GitHub user mohamedsigservice added a comment to the discussion: RLS condition inconsistently applied inside dataset metric subqueries
@Dosu Thanks for the detailed explanation. I have `ALLOW_ADHOC_SUBQUERY = True` enabled, and I can confirm that RLS is correctly applied in the outer query. However, I'm observing that RLS is **not injected inside subqueries used as denominators** in two specific metrics (`Taux de succès` and `Taux d'activation`) in a dataset called `tableau_brand`. Here is the pattern used in these metrics: ```sql SELECT SUM(value_2::int) FROM (SELECT * FROM tableau_brand) AS sub WHERE type = 'ts' AND product_category IS NULL AND date >= ... AND date < ... ``` The outer query correctly receives the RLS clause: ```sql WHERE (warehouse_id = 23 OR warehouse_id IS NULL) OR (warehouse_id = 40 OR warehouse_id IS NULL) ... AND (brand_id = 1 OR brand_id IS NULL) ``` But the subquery inside the metric does **not** receive the same RLS injection. **Important context:** `tableau_brand` is a **virtual dataset** in Superset (defined by a custom SQL query), not a physical PostgreSQL table. My hypothesis is that sqlglot does not recognize it as an `exp.Table` node since it has no physical existence in the database, and therefore skips RLS injection inside the subquery. For comparison, a similar subquery pattern in another dataset (`kpi_groupe`, which is also a virtual dataset) seems to behave differently — though I'm still investigating whether RLS is truly being injected there or simply producing consistent results by coincidence. **Questions:** - Is there a known difference in RLS injection behavior between physical tables and virtual datasets when referenced inside metric subqueries? - Does sqlglot resolve virtual dataset names against the Superset metadata layer, or does it treat them purely as SQL identifiers? - Is there a way to confirm/debug exactly which `exp.Table` nodes are detected and transformed during RLS injection for a given query? Environment: Apache Superset (Docker), PostgreSQL, `ALLOW_ADHOC_SUBQUERY = True`. GitHub link: https://github.com/apache/superset/discussions/40400#discussioncomment-17040632 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
