mikebridge opened a new pull request, #43887: URL: https://github.com/apache/superset/pull/43887
### SUMMARY The semantic-layer `/connections/` endpoint (`SemanticLayerRestApi`, mapped to `can_read`) lists databases and semantic layers together. `_fetch_connection_items` access-filters the **semantic-layer** branch (`SemanticLayer.perm.in_(perms)` when `not can_access_all_datasources()`), but issued a **bare `db.session.query(Database)`** for the **database** branch — so any caller reaching the endpoint received every database's `database_name`, `backend`, `allow_dml`, `allow_file_upload`, `expose_in_sqllab` and last editor, regardless of database access. This applies `DatabaseFilter` — the same scoping `DatabaseRestApi` uses via `base_filters = [["id", DatabaseFilter, lambda: []]]` — to the database branch, so the database inventory is scoped exactly the way every other database path scopes it. The raw `sqlalchemy_uri` is not exposed by the serializer (it is loaded only so `backend` can be derived). **Security framing (per [`SECURITY.md`](https://github.com/apache/superset/blob/master/SECURITY.md)):** this is an in-scope authorization-scoping fix, **not a regression** introduced by any recent change. The gap is pre-existing on master. Built-in **Gamma** reached this endpoint before (via `can_connections`) and after (via `can_read`), so built-in-role reach is unchanged; what changed upstream is that the endpoint is now gated on the coarse, commonly-granted `can_read` and advertised as broadly accessible, so an operator can no longer grant "browse semantic layers" without also handing over the database inventory. Database/datasource inventory is object-scoped via `DatabaseFilter` on every other path. - **Role/capability matrix row:** database (connection) inventory visibility, object-scoped by `DatabaseFilter` base_filters on the Database API. - **Principal assumed:** Gamma, or any custom role granted `can_read` on `SemanticLayer`. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF N/A — backend authorization scoping, no UI change. ### TESTING INSTRUCTIONS Unit tests in `tests/unit_tests/semantic_layers/api_test.py`: - `test_connections_all_access_user_sees_all_databases` — a full-access caller has the database branch left unfiltered. - `test_connections_limited_user_access_filters_databases` — a caller without all-database access has `DatabaseFilter`'s access predicate applied (asserts `user_view_menu_names("database_access")` was consulted). Reverting the fix (bare `db.session.query(Database)`) fails this test. Manual: as a Gamma user (or a custom role with only `can_read` on `SemanticLayer`) that lacks access to some databases, `GET /api/v1/semantic_layer/connections/` returns only the databases the user can access; an all-access user still sees all. ### ADDITIONAL INFORMATION - [x] Has associated issue: sc-119878 (follow-up from the #43783 / sc-119467 review) - [x] Required feature flags: `SEMANTIC_LAYERS` (the endpoint is gated behind it; default off) - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01267VBWbvWTNZUg9GvXKgkC -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
