EnxDev opened a new pull request, #42472:
URL: https://github.com/apache/superset/pull/42472
### SUMMARY
Superset's Subject model already unifies Users, Roles and Groups, and the
dashboard/chart access filters already expand a caller into user + roles +
groups.
This PR closes the remaining gaps between that model and group-based asset
access.
**Principal listings are now scoped.** `SubjectRestApi` had no
`base_filters` and never ran `_apply_subject_list_filters`, so
`EXCLUDE_USERS_FROM_LISTS` and `EXTRA_RELATED_QUERY_FILTERS` were silently
ignored on it — while every other
principal-listing endpoint honours them.
Because its `show_columns` includes `user.email`, the endpoint serves the
full principal directory with emails.
This is contained today only because the API is admin-only, so the scoping
has to land before any permission change.
**`include_ids` no longer bypasses that scoping.**
`_add_extra_ids_to_result` fetched requested IDs with a bare `pk_col.in_(ids)`
and no filters, so a caller could resolve principals the related-field filters
deliberately hide. It now applies the same `base_related_field_filters` as the
unforced query.
**New assets can inherit the creator's groups.** Behind the new
`ASSIGN_CREATOR_GROUPS_AS_VIEWERS` setting, a created asset is shared read-only
with every group its creator belongs to unless the payload names viewers
explicitly. `get_default_viewers_for_new_asset()` is the single decision
point, wired into the create commands plus the five paths that build assets
outside them (`/dashboard/new/`, the template copy, both v1 importers, and the
MCP
`generate_dashboard` tool).
**Group and role audit events are now measurable** as `security.<Action>`
StatsD counters, alongside the existing event-log records.
**`/api/v1/me/` exposes the caller's groups** (id + name). Previously
membership
was only discoverable via `/me/roles/`, which returns names without ids.
#### Design decisions
- **Groups become viewers, not editors.** Viewers are read-only; editors
would grant the whole group edit/delete rights, and for alerts and reports it
would also change the execution identity.
- **The setting defaults to off**, because it *narrows* rather than widens
access. An asset with no viewers falls back to datasource permissions; once it
has any viewer, that fallback is unreachable. Enabling this on an existing
deployment restricts newly created assets, so it is opt-in.
- **Datasets are excluded.** There is no `sqlatable_viewers` table, so a
`viewers` key would be applied by the DAO's `setattr` loop to a non-mapped
attribute and silently dropped. `CreateDatasetCommand` passes
`include_viewers=False`, matching what `CreateReportScheduleCommand` already
did.
- **The template-copy path resolves groups in memory.** `copy_dashboard`
runs in the user's `after_insert` event, where `ab_user_group` rows have not
been written yet, so a membership query can only ever return empty. It uses
`get_default_viewers_for_groups()` against the in-memory collection instead.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
N/A — no UI changes.
### TESTING INSTRUCTIONS
Unit tests (16 new):
pytest tests/unit_tests/subjects/ \
tests/unit_tests/views/test_user_schemas.py \
tests/unit_tests/views/test_related_include_ids.py \
tests/unit_tests/commands/dataset/test_create_subjects.py \
tests/unit_tests/security/test_audit_event_metrics.py
### ADDITIONAL INFORMATION
<!--- Check any relevant boxes with "x" -->
<!--- HINT: Include "Fixes #nnn" if you are fixing an existing issue -->
- [ ] Has associated issue:
- [ ] Required feature flags: ASSIGN_CREATOR_GROUPS_AS_VIEWERS (config
setting, defaults to off)
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in
[SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
