EnxDev commented on code in PR #42472: URL: https://github.com/apache/superset/pull/42472#discussion_r3661712274
########## docs/admin_docs/security/security.mdx: ########## @@ -247,6 +247,33 @@ This feature is particularly useful for: - Granting access to dashboards without exposing the underlying datasets for other uses - Creating dashboard-specific access patterns that don't align with dataset permissions +#### Assigning the creator's groups automatically + +```python +ASSIGN_CREATOR_GROUPS_AS_VIEWERS = True +``` + +With this enabled, a newly created dashboard or chart is shared read-only with every group its +creator belongs to, unless the create payload names viewers explicitly. It applies to every path +that creates an asset: the REST API, `/dashboard/new/`, save-as from Explore, dashboard copy, +the import commands, and the MCP tools. Datasets are unaffected, as they have editors but no +viewers. + +For dashboards, viewer access additionally requires the dashboard to be **published** — the same +rule that governs every dashboard viewer. Until a new dashboard is published its creator's groups +see nothing, and because it now has viewers the dataset-based fallback no longer applies to it +either; group members gain access only once it is published. Charts have no such gate, so a new +chart is visible to the creator's groups immediately. + +Note that this **narrows** access rather than widening it. Because an asset with no viewers falls Review Comment: You're right, thanks for pointing this out. I confirmed that once a new chart is scoped to the creator's groups, a fixed executor that is neither an editor nor a viewer will no longer have access, so `alert/report/thumbnail` rendering can fail. This seems inherent to the stricter access model rather than a bug. A fixed executor that needs to render assets it doesn't own should either be an admin or belong to the appropriate groups. I've documented this behavior and the recommended setup in `security.mdx`, and the setting remains disabled by default. I’d prefer not to add a code-level exemption for the executor, as that would weaken the isolation model. Happy to discuss if you think we should handle it differently. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
