EnxDev commented on code in PR #45166:
URL: https://github.com/apache/superset/pull/45166#discussion_r4328535900
##########
superset/security/manager.py:
##########
@@ -5363,11 +5360,13 @@ def raise_for_access( # noqa: C901
catalog=effective_catalog,
)
for datasource_ in datasources:
+ # Table access derives from a datasource_access grant on a
Review Comment:
#45266 rewrote this loop on master: editorship is refused under
`force_dataset_match` and under a new `allow_editorship=False` flag, and kept
on the non-strict path as the #20382 "explore your own dataset" grant. If the
conflict resolves in favour of this PR, `allow_editorship` stops doing
anything, but dataset create, update, duplicate, v1 import, `/datasource/save/`
and `query_context_processor.py` all still pass it.
If dropping editorship everywhere is the rule we want, could the rebase
remove the flag and its callers too, so nobody reads it later as a live control?
##########
superset/security/manager.py:
##########
@@ -5431,7 +5430,6 @@ def has_promiscuous_chart_access() -> bool:
# A grant on a semantic view's parent layer covers the view,
# matching SemanticView.raise_for_access (sc-119501).
or self._semantic_layer_grant_allows(datasource)
- or self.is_editor(datasource)
Review Comment:
This is the leg #45266 chose to keep.
`test_raise_for_access_datasource_branch_honors_allow_editorship` and the last
assert of `test_raise_for_access_editorship_denied_in_strict_mode` in
`tests/unit_tests/security/manager_test.py` both expect an editor with no grant
to pass by default, so they'll fail once this is rebased.
The two PRs disagree on the policy for a Gamma or sql_lab editor opening
their own dataset in Explore, so it's worth settling which one wins with the
#45266 folks before flipping those tests.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
