GitHub user htcnokia created a discussion: # [Feature Request] Restrict 
standard users to view only their own Alerts & Reports in the subscription list



### Description

Currently, in the **Alerts & Reports** list view, standard (non-admin) users 
can see all configured email reports and alerts created across the entire 
workspace/organization.

Allowing standard users to view all reports and alerts across the system 
creates several issues:

1. **Data Privacy & Security:** Report configurations may reveal sensitive 
query parameters, chart titles, recipient email lists, or dashboard structures 
that a user might not otherwise have permission to view.
2. **Clutter & Poor UX:** Users are exposed to dozens or hundreds of irrelevant 
report configurations created by other team members, making it difficult to 
find and manage their own subscriptions.

### Desired Behavior / Proposed Solution

1. **User-Level Filtering by Default:** Non-admin users should only see reports 
and alerts where they are listed as the **Owner** or **Created By** user.
2. **Role-Based Access Control (RBAC):**
* **Admin / Alpha (with explicit manage permissions):** Retain global 
visibility to view, edit, or delete all system alerts and reports.
* **Gamma / Standard Users:** Scope the fetch query for the Alerts & Reports 
table to `created_by_fk == current_user_id` (or filter by ownership).


3. **Backend Enforcement:** Ensure the API endpoint (`/api/v1/report/`) 
enforces row-level filtering based on the requesting user's role and ID, rather 
than relying solely on frontend list filtering.

### Benefits

* **Enhanced Security & Privacy:** Prevents unintended disclosure of report 
schedules, recipient lists, and query metadata.
* **Cleaner Interface:** Provides users with a focused view containing only the 
alerts and reports relevant to them.

### Environment

* **Superset version:** 6.1.0
* **Feature:** Alerts & Reports Management (`/report/list/`)

---

GitHub link: https://github.com/apache/superset/discussions/42923

----
This is an automatically sent email for [email protected].
To unsubscribe, please send an email to: 
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to