Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Add user filtering to changed_by. Fixes #27986 #29287

Merged
merged 6 commits into from
Jul 25, 2024

Conversation

marre
Copy link
Contributor

@marre marre commented Jun 18, 2024

SUMMARY

The EXTRA_RELATED_QUERY_FILTERS option only affected the "owner" field, this PR changes it to also apply to the "modified by" field.

This option is currently used in a superset installation where a superset user should not be able to list other superset user names. Without this PR a superset user can list the names of other users in the "modified by" field.

Fixes #27986

Documentation of the EXTRA_RELATED_QUERY_FILTERS:

# Extra related query filters make it possible to limit which objects are shown
# in the UI. For examples, to only show "admin" or users starting with the letter "b" in
# the "Owners" dropdowns, you could add the following in your config:

Example superset_config.py with EXTRA_RELATED_QUERY_FILTERS configured to hide all users:

# Hide all users
def user_filter(query):
    from sqlalchemy.sql import false
    return query.filter(false())

EXTRA_RELATED_QUERY_FILTERS = {
    "user": user_filter,
}

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

Before:
image

After:
image

TESTING INSTRUCTIONS

  1. Add the EXTRA_RELATED_QUERY_FILTERS above to your superset_config.py file
  2. Click on "charts" to get the list of all charts
  3. Click on the "owner" drop-down, only your name should be visible
  4. Click on the "modified-by" drop-down, only your name should be visible (before this patch all users were visible)

ADDITIONAL INFORMATION

  • Has associated issue: Showing list of all the users name to other users #27986
  • Required feature flags:
  • Changes UI
  • Includes DB Migration (follow approval process in SIP-59)
    • Migration is atomic, supports rollback & is backwards-compatible
    • Confirm DB migration upgrade and downgrade tested
    • Runtime estimates and downtime expectations provided
  • Introduces new feature or API
  • Removes existing feature or API

@github-actions github-actions bot added the api Related to the REST API label Jun 18, 2024
@dosubot dosubot bot added the authentication:access-control Rlated to access control label Jun 18, 2024
Copy link
Contributor

@github-actions github-actions bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Congrats on making your first PR and thank you for contributing to Superset! 🎉 ❤️

We hope to see you in our Slack community too! Not signed up? Use our Slack App to self-register.

@marre
Copy link
Contributor Author

marre commented Jun 18, 2024

Adding a link to the PR that introduced this feature for "owner" and "group".
#22526

Copy link

codecov bot commented Jun 18, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 83.74%. Comparing base (76d897e) to head (bc29572).
Report is 448 commits behind head on master.

Additional details and impacted files
@@             Coverage Diff             @@
##           master   #29287       +/-   ##
===========================================
+ Coverage   60.48%   83.74%   +23.25%     
===========================================
  Files        1931      524     -1407     
  Lines       76236    37789    -38447     
  Branches     8568        0     -8568     
===========================================
- Hits        46114    31646    -14468     
+ Misses      28017     6143    -21874     
+ Partials     2105        0     -2105     
Flag Coverage Δ
hive 49.13% <100.00%> (-0.03%) ⬇️
javascript ?
mysql 77.00% <100.00%> (?)
postgres 77.08% <100.00%> (?)
presto 53.71% <100.00%> (-0.10%) ⬇️
python 83.74% <100.00%> (+20.25%) ⬆️
sqlite 76.56% <100.00%> (?)
unit 59.86% <100.00%> (+2.23%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@marre
Copy link
Contributor Author

marre commented Jun 19, 2024

@dpgaspar : I think I have corrected the formatting. Would be nice if you can start the workflows again.

@rusackas
Copy link
Member

CI running 🤞

@marre
Copy link
Contributor Author

marre commented Jun 25, 2024

@rusackas : Added missing newline to get ruff linter happy

@dpgaspar would love to get a new CI run...

@marre
Copy link
Contributor Author

marre commented Jul 7, 2024

Would love to get some feedback if this PR is considered for merging. Or if I can improve it in some way.

