airajena opened a new pull request, #52:
URL: https://github.com/apache/fineract-business-intelligence/pull/52
## RLS isolation tests : office-level row security on Superset datasets
### What changed
- Added `tests/integration/test_rls_isolation.py` — 28 tests, parametrized
across all 6 `superset/datasets/*.sql` files. Each test strips the Jinja header
from the dataset SQL, substitutes a real username, and runs it against the live
warehouse as `analytics_reader` (the same connection identity Superset itself
uses). Asserts:
- `admin` sees rows from all offices
- `north_manager` sees only office 101 (North Branch)
- `south_manager` sees only office 102 (South Branch)
- north/south result sets are disjoint — no shared rows
- an unknown username gets 0 rows (fail closed, not fail open)
- Fixed a real bug found while writing these tests:
`warehouse/schema/pipeline_state.sql` seeded `meta.user_office_mapping` with
`office_id 2` / `office_id 3` for `north_manager` / `south_manager`, but the
actual Fineract offices are `1` / `101` / `102` (Head Office / North Branch /
South Branch). This meant RLS was silently broken — both branch managers
matched zero rows and saw nothing instead of their own branch's data. Corrected
to `101` / `102`.
- Wired into CI: `.github/workflows/ci.yml` `integration-test` job now
installs Python + `pg8000`/`pytest` on the runner and runs `pytest
tests/integration/test_rls_isolation.py -v` right after `dbt test`, once the
warehouse has real seeded and dbt-built data.
### Verification
- Ran against a fully rebuilt local stack — fresh volumes, real Fineract
seed → extractor backfill → `dbt run` (18 models) → RLS suite. 28/28 pass.
### Screenshot
<img width="1906" height="723" alt="image"
src="https://github.com/user-attachments/assets/6fc51320-5b32-47d1-b4df-4b09a915250e";
/>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
