2019-01-15 18:53:27 -05:00
|
|
|
# Licensed to the Apache Software Foundation (ASF) under one
|
|
|
|
# or more contributor license agreements. See the NOTICE file
|
|
|
|
# distributed with this work for additional information
|
|
|
|
# regarding copyright ownership. The ASF licenses this file
|
|
|
|
# to you under the Apache License, Version 2.0 (the
|
|
|
|
# "License"); you may not use this file except in compliance
|
|
|
|
# with the License. You may obtain a copy of the License at
|
|
|
|
#
|
|
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
#
|
|
|
|
# Unless required by applicable law or agreed to in writing,
|
|
|
|
# software distributed under the License is distributed on an
|
|
|
|
# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
|
|
# KIND, either express or implied. See the License for the
|
|
|
|
# specific language governing permissions and limitations
|
|
|
|
# under the License.
|
2016-11-01 23:48:31 -04:00
|
|
|
"""Unit tests for Sql Lab"""
|
2016-11-17 14:58:33 -05:00
|
|
|
from datetime import datetime, timedelta
|
2016-11-01 23:48:31 -04:00
|
|
|
import json
|
|
|
|
import unittest
|
|
|
|
|
|
|
|
from flask_appbuilder.security.sqla import models as ab_models
|
2017-03-10 12:11:51 -05:00
|
|
|
|
2018-10-16 20:59:34 -04:00
|
|
|
from superset import db, security_manager
|
2018-06-28 00:35:12 -04:00
|
|
|
from superset.dataframe import SupersetDataFrame
|
|
|
|
from superset.db_engine_specs import BaseEngineSpec
|
2017-11-07 23:23:40 -05:00
|
|
|
from superset.models.sql_lab import Query
|
2018-10-16 20:59:34 -04:00
|
|
|
from superset.utils.core import datetime_to_epoch, get_main_database
|
2016-11-10 02:08:22 -05:00
|
|
|
from .base_tests import SupersetTestCase
|
2016-11-01 23:48:31 -04:00
|
|
|
|
|
|
|
|
2016-11-10 02:08:22 -05:00
|
|
|
class SqlLabTests(SupersetTestCase):
|
2016-11-01 23:48:31 -04:00
|
|
|
"""Testings for Sql Lab"""
|
|
|
|
|
|
|
|
def __init__(self, *args, **kwargs):
|
|
|
|
super(SqlLabTests, self).__init__(*args, **kwargs)
|
|
|
|
|
2016-11-17 14:58:33 -05:00
|
|
|
def run_some_queries(self):
|
2017-04-04 23:15:19 -04:00
|
|
|
db.session.query(Query).delete()
|
2016-11-17 14:58:33 -05:00
|
|
|
db.session.commit()
|
|
|
|
self.run_sql(
|
2019-06-25 16:34:48 -04:00
|
|
|
"SELECT * FROM ab_user", client_id="client_id_1", user_name="admin"
|
|
|
|
)
|
2016-11-17 14:58:33 -05:00
|
|
|
self.run_sql(
|
2019-06-25 16:34:48 -04:00
|
|
|
"SELECT * FROM NO_TABLE", client_id="client_id_3", user_name="admin"
|
|
|
|
)
|
2016-11-17 14:58:33 -05:00
|
|
|
self.run_sql(
|
2019-06-25 16:34:48 -04:00
|
|
|
"SELECT * FROM ab_permission",
|
|
|
|
client_id="client_id_2",
|
|
|
|
user_name="gamma_sqllab",
|
|
|
|
)
|
2016-11-17 14:58:33 -05:00
|
|
|
self.logout()
|
2016-11-01 23:48:31 -04:00
|
|
|
|
|
|
|
def tearDown(self):
|
2019-04-17 19:11:11 -04:00
|
|
|
self.logout()
|
2017-04-04 23:15:19 -04:00
|
|
|
db.session.query(Query).delete()
|
2016-11-17 14:58:33 -05:00
|
|
|
db.session.commit()
|
2019-04-17 19:11:11 -04:00
|
|
|
db.session.close()
|
2016-11-01 23:48:31 -04:00
|
|
|
|
|
|
|
def test_sql_json(self):
|
2019-06-25 16:34:48 -04:00
|
|
|
self.login("admin")
|
2016-11-17 14:58:33 -05:00
|
|
|
|
