GitHub user htcnokia created a discussion: # [Feature Request] Restrict standard users to view only their own Alerts & Reports in the subscription list
### Description Currently, in the **Alerts & Reports** list view, standard (non-admin) users can see all configured email reports and alerts created across the entire workspace/organization. Allowing standard users to view all reports and alerts across the system creates several issues: 1. **Data Privacy & Security:** Report configurations may reveal sensitive query parameters, chart titles, recipient email lists, or dashboard structures that a user might not otherwise have permission to view. 2. **Clutter & Poor UX:** Users are exposed to dozens or hundreds of irrelevant report configurations created by other team members, making it difficult to find and manage their own subscriptions. ### Desired Behavior / Proposed Solution 1. **User-Level Filtering by Default:** Non-admin users should only see reports and alerts where they are listed as the **Owner** or **Created By** user. 2. **Role-Based Access Control (RBAC):** * **Admin / Alpha (with explicit manage permissions):** Retain global visibility to view, edit, or delete all system alerts and reports. * **Gamma / Standard Users:** Scope the fetch query for the Alerts & Reports table to `created_by_fk == current_user_id` (or filter by ownership). 3. **Backend Enforcement:** Ensure the API endpoint (`/api/v1/report/`) enforces row-level filtering based on the requesting user's role and ID, rather than relying solely on frontend list filtering. ### Benefits * **Enhanced Security & Privacy:** Prevents unintended disclosure of report schedules, recipient lists, and query metadata. * **Cleaner Interface:** Provides users with a focused view containing only the alerts and reports relevant to them. ### Environment * **Superset version:** 6.1.0 * **Feature:** Alerts & Reports Management (`/report/list/`) --- GitHub link: https://github.com/apache/superset/discussions/42923 ---- This is an automatically sent email for [email protected]. To unsubscribe, please send an email to: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
