aminghadersohi commented on PR #45816: URL: https://github.com/apache/superset/pull/45816#issuecomment-6473275551
AC1-AC3 re-checked at d604acec739a5a888bb31c00b68d699e9119bb78 and at 9fe7a0ca6a71fabb97f5090ca28cc480e78e934c in a local Superset (PostgreSQL + Redis, `EMBEDDED_SUPERSET` on, guest tokens minted by `POST /api/v1/security/guest_token/`). - AC1, guest asking for another user's SQL Lab query by id: 403, no rows, no SQL text at both commits, on chart data (full, `result_type=query`, and bound to a dashboard chart), Explore GET, `/superset/fetch_datasource_metadata` and column values. An admin still gets 200 with 5 rows for the same query. - AC2, guest token with a `datasets` claim: chart data on the query returns 403 at both commits. - AC3, embedded dashboard with two dataset charts through the Embedded SDK at 9fe7a0ca: both chart-data calls return 200 and the per-region and per-product sums on screen match `SUM(amount)` from SQL. One gap showed up at d604acec: with a guest role that holds schema access, `GET /datasource/get/query/<id>/` returned 200 with the stored SQL, because that legacy view checks the query as `datasource=` instead of `query=`. 9fe7a0ca refuses guests a `query` datasource whether it arrives as `query`, `datasource` or a query context's datasource. Both legacy datasource views (`/datasource/get/` and `/datasource/external_metadata/`) return 403 for the guest there, and `test_legacy_datasource_views_refuse_guest_query` and `test_guest_cannot_read_query_passed_as_datasource` cover it. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
