(superset) branch conservative-rls created (now 2932713c7be)

[be...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

beto pushed a change to branch conservative-rls
in repository https://gitbox.apache.org/repos/asf/superset.git


      at 2932713c7be feat: apply RLS conservatively

This branch includes the following new commits:

     new 2932713c7be feat: apply RLS conservatively

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.

(superset) 01/01: feat: apply RLS conservatively

[be...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

beto pushed a commit to branch conservative-rls
in repository https://gitbox.apache.org/repos/asf/superset.git

commit 2932713c7be857566f4e9ca45bf050c4cffbb692
Author: Beto Dealmeida <ro...@dealmeida.net>
AuthorDate: Mon Mar 16 19:49:52 2026 -0400

    feat: apply RLS conservatively
---
 superset/models/helpers.py | 11 ++++++++---
 superset/utils/rls.py      |  6 +++++-
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/superset/models/helpers.py b/superset/models/helpers.py
index 704b0f4c56a..a4f5cae5c5c 100644
--- a/superset/models/helpers.py
+++ b/superset/models/helpers.py
@@ -2049,15 +2049,20 @@ class ExploreMixin:  # pylint: disable=too-many-public-methods
         if parsed_script.statements:
             default_schema = self.database.get_default_schema(self.catalog)
             try:
-                for statement in parsed_script.statements:
+                # Only regenerate the SQL if RLS predicates were actually applied.
+                # Unnecessary round-tripping through sqlglot can alter SQL in
+                # dialect-specific ways (e.g. dropping column aliases, rewriting
+                # Redshift-specific syntax) and break virtual dataset queries.
+                if any(
                     apply_rls(
                         self.database,
                         self.catalog,
                         self.schema or default_schema or "",
                         statement,
                     )
-                # Regenerate the SQL after RLS application
-                from_sql = parsed_script.format()
+                    for statement in parsed_script.statements
+                ):
+                    from_sql = parsed_script.format()
             except Exception as ex:
                 # Log the error but don't fail - RLS application is best-effort
                 logger.warning("Failed to apply RLS to virtual dataset SQL: %s", ex)
diff --git a/superset/utils/rls.py b/superset/utils/rls.py
index 05f8ea9058c..7e6cdf2aee7 100644
--- a/superset/utils/rls.py
+++ b/superset/utils/rls.py
@@ -34,9 +34,11 @@ def apply_rls(
     catalog: str | None,
     schema: str,
     parsed_statement: BaseSQLStatement[Any],
-) -> None:
+) -> bool:
     """
     Modify statement inplace to ensure RLS rules are applied.
+
+    :returns: True if any RLS predicates were actually applied, False otherwise.
     """
     # There are two ways to insert RLS: either replacing the table with a subquery
     # that has the RLS, or appending the RLS to the ``WHERE`` clause. The former is
@@ -57,7 +59,9 @@ def apply_rls(
             if predicate
         ]
 
+    has_predicates = any(predicates.values())
     parsed_statement.apply_rls(catalog, schema, predicates, method)
+    return has_predicates
 
 
 def get_predicates_for_table(