codeant-ai-for-open-source[bot] commented on code in PR #44968: URL: https://github.com/apache/superset/pull/44968#discussion_r4179125259
########## docs/admin_docs/security/security.mdx: ########## @@ -61,6 +61,16 @@ Beyond the base `sql_lab` role, two additional SQL Lab permissions must be expli Grant these in **Security โ List Roles** by adding the permissions to the relevant role. +Running a query also needs a data grant. By default (`SQLLAB_REQUIRE_DATASET_MATCH = True`), every table the SQL references must be a registered dataset the user has `datasource_access` on (or owns). `database_access` still authorizes the whole database. `schema_access` and `catalog_access` let the user browse that schema in SQL Lab and still authorize charts, but they do not authorize query execution. + +Set the following in `superset_config.py` when schema- or catalog-wide SQL Lab access is the intended control (for example, access is managed on the warehouse and tables change often): + +```python +SQLLAB_REQUIRE_DATASET_MATCH = False +``` + +A `schema_access` or `catalog_access` grant then authorizes SQL Lab queries against every table in that schema, including tables that are not registered as datasets. The same flag covers result fetch, CSV and streaming export, cost estimates, SQL formatting, and the MCP `execute_sql` tool. Chart and Explore access are unchanged. Reports, alerts, MetaDB, and SQL validation still require a dataset match. Review Comment: **Suggestion:** `catalog_access` is checked without a schema restriction, so it authorizes tables across the catalog; this sentence incorrectly narrows its scope to one schema. **Assessment:** ๐ `Major` ยท ๐ `Occurrence: Sometimes` ยท ๐ท๏ธ `Comment mismatch` [](https://docs.codeant.ai/cli/resolve-pr-comments-skill) [](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=6283dc15a75949818c45b0e79746db28&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) [](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=6283dc15a75949818c45b0e79746db28&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) <details> <summary><b>Prompt for AI Agent ๐ค </b></summary> ```mdx This is a comment left during a code review. **Path:** docs/admin_docs/security/security.mdx **Line:** 72:72 **Comment:** *Comment Mismatch: `catalog_access` is checked without a schema restriction, so it authorizes tables across the catalog; this sentence incorrectly narrows its scope to one schema. Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise. Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix ``` </details> <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F44968&comment_hash=11a12f00bc003da81aabf932a4a7cea46234831cb93e21b69132046d6adecdef&reaction=like'>๐</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F44968&comment_hash=11a12f00bc003da81aabf932a4a7cea46234831cb93e21b69132046d6adecdef&reaction=dislike'>๐</a> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
