You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "xavier-GitHub76 (via GitHub)" <gi...@apache.org> on 2024/07/05 15:27:14 UTC
[I] Deprecated permissions are not deleted after upgrade [superset]
xavier-GitHub76 opened a new issue, #29504:
URL: https://github.com/apache/superset/issues/29504
### Bug description
Hello
after upgrade, deprecated permissions are not deleted.
It's maybe normal (a downgrade is possible) but how clean deprecated permissions ?
### How to reproduce the bug
'can select star on Superset' is a deprecated permission.
I install an old version (1.5.2)
I create a role with 'can select star on Superset' permission
I create an user with the role
I stop my superset (I work with docker compose)
I upgrade to 4.0.2
I run superset db upgrade
I run superset db init
I restart superset
The upgrade is done
The role have the deprecated permission
It's possible to create a new role with the deprecated permission
I count the permission in the 'ab_permission' table :
- 72 for a version 4.0.2 from scratch
- 112 for the version 1.5.2 upgraded to 4.0.2
Best regards
### Screenshots/recordings
_No response_
### Superset version
master / latest-dev
### Python version
3.9
### Node version
16
### Browser
Chrome
### Additional context
_No response_
### Checklist
- [ ] I have searched Superset docs and Slack and didn't find a solution to my problem.
- [ ] I have searched the GitHub issue tracker and didn't find a similar bug report.
- [ ] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deprecated permissions are not deleted after upgrade [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas commented on issue #29504:
URL: https://github.com/apache/superset/issues/29504#issuecomment-2745904749
I believe the bot is correct, and this should be case closed. Let us know if you still have an issue here.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deprecated permissions are not deleted after upgrade [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
dosubot[bot] commented on issue #29504:
URL: https://github.com/apache/superset/issues/29504#issuecomment-2211079508
<!-- Answer -->
To clean up deprecated permissions after upgrading Apache Superset from version 1.5.2 to 4.0.2, you can use the `cleanup_permissions` function provided in the `scripts/permissions_cleanup.py` script. This function handles the cleanup of duplicate permissions, permissions with `None` values, and empty roles.
Here is the relevant code snippet for cleaning up permissions:
```python
from collections import defaultdict
from superset import security_manager
from superset.utils.decorators import transaction
@transaction()
def cleanup_permissions() -> None:
# 1. Clean up duplicates.
pvms = security_manager.get_session.query(
security_manager.permissionview_model
).all()
print(f"# of permission view menus is: {len(pvms)}")
pvms_dict = defaultdict(list)
for pvm in pvms:
pvms_dict[(pvm.permission, pvm.view_menu)].append(pvm)
duplicates = [v for v in pvms_dict.values() if len(v) > 1]
for pvm_list in duplicates:
first_prm = pvm_list[0]
roles = set(first_prm.role)
for pvm in pvm_list[1:]:
roles = roles.union(pvm.role)
security_manager.get_session.delete(pvm)
first_prm.roles = list(roles)
pvms = security_manager.get_session.query(
security_manager.permissionview_model
).all()
print(f"Stage 1: # of permission view menus is: {len(pvms)}")
# 2. Clean up None permissions or view menus
pvms = security_manager.get_session.query(
security_manager.permissionview_model
).all()
for pvm in pvms:
if not (pvm.view_menu and pvm.permission):
security_manager.get_session.delete(pvm)
pvms = security_manager.get_session.query(
security_manager.permissionview_model
).all()
print(f"Stage 2: # of permission view menus is: {len(pvms)}")
# 3. Delete empty permission view menus from roles
roles = security_manager.get_session.query(security_manager.role_model).all()
for role in roles:
role.permissions = [p for p in role.permissions if p]
# 4. Delete empty roles from permission view menus
pvms = security_manager.get_session.query(
security_manager.permissionview_model
).all()
for pvm in pvms:
pvm.role = [r for r in pvm.role if r]
cleanup_permissions()
```
To use this function, simply run the `cleanup_permissions` function. This will handle the deletion of duplicate permissions, permissions with `None` values, and empty roles, ensuring that your permissions are properly cleaned up after the upgrade <sup>[[1]](https://github.com/apache/superset/blob/master/scripts/permissions_cleanup.py)</sup>.
<!-- Dosu Comment Footer -->
*To continue talking to [Dosu](https://dosu.dev), mention @dosu.*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deprecated permissions are not deleted after upgrade [superset]
Posted by "xavier-GitHub76 (via GitHub)" <gi...@apache.org>.
xavier-GitHub76 commented on issue #29504:
URL: https://github.com/apache/superset/issues/29504#issuecomment-2827504344
@dosu : I use docker, how can I use the cleanup_permissions function ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deprecated permissions are not deleted after upgrade [superset]
Posted by "dosubot[bot] (via GitHub)" <gi...@apache.org>.
dosubot[bot] commented on issue #29504:
URL: https://github.com/apache/superset/issues/29504#issuecomment-2827511279
<!-- Answer -->
To use the `cleanup_permissions` function within a Docker setup for Apache Superset, you can follow these steps:
1. **Access the Superset Docker Container**: First, you need to access the shell of the Superset Docker container. You can do this by running the following command:
```bash
docker exec -it <container_name> /bin/bash
```
Replace `<container_name>` with the name of your Superset container.
2. **Run the Python Script**: Once inside the container, you can execute the Python script that contains the `cleanup_permissions` function. If the script is located in the `/app/scripts` directory, you can run it using:
```bash
python /app/scripts/permissions_cleanup.py
```
Ensure that the script is accessible within the container and that Python is installed.
3. **Verify Cleanup**: After running the script, you can verify that the deprecated permissions have been cleaned up by checking the permissions in the Superset UI or querying the database directly.
Make sure the script is correctly mounted into the container if it's not already part of the image. You can do this by modifying the `docker-compose.yml` file to include the script in the volumes section, as described in the Docker Compose setup <sup>[[1]](https://github.com/apache/superset/blob/master/docker-compose.yml)</sup>.
<!-- Dosu Comment Footer -->
*To continue talking to [Dosu](https://dosu.dev), mention @dosu.*
---
<sup>Help Dosu learn! Give it feedback: [Great Response](https://app.dosu.dev/response-feedback/d2b1d8fc-9650-45d6-bcd9-379e857fb274?feedback_type=great_response) | [Irrelevant Answer](https://app.dosu.dev/response-feedback/d2b1d8fc-9650-45d6-bcd9-379e857fb274?feedback_type=irrelevant_answer) | [Incorrect Sources](https://app.dosu.dev/response-feedback/d2b1d8fc-9650-45d6-bcd9-379e857fb274?feedback_type=incorrect_sources) | [Too Verbose](https://app.dosu.dev/response-feedback/d2b1d8fc-9650-45d6-bcd9-379e857fb274?feedback_type=too_verbose) | [Hallucination](https://app.dosu.dev/response-feedback/d2b1d8fc-9650-45d6-bcd9-379e857fb274?feedback_type=hallucination) | [Bug Report](https://app.dosu.dev/response-feedback/d2b1d8fc-9650-45d6-bcd9-379e857fb274?feedback_type=bug_report) | [Other](https://app.dosu.dev/response-feedback/d2b1d8fc-9650-45d6-bcd9-379e857fb274?feedback_type=other)</sup>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [I] Deprecated permissions are not deleted after upgrade [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
rusackas closed issue #29504: Deprecated permissions are not deleted after upgrade
URL: https://github.com/apache/superset/issues/29504
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org