2019-06-25 16:34:48 -04:00
|
|
|
data = self.run_sql("SELECT * FROM ab_user", "1")
|
|
|
|
self.assertLess(0, len(data["data"]))
|
2016-11-01 23:48:31 -04:00
|
|
|
|
2019-06-25 16:34:48 -04:00
|
|
|
data = self.run_sql("SELECT * FROM unexistant_table", "2")
|
|
|
|
self.assertLess(0, len(data["error"]))
|
2016-11-01 23:48:31 -04:00
|
|
|
|
2018-12-22 13:28:22 -05:00
|
|
|
def test_multi_sql(self):
|
2019-06-25 16:34:48 -04:00
|
|
|
self.login("admin")
|
2018-12-22 13:28:22 -05:00
|
|
|
|
|
|
|
multi_sql = """
|
|
|
|
SELECT first_name FROM ab_user;
|
|
|
|
SELECT first_name FROM ab_user;
|
|
|
|
"""
|
2019-06-25 16:34:48 -04:00
|
|
|
data = self.run_sql(multi_sql, "2234")
|
|
|
|
self.assertLess(0, len(data["data"]))
|
2018-12-22 13:28:22 -05:00
|
|
|
|
2018-08-03 18:33:33 -04:00
|
|
|
def test_explain(self):
|
2019-06-25 16:34:48 -04:00
|
|
|
self.login("admin")
|
2018-08-03 18:33:33 -04:00
|
|
|
|
2019-06-25 16:34:48 -04:00
|
|
|
data = self.run_sql("EXPLAIN SELECT * FROM ab_user", "1")
|
|
|
|
self.assertLess(0, len(data["data"]))
|
2018-08-03 18:33:33 -04:00
|
|
|
|
2016-11-01 23:48:31 -04:00
|
|
|
def test_sql_json_has_access(self):
|
2018-09-06 17:55:48 -04:00
|
|
|
main_db = get_main_database(db.session)
|
2019-06-25 16:34:48 -04:00
|
|
|
security_manager.add_permission_view_menu("database_access", main_db.perm)
|
2016-11-01 23:48:31 -04:00
|
|
|
db.session.commit()
|
|
|
|
main_db_permission_view = (
|
|
|
|
db.session.query(ab_models.PermissionView)
|
|
|
|
.join(ab_models.ViewMenu)
|
2017-05-22 19:41:32 -04:00
|
|
|
.join(ab_models.Permission)
|
2019-06-25 16:34:48 -04:00
|
|
|
.filter(ab_models.ViewMenu.name == "[main].(id:1)")
|
|
|
|
.filter(ab_models.Permission.name == "database_access")
|
2016-11-01 23:48:31 -04:00
|
|
|
.first()
|
|
|
|
)
|
2019-06-25 16:34:48 -04:00
|
|
|
astronaut = security_manager.add_role("Astronaut")
|
2018-03-27 19:46:02 -04:00
|
|
|
security_manager.add_permission_role(astronaut, main_db_permission_view)
|
2016-11-17 14:58:33 -05:00
|
|
|
# Astronaut role is Gamma + sqllab + main db permissions
|
2019-06-25 16:34:48 -04:00
|
|
|
for perm in security_manager.find_role("Gamma").permissions:
|
2018-03-27 19:46:02 -04:00
|
|
|
security_manager.add_permission_role(astronaut, perm)
|
2019-06-25 16:34:48 -04:00
|
|
|
for perm in security_manager.find_role("sql_lab").permissions:
|
2018-03-27 19:46:02 -04:00
|
|
|
security_manager.add_permission_role(astronaut, perm)
|
2016-11-01 23:48:31 -04:00
|
|
|
|
2019-06-25 16:34:48 -04:00
|
|
|
gagarin = security_manager.find_user("gagarin")
|
2016-11-01 23:48:31 -04:00
|
|
|
if not gagarin:
|
2018-03-27 19:46:02 -04:00
|
|
|
security_manager.add_user(
|
2019-06-25 16:34:48 -04:00
|
|
|
"gagarin",
|
|
|
|
"Iurii",
|
|
|
|
"Gagarin",
|
|
|
|
"gagarin@cosmos.ussr",
|
2016-11-17 14:58:33 -05:00
|
|
|
astronaut,
|
2019-06-25 16:34:48 -04:00
|
|
|
password="general",
|
|
|
|
)
|
|
|
|
data = self.run_sql("SELECT * FROM ab_user", "3", user_name="gagarin")
|
2017-04-04 23:15:19 -04:00
|
|
|
db.session.query(Query).delete()
|
2016-11-01 23:48:31 -04:00
|
|
|
db.session.commit()
|
2019-06-25 16:34:48 -04:00
|
|
|
self.assertLess(0, len(data["data"]))
|
2016-11-01 23:48:31 -04:00
|
|
|
