feat(jinja): current_user_email macro

[Vitor-Avila]

SUMMARY

This PR adds a new Jinja macro: {{current_user_email()}}. This macro can be specially useful when applying RLS based on the logged in user, as it's typically easier for organizations to have the email address information available in their warehouse (as opposed to the Superset account's username or id).

Fixes #26808.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

No UI changes.

TESTING INSTRUCTIONS

1. Navigate to SQL Lab.
2. Execute select '{{current_user_email()}}' as my_email;
3. Validate that your email address is properly displayed.

Tests also added.

ADDITIONAL INFORMATION

• Has associated issue: OAUTH, RLS and the case for {{ current_useremail }} #26808
• Required feature flags: ENABLE_TEMPLATE_PROCESSING
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 69.59%. Comparing base (c78ea20) to head (40b0c78).
Report is 1504 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #27197      +/-   ##
==========================================
+ Coverage   69.46%   69.59%   +0.12%     
==========================================
  Files        1905     1905              
  Lines       74580    74591      +11     
  Branches     8330     8330              
==========================================
+ Hits        51806    51910     +104     
+ Misses      20724    20631      -93     
  Partials     2050     2050              

Flag	Coverage Δ
hive	53.79% <16.66%> (?)
mysql	77.98% <72.22%> (+<0.01%)	⬆️
postgres	78.10% <72.22%> (+<0.01%)	⬆️
presto	53.74% <16.66%> (?)
python	83.12% <100.00%> (+0.26%)	⬆️
sqlite	77.62% <72.22%> (+<0.01%)	⬆️
unit	56.51% <100.00%> (+0.04%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[john-bodley]

Thanks @Vitor-Avila for the PR. Regarding your comment,

This macro can be specially useful when applying RLS based on the logged in user, as it avoids having to ingest data from the Superset user table to know the account ID or username

this doesn't seem to make sense to us, i.e., the user information (including the ID, email, username, etc.) is being pulled from the Superset metadata database.

[Vitor-Avila]

hey @john-bodley let me know if you have any concerns with this implementation. This was also asked in this ticket #26808

I think it makes sense depending on your data structure, but happy to review if it introduces any security concerns.

[john-bodley]

@Vitor-Avila there's no security or implementation concerns IMO, I just think you should remove the following,

as it avoids having to ingest data from the Superset user table to know the account ID or username

from your PR description as said macro does actually need to ingest data from the Superset user table.

[Vitor-Avila]

@john-bodley ohh gotcha! My point there is that if you want to apply an RLS rule using the other macros, for example:

employee = '{{current_username()}}'

You have to have the Superset username values available in your warehouse (the BI DB, not the Superset metadata DB) to properly make it work. So you have to either extract the account IDs or usernames from the metadata DB to your warehouse to apply RLS.

I updated the PR description -- let me know if you have any questions!

[eschutho]

@john-bodley I assumed that you're ok with us merging this, but let us know if there are any other questions. thanks!