aminghadersohi commented on PR #45815: URL: https://github.com/apache/superset/pull/45815#issuecomment-6466776475
Product acceptance at 6ba673f0c345334196601973c0de4ab9c714f7ae: ship. I ran the PR head and the merge base side by side (docker, PostgreSQL, one shared metadata DB), with real logins, RLS rules, SQL Lab queries and guest tokens. - Restricted viewer, chart on a SQL Lab query whose id equals the id of a dataset that has an RLS rule on the table the query reads: master returns all 3 tenants (30 rows); this PR returns tenant 1 only (10 rows). Each Explore action I tried behaves the same way: chart render, View query (the predicate appears 0 times on master, once here), View results, CSV download, Samples, Drill to detail and the `samples` result type. - Guest token with a global rule, chart on a Query datasource: master 30 rows, this PR 10. A dataset-scoped guest rule on the colliding query: master 30, this PR 10. - Injection failure (a malformed clause, or an injected exception in statement RLS): master ran the colliding query unfiltered; this PR refuses it. A user with no rules still gets their rows. - Virtual datasets, physical datasets, Admin and an unrestricted user: same rows as master. In virtual-dataset SQL each predicate appears once, including after a physical dataset with RLS is converted to virtual. - `tests/unit_tests/models/query_datasource_rls_test.py`: 8 passed. Against the master `helpers.py`, 4 failed (the 4 this PR targets). Outside this diff, no change needed here: the fail-closed error for a SQL Lab query still says "virtual dataset query". Not covered: clicking through the browser UI (I sent the frontend's HTTP requests), engines other than PostgreSQL, async SQL Lab. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
