MattiasAng opened a new issue, #44133: URL: https://github.com/apache/superset/issues/44133
### Bug description First of all, I'm not 100% sure this is a bug or intended purpose so @villebro might be able to answer this quickly as the contributor of this feature. https://github.com/apache/superset/pull/38831 implemented the flag `VIEWER_PROMISCUOUS_MODE` which based on the pull request description; > When enabled with ENABLE_VIEWERS, viewers can access dashboards/charts without explicit datasource permissions, mirroring the previous DASHBOARD_RBAC behavior When testing this feature and give viewer access to the dashboard I cannot view it without also giving viewer access to relevant charts, it just stays on a loading screen. If a dashboard has 10+ charts it can quickly become tedious regardless of automation. It would be beneficial if it be more of a top-down approach where if a user/group is given access to a higher-level item (i.e. dashboard) it should also be inherited on relevant charts (and datasets, but that already works). **AI investigation** **Root cause** `SecurityManager.can_drill_dataset_via_dashboard_access(dataset, dashboard)` is the function that implements this bypass, and it's already used correctly in `superset/datasets/api.py` and `superset/views/datasource/views.py`. It was simply never wired into `superset/dashboards/api.py's` `_serialize_dashboard_chart` / `_serialize_dashboard_dataset`, and neither `get_charts()` nor `get_datasets()` even holds a reference to the Dashboard to pass in. **Suggested fix** In `get_charts()/get_datasets()`, resolve the dashboard once and pass it into both serializers; have each serializer treat `can_access_chart(chart)` or `can_drill_dataset_via_dashboard_access(chart.datasource, dashboard)` (and the dataset equivalent) as the "can see full data" condition — mirroring the pattern already used in `datasets/api.py/datasource/views.py`. **Test gaps (none of these exist today):** Dashboard viewer + VIEWER_PROMISCUOUS_MODE=True → chart list retains form_data. Same setup → dataset list retains full metadata. VIEWER_PROMISCUOUS_MODE=False → metadata still narrowed as today. Viewer with access to only one dashboard dataset can't read unrelated datasets via this endpoint. Unpublished dashboard → viewer still denied. ### Screenshots/recordings _No response_ ### Superset version master / latest-dev ### Python version 3.12 ### Node version 18 or greater ### Browser Chrome ### Additional context _No response_ ### Checklist - [x] I have searched Superset docs and Slack and didn't find a solution to my problem. - [x] I have searched the GitHub issue tracker and didn't find a similar bug report. - [x] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
