@apache.org>.
marianysilva commented on PR #32284:
URL: https://github.com/apache/superset/pull/32284#issuecomment-3461906484
Should the [STANDARD_ROLES](https://github.com/apache/superset/blob/5.0/RESOURCES/STANDARD_ROLES.md) be updated?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org