|
|
|
|
def test_queries_endpoint(self):
|
2016-11-17 14:58:33 -05:00
|
|
|
self.run_some_queries()
|
|
|
|
|
|
|
|
# Not logged in, should error out
|
2019-06-25 16:34:48 -04:00
|
|
|
resp = self.client.get("/superset/queries/0")
|
2016-12-15 08:38:34 -05:00
|
|
|
# Redirects to the login page
|
2016-11-01 23:48:31 -04:00
|
|
|
self.assertEquals(403, resp.status_code)
|
|
|
|
|
2016-11-17 14:58:33 -05:00
|
|
|
# Admin sees queries
|
2019-06-25 16:34:48 -04:00
|
|
|
self.login("admin")
|
|
|
|
data = self.get_json_resp("/superset/queries/0")
|
2016-11-01 23:48:31 -04:00
|
|
|
self.assertEquals(2, len(data))
|
|
|
|
|
2016-11-17 14:58:33 -05:00
|
|
|
# Run 2 more queries
|
2019-06-25 16:34:48 -04:00
|
|
|
self.run_sql("SELECT * FROM ab_user LIMIT 1", client_id="client_id_4")
|
|
|
|
self.run_sql("SELECT * FROM ab_user LIMIT 2", client_id="client_id_5")
|
|
|
|
self.login("admin")
|
|
|
|
data = self.get_json_resp("/superset/queries/0")
|
2016-11-01 23:48:31 -04:00
|
|
|
self.assertEquals(4, len(data))
|
|
|
|
|
2016-11-17 14:58:33 -05:00
|
|
|
now = datetime.now() + timedelta(days=1)
|
2019-06-25 16:34:48 -04:00
|
|
|
query = (
|
|
|
|
db.session.query(Query)
|
|
|
|
.filter_by(sql="SELECT * FROM ab_user LIMIT 1")
|
|
|
|
.first()
|
|
|
|
)
|
2016-11-17 14:58:33 -05:00
|
|
|
query.changed_on = now
|
2016-11-01 23:48:31 -04:00
|
|
|
db.session.commit()
|
|
|
|
|
2016-11-17 14:58:33 -05:00
|
|
|
data = self.get_json_resp(
|
2019-06-25 16:34:48 -04:00
|
|
|
"/superset/queries/{}".format(int(datetime_to_epoch(now)) - 1000)
|
|
|
|
)
|
2016-11-17 14:58:33 -05:00
|
|
|
self.assertEquals(1, len(data))
|
2016-11-01 23:48:31 -04:00
|
|
|
|
|
|
|
self.logout()
|
2019-06-25 16:34:48 -04:00
|
|
|
resp = self.client.get("/superset/queries/0")
|
2016-12-15 08:38:34 -05:00
|
|
|
# Redirects to the login page
|
2016-11-01 23:48:31 -04:00
|
|
|
self.assertEquals(403, resp.status_code)
|
|
|
|
|
|
|
|
def test_search_query_on_db_id(self):
|
2016-11-17 14:58:33 -05:00
|
|
|
self.run_some_queries()
|
2019-06-25 16:34:48 -04:00
|
|
|
self.login("admin")
|
2016-11-17 14:58:33 -05:00
|
|
|
# Test search queries on database Id
|
2019-06-25 16:34:48 -04:00
|
|
|
data = self.get_json_resp("/superset/search_queries?database_id=1")
|
2016-11-17 14:58:33 -05:00
|
|
|
self.assertEquals(3, len(data))
|
2019-06-25 16:34:48 -04:00
|
|
|
db_ids = [k["dbId"] for k in data]
|
2016-11-17 14:58:33 -05:00
|
|
|
self.assertEquals([1, 1, 1], db_ids)
|
|
|
|
|
2019-06-25 16:34:48 -04:00
|
|
|
resp = self.get_resp("/superset/search_queries?database_id=-1")
|
2016-11-17 14:58:33 -05:00
|
|
|
data = json.loads(resp)
|
|
|
|
self.assertEquals(0, len(data))
|
2016-11-01 23:48:31 -04:00
|
|
|
|
|
|
|
def test_search_query_on_user(self):
|
2016-11-17 14:58:33 -05:00
|
|
|
self.run_some_queries()
|
2019-06-25 16:34:48 -04:00
|
|
|
self.login("admin")
|
2016-11-17 14:58:33 -05:00
|
|
|
|
|
|
|
# Test search queries on user Id
|
2019-06-25 16:34:48 -04:00
|
|
|
user_id = security_manager.find_user("admin").id
|
|
|
|
data = self.get_json_resp("/superset/search_queries?user_id={}".format(user_id))
|
2016-11-17 14:58:33 -05:00
|
|
|
self.assertEquals(2, len(data))
|
2019-06-25 16:34:48 -04:00
|
|
|
