You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "abhishek-kgen (via GitHub)" <gi...@apache.org> on 2025/03/22 23:33:40 UTC
[D] Hiding Force refresh in Dashboard [superset]
GitHub user abhishek-kgen created a discussion: Hiding Force refresh in Dashboard
### Bug description
Hello,
I want to disable `Force Refresh` in Dashboard for users. It should only be accessed by the admins.
I created a new role and given only read only permissions, still users are able to do force refresh.
Which permission should I revoke for Gamma users to hide this option ?
### How to reproduce the bug
Go to the dashboard.
In menu, use Force refresh.
### Screenshots/recordings
### Superset version
3.1.2
### Python version
3.11
### Node version
16
### Browser
Chrome
### Additional context
_No response_
### Checklist
- [X] I have searched Superset docs and Slack and didn't find a solution to my problem.
- [X] I have searched the GitHub issue tracker and didn't find a similar bug report.
- [X] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.
GitHub link: https://github.com/apache/superset/discussions/32806
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Hiding Force refresh in Dashboard [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
GitHub user rusackas added a comment to the discussion: Hiding Force refresh in Dashboard
I'm not sure if there is such a granular permission for that. I'm curious the use case and why you wouldn't want users to refresh... maybe for embedded purposes?
Maybe @eschutho or @dpgaspar know a permission that can address this.
GitHub link: https://github.com/apache/superset/discussions/32806#discussioncomment-12589414
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Hiding Force refresh in Dashboard [superset]
Posted by "mistercrunch (via GitHub)" <gi...@apache.org>.
GitHub user mistercrunch added a comment to the discussion: Hiding Force refresh in Dashboard
No update on my side, was mostly thinking about a recent SIP and how it relates to this, but I wouldn't couple the solutions.
I can point to this https://github.com/apache/superset/pull/27029 as a recent similar PR that may be used for inspiration as to how to implement more granular perms.
GitHub link: https://github.com/apache/superset/discussions/32806#discussioncomment-12589420
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Hiding Force refresh in Dashboard [superset]
Posted by "dpgaspar (via GitHub)" <gi...@apache.org>.
GitHub user dpgaspar added a comment to the discussion: Hiding Force refresh in Dashboard
> I'm not sure if there is such a granular permission for that. I'm curious the use case and why you wouldn't want users to refresh... maybe for embedded purposes?
>
> Maybe @eschutho or @dpgaspar know a permission that can address this.
No specific permission for it. As you said, user's can always hit the endpoint `explore_json` or chart/data`, rate limit could be a solution also
GitHub link: https://github.com/apache/superset/discussions/32806#discussioncomment-12589417
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Hiding Force refresh in Dashboard [superset]
Posted by "rayyan-abid-ali (via GitHub)" <gi...@apache.org>.
GitHub user rayyan-abid-ali added a comment to the discussion: Hiding Force refresh in Dashboard
Would also love this, a permission that checks whether a user is allowed to force refresh or not would definitely help in reducing costs.
GitHub link: https://github.com/apache/superset/discussions/32806#discussioncomment-19097272
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Hiding Force refresh in Dashboard [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
GitHub user rusackas added a comment to the discussion: Hiding Force refresh in Dashboard
I'm going to move this to a Discussion, as it's more of a fit for an "Ideas" thread than a bug/issue. Please do chip in on the SIP discussion if you're interested in making this happen.
GitHub link: https://github.com/apache/superset/discussions/32806#discussioncomment-12589421
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Hiding Force refresh in Dashboard [superset]
Posted by "abhishek-kgen (via GitHub)" <gi...@apache.org>.
GitHub user abhishek-kgen added a comment to the discussion: Hiding Force refresh in Dashboard
@rusackas Frequent refresh causes a lot of query to Athena which also increases our Athena cost.
GitHub link: https://github.com/apache/superset/discussions/32806#discussioncomment-12589415
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Hiding Force refresh in Dashboard [superset]
Posted by "abhishek-kgen (via GitHub)" <gi...@apache.org>.
GitHub user abhishek-kgen added a comment to the discussion: Hiding Force refresh in Dashboard
Can someone help ?
GitHub link: https://github.com/apache/superset/discussions/32806#discussioncomment-12589413
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Hiding Force refresh in Dashboard [superset]
Posted by "rusackas (via GitHub)" <gi...@apache.org>.
GitHub user rusackas added a comment to the discussion: Hiding Force refresh in Dashboard
Sounds reasonable, but just to play devil's advocate here... are you sure you have a lot of users doing "force refresh" or is the dashboard's cache timeout too short? Also _maybe_ worth noting that people can still run these queries via the chart builder or SQL lab views as frequently as they want.
Another solution would be to put a tool in the middle that queries athena on a schedule (or provides an additional layer of caching, at least), keeping the resulting data in a more cost-effective warehouse/lake/db/etc. which you'd connect Superset to.
GitHub link: https://github.com/apache/superset/discussions/32806#discussioncomment-12589416
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Hiding Force refresh in Dashboard [superset]
Posted by "abhishek-kgen (via GitHub)" <gi...@apache.org>.
GitHub user abhishek-kgen added a comment to the discussion: Hiding Force refresh in Dashboard
@mistercrunch Any update on this? This will save a lot of money.
GitHub link: https://github.com/apache/superset/discussions/32806#discussioncomment-12589419
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Hiding Force refresh in Dashboard [superset]
Posted by "mistercrunch (via GitHub)" <gi...@apache.org>.
GitHub user mistercrunch added a comment to the discussion: Hiding Force refresh in Dashboard
I'm adding a note here as I'm thinking about evolving the security model, and going with a hierarchical action model. I want to make sure that the model we'll come up with will work to support the perm requests across the community.
Here the resource would be `Dashboard` and action would be `read.refresh.force`, where composing a role you could specify you give `read.*` minus `!read.refresh.force`. Clearly will require work to attach perms to actions across the frontend/backend, but seems the model I have in mind (and will publish soon) should support this.
GitHub link: https://github.com/apache/superset/discussions/32806#discussioncomment-12589418
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [D] Hiding Force refresh in Dashboard [superset]
Posted by "jcbrugiroux (via GitHub)" <gi...@apache.org>.
GitHub user jcbrugiroux added a comment to the discussion: Hiding Force refresh in Dashboard
Any news on this topic ? For embedded frames it's really annoying to display options like "force refresh", "show query".. That are features that we don't want to expose or that should be hidden if not authorized.
GitHub link: https://github.com/apache/superset/discussions/32806#discussioncomment-17473008
----
This is an automatically sent email for notifications@superset.apache.org.
To unsubscribe, please send an email to: notifications-unsubscribe@superset.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org