codeant-ai-for-open-source[bot] commented on code in PR #43591: URL: https://github.com/apache/superset/pull/43591#discussion_r3873468899
########## docs/admin_docs/security/security.mdx: ########## @@ -583,6 +583,24 @@ SELECT * FROM ( queries run against tables that have associated datasets with RLS filters will then have the appropriate predicates injected automatically. +#### RLS Indicator in the Dataset List and Explore + +When a dataset has one or more RLS filters that apply to it, Superset shows a lock +icon badge next to the dataset name in the **Datasets** list and next to the dataset +selector in **Explore**. Hovering over the badge shows a tooltip listing each +applicable filter's name, filter type (Regular or Base), group key (if any), assigned +roles, and clause. Review Comment: **Suggestion:** The badge data is built from every subject attached to a filter, not only roles; subjects can be users, roles, or groups, and the frontend displays all of them under the `Roles` label. Change this wording to refer to assigned subjects or explicitly mention users and groups. [inconsistent naming] <details> <summary><b>Severity Level:</b> Minor ๐งน</summary> ```mdx - โ ๏ธ RLS tooltip mislabels user and group assignments. - โ ๏ธ Administrators may misunderstand who receives each filter. ``` </details> [](https://docs.codeant.ai/cli/resolve-pr-comments-skill) [](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=60a9da0b90404f219835e572bdbe6f9d&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) [](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=60a9da0b90404f219835e572bdbe6f9d&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) <details> <summary><b>Prompt for AI Agent ๐ค </b></summary> ```mdx This is a comment left during a code review. **Path:** docs/admin_docs/security/security.mdx **Line:** 591:592 **Comment:** *Inconsistent Naming: The badge data is built from every subject attached to a filter, not only roles; subjects can be users, roles, or groups, and the frontend displays all of them under the `Roles` label. Change this wording to refer to assigned subjects or explicitly mention users and groups. Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise. Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix ``` </details> <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43591&comment_hash=528c22345fc2de566d0fe636416670fddb047a3d6ca468c8d11bcd5cbb4a09df&reaction=like'>๐</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43591&comment_hash=528c22345fc2de566d0fe636416670fddb047a3d6ca468c8d11bcd5cbb4a09df&reaction=dislike'>๐</a> ########## docs/admin_docs/security/security.mdx: ########## @@ -583,6 +583,24 @@ SELECT * FROM ( queries run against tables that have associated datasets with RLS filters will then have the appropriate predicates injected automatically. +#### RLS Indicator in the Dataset List and Explore + +When a dataset has one or more RLS filters that apply to it, Superset shows a lock +icon badge next to the dataset name in the **Datasets** list and next to the dataset +selector in **Explore**. Hovering over the badge shows a tooltip listing each +applicable filter's name, filter type (Regular or Base), group key (if any), assigned +roles, and clause. + +This badge also surfaces filters that are inherited from the physical tables +referenced by a virtual (SQL-based) dataset, as described above. Inherited filters +are marked "from underlying table" in the tooltip, and a summary note is shown +whenever any of the listed filters are inherited rather than assigned directly to +the dataset. + +The badge is a visibility aid only โ it does not change which filters are applied to +a query. Use the RLS REST API described below if you need to confirm exactly which +filters affect a dataset. Review Comment: **Suggestion:** The documented Row Level Security API query filters direct filter-to-dataset associations; it does not compute the SQL-parsed physical-table inheritance used by the badge. Therefore it cannot confirm the complete set of filters affecting a virtual dataset as stated here. Point users to the dataset response or explicitly limit this claim to directly configured filters. [api mismatch] <details> <summary><b>Severity Level:</b> Minor ๐งน</summary> ```mdx - โ ๏ธ API query by virtual dataset misses inherited filters. - โ ๏ธ Auditors may incorrectly treat direct associations as complete. ``` </details> [](https://docs.codeant.ai/cli/resolve-pr-comments-skill) [](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=8b8ce90ca22e43d4a19abf0142fc78bf&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) [](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=8b8ce90ca22e43d4a19abf0142fc78bf&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) <details> <summary><b>Prompt for AI Agent ๐ค </b></summary> ```mdx This is a comment left during a code review. **Path:** docs/admin_docs/security/security.mdx **Line:** 600:602 **Comment:** *Api Mismatch: The documented Row Level Security API query filters direct filter-to-dataset associations; it does not compute the SQL-parsed physical-table inheritance used by the badge. Therefore it cannot confirm the complete set of filters affecting a virtual dataset as stated here. Point users to the dataset response or explicitly limit this claim to directly configured filters. Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise. Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix ``` </details> <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43591&comment_hash=93e96d43e8132caf722d867c81167fc1a0efb0a8e334bfd0f65c8a0cfee79d01&reaction=like'>๐</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43591&comment_hash=93e96d43e8132caf722d867c81167fc1a0efb0a8e334bfd0f65c8a0cfee79d01&reaction=dislike'>๐</a> ########## docs/admin_docs/security/security.mdx: ########## @@ -583,6 +583,24 @@ SELECT * FROM ( queries run against tables that have associated datasets with RLS filters will then have the appropriate predicates injected automatically. +#### RLS Indicator in the Dataset List and Explore + +When a dataset has one or more RLS filters that apply to it, Superset shows a lock +icon badge next to the dataset name in the **Datasets** list and next to the dataset +selector in **Explore**. Hovering over the badge shows a tooltip listing each +applicable filter's name, filter type (Regular or Base), group key (if any), assigned +roles, and clause. + +This badge also surfaces filters that are inherited from the physical tables +referenced by a virtual (SQL-based) dataset, as described above. Inherited filters +are marked "from underlying table" in the tooltip, and a summary note is shown +whenever any of the listed filters are inherited rather than assigned directly to +the dataset. Review Comment: **Suggestion:** The inherited-filter indicator is best-effort rather than unconditional: Superset only discovers physical tables that its SQL parser can process and whose table, schema, and database identities match a physical dataset. Parse failures and unsupported or unmatched references are silently omitted from the badge, so qualify this statement accordingly. [api mismatch] <details> <summary><b>Severity Level:</b> Minor ๐งน</summary> ```mdx - โ ๏ธ Dataset badges can omit inherited filters after parse failures. - โ ๏ธ Virtual datasets with unmatched references show incomplete indicators. ``` </details> [](https://docs.codeant.ai/cli/resolve-pr-comments-skill) [](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=d5961f985b74426ca68e9e4390c9e046&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) [](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=d5961f985b74426ca68e9e4390c9e046&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) <details> <summary><b>Prompt for AI Agent ๐ค </b></summary> ```mdx This is a comment left during a code review. **Path:** docs/admin_docs/security/security.mdx **Line:** 594:598 **Comment:** *Api Mismatch: The inherited-filter indicator is best-effort rather than unconditional: Superset only discovers physical tables that its SQL parser can process and whose table, schema, and database identities match a physical dataset. Parse failures and unsupported or unmatched references are silently omitted from the badge, so qualify this statement accordingly. Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise. Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix ``` </details> <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43591&comment_hash=5882035ba957b8021f5e7fea71247d1554938dfadc3b700213bd414d2cdcf2a1&reaction=like'>๐</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43591&comment_hash=5882035ba957b8021f5e7fea71247d1554938dfadc3b700213bd414d2cdcf2a1&reaction=dislike'>๐</a> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
