AmoghAtreya opened a new pull request, #44968:
URL: https://github.com/apache/superset/pull/44968
### SUMMARY
Fixes #44903. After #40409, SQL Lab required `datasource_access` on a
registered dataset for every referenced table. A Gamma user with `sql_lab` plus
`schema_access` and `catalog_access` could still browse the schema and open
charts, but every SQL Lab query was denied. The error read as if those schema
grants were missing, and there was no configuration to restore the previous
behavior. Registering every table as a dataset does not scale for schemas where
tables are added and renamed often, and `database_access` is broader than a
single schema.
`SQLLAB_REQUIRE_DATASET_MATCH` defaults to `True`, so the dataset-match
requirement stays on unless an admin opts out. Set it to `False` to authorize
SQL Lab from `schema_access` or `catalog_access` alone. That grant then covers
every table in the schema, including tables that are not registered as datasets.
The flag covers the SQL Lab paths that execute a query or return its rows:
- query execution
- result fetch
- CSV and streaming export
- cost estimates
- SQL formatting
- the MCP `execute_sql` tool
Charts and Explore already honor `schema_access` and `catalog_access` and
are unchanged. Reports, alerts, MetaDB, and SQL validation keep requiring a
dataset match.
When the requirement is left on, a denial names the dataset requirement. It
says `schema_access` and `catalog_access` do not authorize the query, instead
of reading as if those grants are absent.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
N/A. Backend permission check and configuration only.
### TESTING INSTRUCTIONS
1. Use a database that supports catalogs, with "Allow changing catalogs"
enabled. Create a non-admin user with the `sql_lab` role and only these data
grants:
- `catalog_access` on `[Database].[catalog]`
- `schema_access` on `[Database].[catalog].[schema]`
- no `database_access`
- no per-table `datasource_access`
2. Leave `SQLLAB_REQUIRE_DATASET_MATCH` unset (default `True`). In SQL Lab,
run `SELECT * FROM schema.table LIMIT 100`. The query is denied. The error says
a registered dataset with `datasource_access` is required, and that
`schema_access` and `catalog_access` do not authorize the query.
3. Set `SQLLAB_REQUIRE_DATASET_MATCH = False` in `superset_config.py` and
restart. Run the same query. It succeeds.
4. Set the flag back to `True`. Grant `datasource_access` on a registered
dataset for that table and run the query again. It succeeds.
5. With the flag at either value, open a chart or dashboard backed by a
dataset in that schema. It still loads for a user who holds `schema_access`.
```bash
pytest tests/unit_tests/sqllab/test_requires_dataset_match.py \
tests/unit_tests/sqllab/api_test.py \
tests/unit_tests/commands/sql_lab/test_estimate.py \
tests/unit_tests/security/manager_test.py \
-k "dataset_match or format_sql or catalog_self_reference"
### ADDITIONAL INFORMATION
- [x] Has associated issue: Fixes #44903
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in
[SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