user_ids = {k["userId"] for k in data}
|
2017-01-11 10:53:24 -05:00
|
|
|
self.assertEquals(set([user_id]), user_ids)
|
2016-11-17 14:58:33 -05:00
|
|
|
|
2019-06-25 16:34:48 -04:00
|
|
|
user_id = security_manager.find_user("gamma_sqllab").id
|
|
|
|
resp = self.get_resp("/superset/search_queries?user_id={}".format(user_id))
|
2016-11-17 14:58:33 -05:00
|
|
|
data = json.loads(resp)
|
|
|
|
self.assertEquals(1, len(data))
|
2019-06-25 16:34:48 -04:00
|
|
|
self.assertEquals(data[0]["userId"], user_id)
|
2016-11-01 23:48:31 -04:00
|
|
|
|
|
|
|
def test_search_query_on_status(self):
|
2016-11-17 14:58:33 -05:00
|
|
|
self.run_some_queries()
|
2019-06-25 16:34:48 -04:00
|
|
|
self.login("admin")
|
2016-11-17 14:58:33 -05:00
|
|
|
# Test search queries on status
|
2019-06-25 16:34:48 -04:00
|
|
|
resp = self.get_resp("/superset/search_queries?status=success")
|
2016-11-17 14:58:33 -05:00
|
|
|
data = json.loads(resp)
|
|
|
|
self.assertEquals(2, len(data))
|
2019-06-25 16:34:48 -04:00
|
|
|
states = [k["state"] for k in data]
|
|
|
|
self.assertEquals(["success", "success"], states)
|
2016-11-17 14:58:33 -05:00
|
|
|
|
2019-06-25 16:34:48 -04:00
|
|
|
resp = self.get_resp("/superset/search_queries?status=failed")
|
2016-11-17 14:58:33 -05:00
|
|
|
data = json.loads(resp)
|
|
|
|
self.assertEquals(1, len(data))
|
2019-06-25 16:34:48 -04:00
|
|
|
self.assertEquals(data[0]["state"], "failed")
|
2016-11-01 23:48:31 -04:00
|
|
|
|
|
|
|
def test_search_query_on_text(self):
|
2016-11-17 14:58:33 -05:00
|
|
|
self.run_some_queries()
|
2019-06-25 16:34:48 -04:00
|
|
|
self.login("admin")
|
|
|
|
url = "/superset/search_queries?search_text=permission"
|
2016-12-01 18:21:18 -05:00
|
|
|
data = self.get_json_resp(url)
|
2016-11-17 14:58:33 -05:00
|
|
|
self.assertEquals(1, len(data))
|
2019-06-25 16:34:48 -04:00
|
|
|
self.assertIn("permission", data[0]["sql"])
|
2016-11-01 23:48:31 -04:00
|
|
|
|
|
|
|
def test_search_query_on_time(self):
|
2016-11-17 14:58:33 -05:00
|
|
|
self.run_some_queries()
|
2019-06-25 16:34:48 -04:00
|
|
|
self.login("admin")
|
2016-11-17 14:58:33 -05:00
|
|
|
first_query_time = (
|
2019-06-25 16:34:48 -04:00
|
|
|
db.session.query(Query).filter_by(sql="SELECT * FROM ab_user").one()
|
2016-11-17 14:58:33 -05:00
|
|
|
).start_time
|
|
|
|
second_query_time = (
|
2019-06-25 16:34:48 -04:00
|
|
|
db.session.query(Query).filter_by(sql="SELECT * FROM ab_permission").one()
|
2016-11-17 14:58:33 -05:00
|
|
|
).start_time
|
|
|
|
# Test search queries on time filter
|
2019-06-25 16:34:48 -04:00
|
|
|
from_time = "from={}".format(int(first_query_time))
|
|
|
|
to_time = "to={}".format(int(second_query_time))
|
2016-11-17 14:58:33 -05:00
|
|
|
params = [from_time, to_time]
|
2019-06-25 16:34:48 -04:00
|
|
|
resp = self.get_resp("/superset/search_queries?" + "&".join(params))
|
2016-11-17 14:58:33 -05:00
|
|
|
data = json.loads(resp)
|
|
|
|
self.assertEquals(2, len(data))
|
2016-11-01 23:48:31 -04:00
|
|
|
|
2019-04-17 19:11:11 -04:00
|
|
|
def test_search_query_with_owner_only_perms(self) -> None:
|
|
|
|
"""
|
|
|
|
Test a search query with can_only_access_owned_queries perm added to
|
|
|
|
Admin and make sure only Admin queries show up.
