GitHub user dosubot[bot] added a comment to the discussion: Set database
transaction params
<!-- Answer -->
Your SQL_QUERY_MUTATOR should be called for every query in Superset v5,
including embedded/guest_token scenarios, as long as it's correctly registered
in your superset_config.py and Superset is restarted after changes. Here are
some things to check:
1. Make sure SQL_QUERY_MUTATOR = sql_query_mutator is set in your
superset_config.py (not just in a random Python file).
2. Restart all Superset processes (web server, Celery, etc.) after editing the
config.
3. Test with a trivial mutator (e.g., always prepend "-- MUTATOR TEST\n" to
every query) to confirm it's being called at all. If you don't see the comment
in your database logs or Superset SQL logs, the config isn't loaded.
4. Check the MUTATE_AFTER_SPLIT setting: by default it's False, so the mutator
runs on the whole query before splitting. If you want it to run per statement
(which is usually needed for SET LOCAL), set MUTATE_AFTER_SPLIT = True in your
config.
5. If the mutator is called but your logic isn't working, double-check that
your guest claims are actually being set on Flask's g object before the query
runs. The Flask request context and g are available when the mutator runs, so
this approach should work if the claims are present.
If you want a more robust and future-proof solution for user-specific RLS with
guest tokens, consider using the get_guest_user_attribute Jinja macro in your
dataset SQL. This lets you pass user attributes in the guest token and
reference them directly in your queries, without needing to mutate SQL or set
session variables. Example:
```sql
SELECT * FROM your_table
WHERE user_id = '{{ get_guest_user_attribute("user_id") }}'
```
This approach is officially supported and works well for embedded dashboards
with guest tokens.
If your mutator still isn't called after these steps, check for typos, config
file location, or errors in the Superset logs. Let me know if you want a
step-by-step for the Jinja macro approach or help debugging your config.
[Reference: SQL_QUERY_MUTATOR config and
invocation](https://github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/models/core.py#L408-L699)
<!-- Dosu Comment Footer -->
*To reply, just mention [@dosu](https://go.dosu.dev/dosubot).*
---
<sup>How did I do?
[Good](https://app.dosu.dev/response-feedback/70fbc80c-978e-476d-aa9d-06cb96459841?feedback_type=great_response)
|
[Irrelevant](https://app.dosu.dev/response-feedback/70fbc80c-978e-476d-aa9d-06cb96459841?feedback_type=irrelevant_answer)
|
[Incorrect](https://app.dosu.dev/response-feedback/70fbc80c-978e-476d-aa9d-06cb96459841?feedback_type=incorrect_sources)
|
[Verbose](https://app.dosu.dev/response-feedback/70fbc80c-978e-476d-aa9d-06cb96459841?feedback_type=too_verbose)
|
[Hallucination](https://app.dosu.dev/response-feedback/70fbc80c-978e-476d-aa9d-06cb96459841?feedback_type=hallucination)
| [Report
🐛](https://app.dosu.dev/response-feedback/70fbc80c-978e-476d-aa9d-06cb96459841?feedback_type=bug_report)
|
[Other](https://app.dosu.dev/response-feedback/70fbc80c-978e-476d-aa9d-06cb96459841?feedback_type=other)</sup>
[](https://app.dosu.dev/a28d3c7e-a9d3-459e-9fb6-3a6f9ff4f357/ask?utm_source=github) [](https://cursor.com/link/prompt?text=Your%20SQL_QUERY_MUTATOR%20should%20be%20called%20for%20every%20query%20in%20Superset%20v5%2C%20including%20embedded/guest_token%20scenarios%2C%20as%20long%20as%20it%27s%20correctly%20registered%20in%20your%20superset_config.py%20and%20Superset%20is%20restarted%20after%20changes.%20Here%20are%20some%20things%20to%20check%3A%0A%0A1.%20Make%20sure%20SQL_QUERY_MUTATOR%20%3D%20sql_query_mutator%20is%20set%20in%20your%20superset_config.py%20%28not%20just%20in%20a%20random%20Python%20file%29.%0A2.%20Restart%20all%20Superset%20processes%20%28web%20server%2C%20Celery%2C%20etc.%29%20after%20editing%20the%20config.%0A3.%20Test%20with%20a%20trivial%20mutator%20%28e.g.%2C%20always%20prepend%20%22--%20MUTATOR%20TEST%5Cn%22%20to%20every%20query%29%20to%20confirm%20
it%27s%20being%20called%20at%20all.%20If%20you%20don%27t%20see%20the%20comment%20in%20your%20database%20logs%20or%20Superset%20SQL%20logs%2C%20the%20config%20isn%27t%20loaded.%0A4.%20Check%20the%20MUTATE_AFTER_SPLIT%20setting%3A%20by%20default%20it%27s%20False%2C%20so%20the%20mutator%20runs%20on%20the%20whole%20query%20before%20splitting.%20If%20you%20want%20it%20to%20run%20per%20statement%20%28which%20is%20usually%20needed%20for%20SET%20LOCAL%29%2C%20set%20MUTATE_AFTER_SPLIT%20%3D%20True%20in%20your%20config.%0A5.%20If%20the%20mutator%20is%20called%20but%20your%20logic%20isn%27t%20working%2C%20double-check%20that%20your%20guest%20claims%20are%20actually%20being%20set%20on%20Flask%27s%20g%20object%20before%20the%20query%20runs.%20The%20Flask%20request%20context%20and%20g%20are%20available%20when%20the%20mutator%20runs%2C%20so%20this%20approach%20should%20work%20if%20the%20claims%20are%20present.%0A%0AIf%20you%20want%20a%20more%20robust%20and%20future-proof%20solution%20for%20user-sp
ecific%20RLS%20with%20guest%20tokens%2C%20consider%20using%20the%20get_guest_user_attribute%20Jinja%20macro%20in%20your%20dataset%20SQL.%20This%20lets%20you%20pass%20user%20attributes%20in%20the%20guest%20token%20and%20reference%20them%20directly%20in%20your%20queries%2C%20without%20needing%20to%20mutate%20SQL%20or%20set%20session%20variables.%20Example%3A%0A%0A%60%60%60sql%0ASELECT%20%2A%20FROM%20your_table%0AWHERE%20user_id%20%3D%20%27%7B%7B%20get_guest_user_attribute%28%22user_id%22%29%20%7D%7D%27%0A%60%60%60%0A%0AThis%20approach%20is%20officially%20supported%20and%20works%20well%20for%20embedded%20dashboards%20with%20guest%20tokens.%20%0A%0AIf%20your%20mutator%20still%20isn%27t%20called%20after%20these%20steps%2C%20check%20for%20typos%2C%20config%20file%20location%2C%20or%20errors%20in%20the%20Superset%20logs.%20Let%20me%20know%20if%20you%20want%20a%20step-by-step%20for%20the%20Jinja%20macro%20approach%20or%20help%20debugging%20your%20config.%20%0A%0A%5BReference%3A%20SQL_QUERY_
MUTATOR%20config%20and%20invocation%5D%28https%3A//github.com/apache/superset/blob/829e4d92d91ceae4b43b1ed3b063ffe45377799c/superset/models/core.py%23L408-L699%29) [](https://go.dosu.dev/discord-bot) [](https://twitter.com/intent/tweet?text=%40dosu_ai%20helped%20me%20solve%20this%20issue!&url=https%3A//github.com/apache/superset/discussions/37498)
GitHub link:
https://github.com/apache/superset/discussions/37498#discussioncomment-15645416
----
This is an automatically sent email for [email protected].
To unsubscribe, please send an email to:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