@rusackas rusackas requested review from nytai and geido July 8, 2024 18:14
@marre
Copy link
Contributor Author

marre commented Jul 13, 2024

Updated branch with master to resolve merge conflict

@marre
Copy link
Contributor Author

marre commented Jul 13, 2024

Updated the "summary" of this PR with a better description and added "testing instructions"

@rusackas
Copy link
Member

Running CI again :)

@marre
Copy link
Contributor Author

marre commented Jul 18, 2024

Anything else I can do to get this approved/merged?

@bcook-konza
Copy link

This looks awesome @marre - we would also greatly benefit from this. We'll be crossing our fingers for approval soon and we'll be willing to help if any additional work is needed

@rusackas
Copy link
Member

Done! Thanks for your contribution!

@rusackas rusackas merged commit 922128f into apache:master Jul 25, 2024
39 checks passed
@marre
Copy link
Contributor Author

marre commented Jul 26, 2024

Thanks!

In what release will it be included in?

@sadpandajoe
Copy link
Member

@supersetbot label 4.1

@github-actions github-actions bot added the v4.1 Label added by the release manager to track PRs to be included in the 4.1 branch label Jul 30, 2024
sadpandajoe pushed a commit to preset-io/superset that referenced this pull request Jul 30, 2024
Co-authored-by: Markus Eriksson <[email protected]>
(cherry picked from commit 922128f)
@bruno-santos-6
Copy link

bruno-santos-6 commented Aug 1, 2024

@marre, thank you! However, you mentioned that this would fix the 'Modified By' field issue, but the only field currently removing the list of users is 'Owner'.

Example for the 'Owner' field:
image

Example for the 'Modified By' field

image

Is there any configuration that I'm missing?

Hide all users

from sqlalchemy.sql import false

def user_filter(query):
    return query.filter(false())
        
EXTRA_RELATED_QUERY_FILTERS = {
       "user": user_filter,
       "changed_by": user_filter
 }              

@sadpandajoe
Copy link
Member

@supersetbot unlabel 4.1

@github-actions github-actions bot removed the v4.1 Label added by the release manager to track PRs to be included in the 4.1 branch label Aug 1, 2024
@marre
Copy link
Contributor Author

marre commented Aug 2, 2024

@sadpandajoe Would really love to have this in 4.1...

@bruno-santos-6 What version of superset are you testing with?

Just pulled latest from superset/superset (master branch@40520c54d40f887453827ef36a9f5924119ada62)

Without EXTRA_RELATED_QUERY_FILTERS

Without EXTRA_RELATED_QUERY_FILTERS configured:

Owner:
image

Modified-by:
image

With EXTRA_RELATED_QUERY_FILTERS

Added this to my superset_config.py:

def user_filter(query):
    from sqlalchemy.sql import false
    return query.filter(false())

EXTRA_RELATED_QUERY_FILTERS = {
    "user": user_filter,
}

Started with:

export SUPERSET_CONFIG_PATH=./superset_config.py
superset run -p 8088 --with-threads --reload --debugger --debug

Owner after:
image

Modified-by after:
image

@marre
Copy link
Contributor Author

marre commented Aug 2, 2024

Noticed that I had a typo in the first sentence of the description. I wrote "modified-by" where I intended "owner" and vice-versa. Corrected in description.

@bruno-santos-6
Copy link

@marre You are right, I deployed Superset using Helm on Kubernetes, and the latest version of Superset available in the official chart is 4.0.1. I will try to apply version 4.0.2

@marre
Copy link
Contributor Author

marre commented Aug 5, 2024

You have to either grab it directly from github from master branch or wait for a release where this PR will be included in. I hope it will be in 4.1.0 as it was once tagged with 4.1, but that tag has been removed. So I really don't know when this will be included in a release.

@sadpandajoe sadpandajoe added the v4.1 Label added by the release manager to track PRs to be included in the 4.1 branch label Aug 13, 2024
sadpandajoe pushed a commit that referenced this pull request Aug 13, 2024
Co-authored-by: Markus Eriksson <[email protected]>
(cherry picked from commit 922128f)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
api Related to the REST API authentication:access-control Rlated to access control size/M v4.1 Label added by the release manager to track PRs to be included in the 4.1 branch
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Showing list of all the users name to other users
5 participants