|
|
|
|
"""
|
|
|
|
session = db.session
|
|
|
|
|
|
|
|
# Add can_only_access_owned_queries perm to Admin user
|
|
|
|
owned_queries_view = security_manager.find_permission_view_menu(
|
2019-06-25 16:34:48 -04:00
|
|
|
"can_only_access_owned_queries", "can_only_access_owned_queries"
|
2019-04-17 19:11:11 -04:00
|
|
|
)
|
|
|
|
security_manager.add_permission_role(
|
2019-06-25 16:34:48 -04:00
|
|
|
security_manager.find_role("Admin"), owned_queries_view
|
2019-04-17 19:11:11 -04:00
|
|
|
)
|
|
|
|
session.commit()
|
|
|
|
|
|
|
|
# Test search_queries for Admin user
|
|
|
|
self.run_some_queries()
|
2019-06-25 16:34:48 -04:00
|
|
|
self.login("admin")
|
2019-04-17 19:11:11 -04:00
|
|
|
|
2019-06-25 16:34:48 -04:00
|
|
|
user_id = security_manager.find_user("admin").id
|
|
|
|
data = self.get_json_resp("/superset/search_queries")
|
2019-04-17 19:11:11 -04:00
|
|
|
self.assertEquals(2, len(data))
|
2019-06-25 16:34:48 -04:00
|
|
|
user_ids = {k["userId"] for k in data}
|
2019-04-17 19:11:11 -04:00
|
|
|
self.assertEquals(set([user_id]), user_ids)
|
|
|
|
|
|
|
|
# Remove can_only_access_owned_queries from Admin
|
|
|
|
owned_queries_view = security_manager.find_permission_view_menu(
|
2019-06-25 16:34:48 -04:00
|
|
|
"can_only_access_owned_queries", "can_only_access_owned_queries"
|
2019-04-17 19:11:11 -04:00
|
|
|
)
|
|
|
|
security_manager.del_permission_role(
|
2019-06-25 16:34:48 -04:00
|
|
|
security_manager.find_role("Admin"), owned_queries_view
|
2019-04-17 19:11:11 -04:00
|
|
|
)
|
|
|
|
|
|
|
|
session.commit()
|
|
|
|
|
2016-12-01 22:53:23 -05:00
|
|
|
def test_alias_duplicate(self):
|
|
|
|
self.run_sql(
|
2019-06-25 16:34:48 -04:00
|
|
|
"SELECT username as col, id as col, username FROM ab_user",
|
|
|
|
client_id="2e2df3",
|
|
|
|
user_name="admin",
|
|
|
|
raise_on_error=True,
|
|
|
|
)
|
2016-12-01 22:53:23 -05:00
|
|
|
|
2018-01-23 23:58:06 -05:00
|
|
|
def test_df_conversion_no_dict(self):
|
2019-06-25 16:34:48 -04:00
|
|
|
cols = [["string_col", "string"], ["int_col", "int"], ["float_col", "float"]]
|
|
|
|
data = [["a", 4, 4.0]]
|
2018-06-28 00:35:12 -04:00
|
|
|
cdf = SupersetDataFrame(data, cols, BaseEngineSpec)
|
2018-03-19 14:43:04 -04:00
|
|
|
|
|
|
|
self.assertEquals(len(data), cdf.size)
|
|
|
|
self.assertEquals(len(cols), len(cdf.columns))
|
|
|
|
|
|
|
|
def test_df_conversion_tuple(self):
|
2019-06-25 16:34:48 -04:00
|
|
|
cols = ["string_col", "int_col", "list_col", "float_col"]
|
|
|
|
data = [(u"Text", 111, [123], 1.0)]
|
2018-06-28 00:35:12 -04:00
|
|
|
cdf = SupersetDataFrame(data, cols, BaseEngineSpec)
|
2018-01-23 23:58:06 -05:00
|
|
|
|
|
|
|
self.assertEquals(len(data), cdf.size)
|
|
|
|
self.assertEquals(len(cols), len(cdf.columns))
|
|
|
|
|
|
|
|
def test_df_conversion_dict(self):
|
