aminghadersohi commented on code in PR #44033: URL: https://github.com/apache/superset/pull/44033#discussion_r3993245465
########## SECURITY.md: ########## @@ -94,6 +94,10 @@ Realtime transports, including WebSocket delivery backed by Redis or Valkey Pub/ The realtime notification permission is distinct from the permission to read the underlying object. It controls whether a principal receives push notifications, not whether they may read the object once they call the protected REST API. Existing websocket connections are authorized by the JWT accepted at upgrade time; permission revocation after token minting is bounded by `WEBSOCKET_JWT_EXPIRATION_SECONDS` plus the websocket server's socket-check interval. Redis Streams are internal server-to-server coordination primitives and should not be directly exposed as an end-user subscription surface. +### Version History and Change Metadata + +An entity's version history — its change-record activity stream, field-level before/after diffs, and the author identity and timestamps attached to each change — is not part of the base *Read data* capability. Reading it requires **object-level editorship** of the entity (owner, editor, or Admin), the same capability required to restore a version. A principal who can read an entity's current state but is not an editor of it — including an **embedded guest token** and any **view-only** (read-but-not-edit) role — is not entitled to its version history, change metadata, or author identity, and such requests are refused. Related-entity records in a cross-entity activity view remain silently filtered to the reader's own read access. A bug that discloses version history, change-record diffs, or author identity to a principal lacking object-level editorship is in scope. Review Comment: Verified #44021 at `77078435`: `api_helpers.py` has zero `raise_for_access` left, the model allowlist fails closed by class identity (:287), editorship at :320. Yes to "Depends on #44021 — merge after"; keep them separate. Its UPDATING.md adds the same bullet twice (72/73). ########## SECURITY.md: ########## @@ -94,6 +94,10 @@ Realtime transports, including WebSocket delivery backed by Redis or Valkey Pub/ The realtime notification permission is distinct from the permission to read the underlying object. It controls whether a principal receives push notifications, not whether they may read the object once they call the protected REST API. Existing websocket connections are authorized by the JWT accepted at upgrade time; permission revocation after token minting is bounded by `WEBSOCKET_JWT_EXPIRATION_SECONDS` plus the websocket server's socket-check interval. Redis Streams are internal server-to-server coordination primitives and should not be directly exposed as an end-user subscription surface. +### Version History and Change Metadata + +An entity's version history — its change-record activity stream, field-level before/after diffs, and the author identity and timestamps attached to each change — is not part of the base *Read data* capability. Reading it requires **object-level editorship** of the entity (owner, editor, or Admin), the same capability required to restore a version. A principal who can read an entity's current state but is not an editor of it — including an **embedded guest token** and any **view-only** (read-but-not-edit) role — is not entitled to its version history, change metadata, or author identity, and such requests are refused. Related-entity records in a cross-entity activity view remain silently filtered to the reader's own read access. A bug that discloses version history, change-record diffs, or author identity to a principal lacking object-level editorship is in scope. Review Comment: Confirmed: the guest deny (:307) precedes editorship (:320), and `test_preflight_denies_guest_principals_outright` patches both gates to raise if reached, so the ordering is enforced rather than asserted. Withdrawing the `GUEST_ROLE_NAME` point — it doesn't survive #44021. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
