john-bodley commented on code in PR #24350:
URL: https://github.com/apache/superset/pull/24350#discussion_r1227064349
##########
superset/security/manager.py:
##########
@@ -1995,38 +2010,40 @@ def raise_for_user_activity_access(user_id: int) ->
None:
def raise_for_dashboard_access(self, dashboard: "Dashboard") -> None:
"""
Raise an exception if the user cannot access the dashboard.
- This does not check for the required role/permission pairs,
- it only concerns itself with entity relationships.
+
+ This does not check for the required role/permission pairs, it only
concerns
+ itself with entity relationships.
:param dashboard: Dashboard the user wants access to
:raises DashboardAccessDeniedError: If the user cannot access the
resource
"""
+
# pylint: disable=import-outside-toplevel
from superset import is_feature_enabled
from superset.dashboards.commands.exceptions import
DashboardAccessDeniedError
- def has_rbac_access() -> bool:
- if not is_feature_enabled("DASHBOARD_RBAC") or not dashboard.roles:
- return True
-
- return any(
- dashboard_role.id
- in [user_role.id for user_role in self.get_user_roles()]
- for dashboard_role in dashboard.roles
- )
-
if self.is_guest_user() and dashboard.embedded:
- can_access = self.has_guest_access(dashboard)
+ if self.has_guest_access(dashboard):
+ return
else:
- can_access = (
- self.is_admin()
- or self.is_owner(dashboard)
- or (dashboard.published and has_rbac_access())
Review Comment:
@villebro is the desired end state to support only one or do you perceive
both coexisting for some time?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscr...@superset.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscr...@superset.apache.org
For additional commands, e-mail: notifications-h...@superset.apache.org