2019-06-25 16:34:48 -04:00
|
|
|
cols = ["string_col", "dict_col", "int_col"]
|
|
|
|
data = [["a", {"c1": 1, "c2": 2, "c3": 3}, 4]]
|
2018-06-28 00:35:12 -04:00
|
|
|
cdf = SupersetDataFrame(data, cols, BaseEngineSpec)
|
2018-01-23 23:58:06 -05:00
|
|
|
|
|
|
|
self.assertEquals(len(data), cdf.size)
|
|
|
|
self.assertEquals(len(cols), len(cdf.columns))
|
|
|
|
|
2018-04-04 16:38:37 -04:00
|
|
|
def test_sqllab_viz(self):
|
|
|
|
payload = {
|
2019-06-25 16:34:48 -04:00
|
|
|
"chartType": "dist_bar",
|
|
|
|
"datasourceName": "test_viz_flow_table",
|
|
|
|
"schema": "superset",
|
|
|
|
"columns": [
|
|
|
|
{
|
|
|
|
"is_date": False,
|
|
|
|
"type": "STRING",
|
|
|
|
"name": "viz_type",
|
|
|
|
"is_dim": True,
|
|
|
|
},
|
|
|
|
{
|
|
|
|
"is_date": False,
|
|
|
|
"type": "OBJECT",
|
|
|
|
"name": "ccount",
|
|
|
|
"is_dim": True,
|
|
|
|
"agg": "sum",
|
|
|
|
},
|
|
|
|
],
|
|
|
|
"sql": """\
|
2018-04-04 16:38:37 -04:00
|
|
|
SELECT viz_type, count(1) as ccount
|
|
|
|
FROM slices
|
2018-07-21 15:01:26 -04:00
|
|
|
WHERE viz_type LIKE '%a%'
|
2018-04-04 16:38:37 -04:00
|
|
|
GROUP BY viz_type""",
|
2019-06-25 16:34:48 -04:00
|
|
|
"dbId": 1,
|
2018-04-04 16:38:37 -04:00
|
|
|
}
|
2019-06-25 16:34:48 -04:00
|
|
|
data = {"data": json.dumps(payload)}
|
|
|
|
resp = self.get_json_resp("/superset/sqllab_viz/", data=data)
|
|
|
|
self.assertIn("table_id", resp)
|
2018-04-04 16:38:37 -04:00
|
|
|
|
2018-11-07 18:57:44 -05:00
|
|
|
def test_sql_limit(self):
|
2019-06-25 16:34:48 -04:00
|
|
|
self.login("admin")
|
2018-11-07 18:57:44 -05:00
|
|
|
test_limit = 1
|
2019-06-25 16:34:48 -04:00
|
|
|
data = self.run_sql("SELECT * FROM ab_user", client_id="sql_limit_1")
|
|
|
|
self.assertGreater(len(data["data"]), test_limit)
|
2018-11-07 18:57:44 -05:00
|
|
|
data = self.run_sql(
|
2019-06-25 16:34:48 -04:00
|
|
|
"SELECT * FROM ab_user", client_id="sql_limit_2", query_limit=test_limit
|
|
|
|
)
|
|
|
|
self.assertEquals(len(data["data"]), test_limit)
|
2018-11-07 18:57:44 -05:00
|
|
|
data = self.run_sql(
|
2019-06-25 16:34:48 -04:00
|
|
|
"SELECT * FROM ab_user LIMIT {}".format(test_limit),
|
|
|
|
client_id="sql_limit_3",
|
|
|
|
query_limit=test_limit + 1,
|
|
|
|
)
|
|
|
|
self.assertEquals(len(data["data"]), test_limit)
|
2018-11-07 18:57:44 -05:00
|
|
|
data = self.run_sql(
|
2019-06-25 16:34:48 -04:00
|
|
|
"SELECT * FROM ab_user LIMIT {}".format(test_limit + 1),
|
|
|
|
client_id="sql_limit_4",
|
|
|
|
query_limit=test_limit,
|
|
|
|
)
|
|
|
|
self.assertEquals(len(data["data"]), test_limit)
|
2018-11-07 18:57:44 -05:00
|
|
|
|
2019-04-17 19:11:11 -04:00
|
|
|
def test_queryview_filter(self) -> None:
|
|
|
|
"""
|
|
|
|
Test queryview api without can_only_access_owned_queries perm added to
|
|
|
|
Admin and make sure all queries show up.
