fix: Add user filtering to changed_by. Fixes #27986

[marre]

SUMMARY

The EXTRA_RELATED_QUERY_FILTERS option only affected the "modified by" field, this PR changes it to also apply to the "owner" field.

This option is currently used in a superset installation where a superset user should not be able to list other superset user names. Without this PR a superset user can list the names of other users in the "modified by" field.

Fixes #27986

Documentation of the EXTRA_RELATED_QUERY_FILTERS:

# Extra related query filters make it possible to limit which objects are shown
# in the UI. For examples, to only show "admin" or users starting with the letter "b" in
# the "Owners" dropdowns, you could add the following in your config:

Example superset_config.py with EXTRA_RELATED_QUERY_FILTERS configured to hide all users:

# Hide all users
def user_filter(query):
    from sqlalchemy.sql import false
    return query.filter(false())

EXTRA_RELATED_QUERY_FILTERS = {
    "user": user_filter,
}

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

Before:

After:

TESTING INSTRUCTIONS

1. Add the EXTRA_RELATED_QUERY_FILTERS above to your superset_config.py file
2. Click on "charts" to get the list of all charts
3. Click on the "owner" drop-down, only your name should be visible
4. Click on the "modified-by" drop-down, only your name should be visible (before this patch all users were visible)

ADDITIONAL INFORMATION

• Has associated issue: Showing list of all the users name to other users #27986
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

[github-actions]

Congrats on making your first PR and thank you for contributing to Superset! 🎉 ❤️

We hope to see you in our Slack community too! Not signed up? Use our Slack App to self-register.

[marre]

Adding a link to the PR that introduced this feature for "owner" and "group".
#22526

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 83.74%. Comparing base (76d897e) to head (bc29572).
Report is 448 commits behind head on master.

Additional details and impacted files

@@             Coverage Diff             @@
##           master   #29287       +/-   ##
===========================================
+ Coverage   60.48%   83.74%   +23.25%     
===========================================
  Files        1931      524     -1407     
  Lines       76236    37789    -38447     
  Branches     8568        0     -8568     
===========================================
- Hits        46114    31646    -14468     
+ Misses      28017     6143    -21874     
+ Partials     2105        0     -2105     

Flag	Coverage Δ
hive	49.13% <100.00%> (-0.03%)	⬇️
javascript	?
mysql	77.00% <100.00%> (?)
postgres	77.08% <100.00%> (?)
presto	53.71% <100.00%> (-0.10%)	⬇️
python	83.74% <100.00%> (+20.25%)	⬆️
sqlite	76.56% <100.00%> (?)
unit	59.86% <100.00%> (+2.23%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[marre]

@dpgaspar : I think I have corrected the formatting. Would be nice if you can start the workflows again.

[rusackas]

CI running 🤞

[marre]

@rusackas : Added missing newline to get ruff linter happy

@dpgaspar would love to get a new CI run...

[marre]

Would love to get some feedback if this PR is considered for merging. Or if I can improve it in some way.

[marre]

Updated branch with master to resolve merge conflict

[marre]

Updated the "summary" of this PR with a better description and added "testing instructions"

[rusackas]

Running CI again :)