sadpandajoe commented on code in PR #44857: URL: https://github.com/apache/superset/pull/44857#discussion_r4327165064
########## UPDATING.md: ########## @@ -804,14 +804,28 @@ routes answer 404, and the "Reset Password" and "Reset my password" buttons on the legacy FAB user pages that led to them are gone. `superset init` no longer assigns their permissions (`can this form get/post on ResetPasswordView` and `ResetMyPasswordView`, plus the `resetpasswords` and `resetmypassword` actions on -`UserDBModelView`) to any role. Every flow they served lives in the SPA: -administrators reset a user's password from the "New password" fields in the -Users list edit modal (`PUT /api/v1/security/users/<id>`), users change their -own from the "Reset my password" modal on their profile page (`PUT -/api/v1/me/`, which requires `current_password` when the account already has one), and a pending forced password -change (`ENABLE_FORCE_PASSWORD_CHANGE`) now redirects to that profile page -instead of the removed form. Deployments that link to either legacy route should -point at `/user_info/` or the Users list instead. +`UserDBModelView`) to the built-in Admin/Alpha/Gamma/sql_lab roles, and a data +migration removes those same permissions from every other (operator-defined) +role that already held them, so no role on any upgraded install retains them. +Every flow they served lives in the SPA: administrators reset a user's +password from the "New password" fields in the Users list edit modal (`PUT +/api/v1/security/users/<id>`), users change their own from the "Reset my +password" modal on their profile page (`PUT /api/v1/me/`, which requires +`current_password` when the account already has one), and a pending forced +password change (`ENABLE_FORCE_PASSWORD_CHANGE`) now redirects to that profile +page instead of the removed form. Deployments that link to either legacy route +should point at `/user_info/` or the Users list instead. + +Reaching the profile page requires `can_read` on `user`, which the built-in +Admin/Alpha/Gamma roles hold by default but a custom role is not guaranteed +to. A user whose only role lacks it and who gets redirected there by a forced +password change is now redirected to logout with an explanatory message Review Comment: This says a flagged user whose role lacks `can_read` on `user` is redirected to logout, but under `AUTH_REMOTE_USER` the hook now returns a terminal 403 with no logout. An operator on remote-user auth who reads this note would expect a logout and not a blocked session. Could the note mention that exception? -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
