codeant-ai-for-open-source[bot] commented on code in PR #42472: URL: https://github.com/apache/superset/pull/42472#discussion_r3672039189
########## docs/admin_docs/security/security.mdx: ########## @@ -247,6 +247,42 @@ This feature is particularly useful for: - Granting access to dashboards without exposing the underlying datasets for other uses - Creating dashboard-specific access patterns that don't align with dataset permissions +#### Assigning the creator's groups automatically + +```python +ASSIGN_CREATOR_GROUPS_AS_VIEWERS = True +``` + +With this enabled, a newly created dashboard or chart is shared read-only with every group its +creator belongs to, unless the create payload names viewers explicitly. It applies to every path +that creates an asset: the REST API, `/dashboard/new/`, save-as from Explore, dashboard copy, +the import commands, and the MCP tools. Datasets are unaffected, as they have editors but no +viewers. + +For dashboards, viewer access additionally requires the dashboard to be **published** — the same +rule that governs every dashboard viewer. Until a new dashboard is published its creator's groups +see nothing, and because it now has viewers the dataset-based fallback no longer applies to it +either; group members gain access only once it is published. Charts have no such gate, so a new +chart is visible to the creator's groups immediately. Review Comment: **Suggestion:** Charts with assigned group viewers are not necessarily visible immediately: the preceding access rules state that viewer access still performs normal dataset permission checks unless `VIEWER_PROMISCUOUS_MODE` is enabled. Clarify this sentence to explain that group membership grants the viewer relationship, but chart data access may still be denied by dataset permissions. [docstring mismatch] <details> <summary><b>Severity Level:</b> Major ⚠️</summary> ```mdx - ❌ Group viewers may be denied chart rendering without dataset permissions. - ⚠️ Administrators may misconfigure access based on inaccurate documentation. - ⚠️ Chart viewer behavior conflicts with the documented normal dataset checks. ``` </details> <details> <summary><b>Steps of Reproduction ✅ </b></summary> ```mdx 1. Enable `ENABLE_VIEWERS` and `ASSIGN_CREATOR_GROUPS_AS_VIEWERS`, while leaving `VIEWER_PROMISCUOUS_MODE` disabled as in the default configuration at `superset/config.py:2995-3005`. 2. Create a chart through the Explore save flow at `superset/views/core.py:639-643`; the creator's group subjects are assigned to the chart's `viewers` relationship. 3. Have another member of that group request the chart without dataset permissions. Chart datasource access is checked by `security_manager.raise_for_access()` at `superset/security/manager.py:4083-4135`; the viewer-based datasource bypass is conditional on `VIEWER_PROMISCUOUS_MODE` at `superset/security/manager.py:4131-4135`. 4. Observe that the group member is denied access despite being an explicit chart viewer. The behavior is covered by `test_raise_for_access_datasource_chart_viewer_no_promiscuous_denies` at `tests/unit_tests/subjects/test_raise_for_access.py:328-349`. The documentation should state that chart viewers gain the viewer relationship immediately, but chart rendering still requires dataset permissions unless promiscuous mode is enabled. ``` </details> [](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=dfccbf6ab068445e857c52f7645235d2&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) [](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=dfccbf6ab068445e857c52f7645235d2&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) *(Use Cmd/Ctrl + Click for best experience)* <details> <summary><b>Prompt for AI Agent 🤖 </b></summary> ```mdx This is a comment left during a code review. **Path:** docs/admin_docs/security/security.mdx **Line:** 265:266 **Comment:** *Docstring Mismatch: Charts with assigned group viewers are not necessarily visible immediately: the preceding access rules state that viewer access still performs normal dataset permission checks unless `VIEWER_PROMISCUOUS_MODE` is enabled. Clarify this sentence to explain that group membership grants the viewer relationship, but chart data access may still be denied by dataset permissions. Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise. Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix ``` </details> <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F42472&comment_hash=6d00e9577f66f527beb74def6878b3c54b9e8af4f3cb26c6368b2d04062df580&reaction=like'>👍</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F42472&comment_hash=6d00e9577f66f527beb74def6878b3c54b9e8af4f3cb26c6368b2d04062df580&reaction=dislike'>👎</a> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
