villebro opened a new pull request, #43516: URL: https://github.com/apache/superset/pull/43516
### SUMMARY Adds an explicit FAB permission for user-facing realtime notification delivery in the GAQ-to-GTF branch. This introduces `can_read` on the `Realtime` resource and uses it in the two browser-facing websocket paths: - `register_ws_channel_cookie()` only mints a websocket channel-token cookie when the current principal has `can_read Realtime`; stale cookies are cleared when the principal is anonymous or loses the permission. - `common_bootstrap_payload()` masks `WEBSOCKET_ENABLED` to `false` per request when the principal lacks `can_read Realtime`, without mutating the cached common bootstrap payload. The permission controls push notification delivery only. It does not grant access to dashboards, charts, tasks, task payloads, or chart data. Those remain guarded by the existing REST APIs, task subscriber filters, and chart/dashboard/dataset access checks. Redis Streams are intentionally not exposed as an end-user permission here. Streams are internal server-to-server coordination for correctness-sensitive waits such as task completion, dependency joins, and lock-release handoff. Browser-facing Pub/Sub/WebSocket delivery is the part that needs an operator-controllable permission. This also updates `SECURITY.md` to document the async execution/realtime notification security model and clarifies chart task abort wording: this path can unsubscribe or abort pending task work, but it does not guarantee database-engine query cancellation once chart execution has started. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF Not applicable; this is permission and transport gating only. ### TESTING INSTRUCTIONS Automated: ```bash pytest tests/unit_tests/websocket/test_channel.py tests/unit_tests/security/test_realtime_notification_permissions.py tests/unit_tests/views/test_base.py pre-commit run ``` Manual: 1. Enable `WEBSOCKET_ENABLED`. 2. Confirm a role with `can_read Realtime` receives the websocket channel-token cookie and sees `WEBSOCKET_ENABLED: true` in bootstrap config. 3. Remove `can_read Realtime` from the role. 4. Confirm the websocket channel-token cookie is not minted or is cleared, and bootstrap config exposes `WEBSOCKET_ENABLED: false`. 5. Confirm chart async completion still works through polling. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [x] Required feature flags: optional `WEBSOCKET_ENABLED` for websocket transport - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [x] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
