Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(Explore): Apply RLS at column values #30490

Merged
merged 5 commits into from
Oct 4, 2024
Merged

fix(Explore): Apply RLS at column values #30490

merged 5 commits into from
Oct 4, 2024

Conversation

geido
Copy link
Member

@geido geido commented Oct 1, 2024

SUMMARY

When applying a filter, column values would show all possible values without respecting RLS filters. This PR fixes that.

AFTER

rls_after.mp4

TESTING INSTRUCTIONS

  1. Apply RLS filters to an account
  2. Create a new chart using the target dataset
  3. Create a filter on a Table chart
  4. The user should only see the values of the column with RLS applied

ADDITIONAL INFORMATION

  • Has associated issue:
  • Required feature flags:
  • Changes UI
  • Includes DB Migration (follow approval process in SIP-59)
    • Migration is atomic, supports rollback & is backwards-compatible
    • Confirm DB migration upgrade and downgrade tested
    • Runtime estimates and downtime expectations provided
  • Introduces new feature or API
  • Removes existing feature or API

@dosubot dosubot bot added authentication:row-level-security Related to Row Level Security explore:filter Related to filters in Explore labels Oct 1, 2024
Vitor-Avila
Vitor-Avila approved these changes Oct 1, 2024
View reviewed changes
Copy link
Contributor

@Vitor-Avila Vitor-Avila left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM! Thanks for this improvement!

@geido geido marked this pull request as draft October 1, 2024 16:51
betodealmeida
betodealmeida previously requested changes Oct 3, 2024
View reviewed changes
Copy link
Member

@betodealmeida betodealmeida left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Left some comments on how to improve the logic.

superset/models/helpers.py Outdated Show resolved Hide resolved
superset/models/helpers.py Outdated Show resolved Hide resolved
superset/sql/parse.py Outdated Show resolved Hide resolved
superset/sql/parse.py Outdated Show resolved Hide resolved
superset/models/helpers.py Outdated Show resolved Hide resolved
@geido geido force-pushed the geido/fix/rls-at-column-values branch from 0ac0335 to 453ca98 Compare October 4, 2024 13:51
@geido geido dismissed betodealmeida’s stale review October 4, 2024 13:53

The changes discussed here were unnecessary as RLS should be applied as-is on the query to respect the original RLS intent.

@geido geido marked this pull request as ready for review October 4, 2024 13:53
@geido
Copy link
Member Author

geido commented Oct 4, 2024

/testenv up

@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Oct 4, 2024

@geido Ephemeral environment spinning up at http://35.94.18.43:8080. Credentials are admin/admin. Please allow several minutes for bootstrapping and startup.

@Vitor-Avila
Copy link
Contributor

I've just tested in the ephemeral and it worked properly for me both when combining multiple RLS conditions with the same group key, or a different group key. Thanks @geido!

betodealmeida
betodealmeida approved these changes Oct 4, 2024
View reviewed changes
Copy link
Member

@betodealmeida betodealmeida left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice!

superset/models/helpers.py Outdated Show resolved Hide resolved
@geido @betodealmeida
Update superset/models/helpers.py
c1815a8 
Co-authored-by: Beto Dealmeida <roberto@dealmeida.net>
@geido geido merged commit f314685 into master Oct 4, 2024
33 checks passed
@github-actions GitHub Actions
Copy link
Contributor

github-actions bot commented Oct 4, 2024

Ephemeral environment shutdown and build artifacts deleted.

@villebro
Copy link
Member

villebro commented Oct 4, 2024

Oof.. Nice catch + fix @geido!

@rusackas rusackas deleted the geido/fix/rls-at-column-values branch October 4, 2024 17:04
@sadpandajoe sadpandajoe added the v4.1 Label added by the release manager to track PRs to be included in the 4.1 branch label Oct 7, 2024
sadpandajoe pushed a commit that referenced this pull request Oct 7, 2024
@geido @sadpandajoe
fix(Explore): Apply RLS at column values (#30490)
9f5f089 
Co-authored-by: Beto Dealmeida <roberto@dealmeida.net>
(cherry picked from commit f314685)
@github-actions github-actions bot added 🍒 4.1.0 🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels labels Nov 14, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@mistercrunch mistercrunch mistercrunch left review comments

@Vitor-Avila Vitor-Avila Vitor-Avila approved these changes

@betodealmeida betodealmeida betodealmeida approved these changes

@Antonio-RiveroMartnez Antonio-RiveroMartnez Awaiting requested review from Antonio-RiveroMartnez

@villebro villebro Awaiting requested review from villebro

@michael-s-molina michael-s-molina Awaiting requested review from michael-s-molina

Assignees
No one assigned
Labels
authentication:row-level-security Related to Row Level Security 🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels explore:filter Related to filters in Explore review:draft size/L v4.1 Label added by the release manager to track PRs to be included in the 4.1 branch 🍒 4.1.0
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
7 participants
@geido @Vitor-Avila @villebro @mistercrunch @betodealmeida @sadpandajoe @michael-s-molina