sha174n commented on code in PR #45166:
URL: https://github.com/apache/superset/pull/45166#discussion_r4256908712
##########
superset/security/manager.py:
##########
@@ -5363,11 +5363,13 @@ def raise_for_access( # noqa: C901
catalog=effective_catalog,
)
for datasource_ in datasources:
+ # Table access derives from a datasource_access grant on a
Review Comment:
Addressed in ded56a11ad: DatasourceFilter drops the editor-only trash leg,
and dataset restore, purge and the MCP restore tool now keep the grant-based
base filter, so trash follows the same rule as live datasets (chart restore is
unchanged, since chart editors still pass chart access).
##########
superset/security/manager.py:
##########
@@ -5431,7 +5433,6 @@ def has_promiscuous_chart_access() -> bool:
# A grant on a semantic view's parent layer covers the view,
# matching SemanticView.raise_for_access (sc-119501).
or self._semantic_layer_grant_allows(datasource)
- or self.is_editor(datasource)
Review Comment:
Intended. Added an UPDATING.md entry in ded56a11ad: saving a virtual dataset
creates no grant on it, so such roles should get datasource_access on those
datasets or schema_access on their schema.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
