gpiccione-ship-it opened a new issue, #44239:
URL: https://github.com/apache/superset/issues/44239
### Bug description
### What we observe
On our instance two dashboards have an empty layout and **no associated
slices**. They are visible to
an admin and **invisible to a non-admin user who otherwise has access to
them**. An empty dashboard is
a perfectly legitimate state: it has just been created, or its charts have
been removed.
### Cause
`DashboardAccessFilter` builds its query with `.join(Dashboard.slices,
isouter=True)` — deliberately
an **outer** join, so that dashboards without slices survive the filter —
and then adds **two INNER
joins** downstream. Those inner joins discard exactly the rows the outer
join existed to keep: on a
dashboard with no slices the joined columns are `NULL`, and an INNER join
drops the row.
The precaution does not fail. It **disappears**. ⬜ *File e riga esatti da
rileggere in 6.1.0.*
### Why it is worth fixing
* it is **silent**: no error, no warning, the dashboard is simply not in the
list, and the user has no
way to tell "I don't have access" from "it isn't there";
* the intent is already in the code — someone wrote `isouter=True` **on
purpose**. The defect is that
the intent is cancelled three lines later, which is the kind of thing that
survives review because
each line is individually correct;
* it makes a legitimate product state unreachable for a whole class of users.
### Suggested fix
Either make the downstream joins outer as well, or restructure the
slice-based predicate as an
`EXISTS` subquery so that it filters *whether* a dashboard qualifies without
constraining the set of
dashboard rows.
### ⬜ Reproduction to run before filing
1. create a dashboard and associate **no** chart with it;
2. grant a non-admin role access to it;
3. list dashboards as that user — expected: present; observed: absent;
4. repeat as admin — present.
### Screenshots/recordings
_No response_
### Superset version
6.1.0
### Python version
Not applicable
### Node version
Not applicable
### Browser
Not applicable
### Additional context
```
Metadata database: MySQL 8.4
Deployment: Docker Swarm
Auth: AUTH_REMOTE_USER; the affected user is a non-admin with role-based
access to the dashboard
Python: 3.10.21 — this is what the official `apache/superset:6.1.0` image
ships. The dropdown
above only offers 3.11 and 3.12, so I selected "Not applicable"; you may
want to add 3.10.
```
### Checklist
- [x] I have searched Superset docs and Slack and didn't find a solution to
my problem.
- [x] I have searched the GitHub issue tracker and didn't find a similar bug
report.
- [x] I have checked Superset's logs for errors and if I found a relevant
Python stacktrace, I included it here as text in the "additional context"
section.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