|
|
|
|
"""
|
|
|
|
self.run_some_queries()
|
2019-06-25 16:34:48 -04:00
|
|
|
self.login(username="admin")
|
2019-04-17 19:11:11 -04:00
|
|
|
|
2019-06-25 16:34:48 -04:00
|
|
|
url = "/queryview/api/read"
|
2019-04-17 19:11:11 -04:00
|
|
|
data = self.get_json_resp(url)
|
2019-06-25 16:34:48 -04:00
|
|
|
admin = security_manager.find_user("admin")
|
|
|
|
gamma_sqllab = security_manager.find_user("gamma_sqllab")
|
|
|
|
self.assertEquals(3, len(data["result"]))
|
|
|
|
user_queries = [result.get("username") for result in data["result"]]
|
2019-04-17 19:11:11 -04:00
|
|
|
assert admin.username in user_queries
|
|
|
|
assert gamma_sqllab.username in user_queries
|
|
|
|
|
|
|
|
def test_queryview_filter_owner_only(self) -> None:
|
|
|
|
"""
|
|
|
|
Test queryview api with can_only_access_owned_queries perm added to
|
|
|
|
Admin and make sure only Admin queries show up.
|
|
|
|
"""
|
|
|
|
session = db.session
|
|
|
|
|
|
|
|
# Add can_only_access_owned_queries perm to Admin user
|
|
|
|
owned_queries_view = security_manager.find_permission_view_menu(
|
2019-06-25 16:34:48 -04:00
|
|
|
"can_only_access_owned_queries", "can_only_access_owned_queries"
|
2019-04-17 19:11:11 -04:00
|
|
|
)
|
|
|
|
security_manager.add_permission_role(
|
2019-06-25 16:34:48 -04:00
|
|
|
security_manager.find_role("Admin"), owned_queries_view
|
2019-04-17 19:11:11 -04:00
|
|
|
)
|
|
|
|
session.commit()
|
|
|
|
|
|
|
|
# Test search_queries for Admin user
|
|
|
|
self.run_some_queries()
|
2019-06-25 16:34:48 -04:00
|
|
|
self.login("admin")
|
2019-04-17 19:11:11 -04:00
|
|
|
|
2019-06-25 16:34:48 -04:00
|
|
|
url = "/queryview/api/read"
|
2019-04-17 19:11:11 -04:00
|
|
|
data = self.get_json_resp(url)
|
2019-06-25 16:34:48 -04:00
|
|
|
admin = security_manager.find_user("admin")
|
|
|
|
self.assertEquals(2, len(data["result"]))
|
|
|
|
all_admin_user_queries = all(
|
|
|
|
[result.get("username") == admin.username for result in data["result"]]
|
|
|
|
)
|
2019-04-17 19:11:11 -04:00
|
|
|
assert all_admin_user_queries is True
|
|
|
|
|
|
|
|
# Remove can_only_access_owned_queries from Admin
|
|
|
|
owned_queries_view = security_manager.find_permission_view_menu(
|
2019-06-25 16:34:48 -04:00
|
|
|
"can_only_access_owned_queries", "can_only_access_owned_queries"
|
2019-04-17 19:11:11 -04:00
|
|
|
)
|
|
|
|
security_manager.del_permission_role(
|
2019-06-25 16:34:48 -04:00
|
|
|
security_manager.find_role("Admin"), owned_queries_view
|
2019-04-17 19:11:11 -04:00
|
|
|
)
|
|
|
|
|
|
|
|
session.commit()
|
|
|
|
|
2016-11-01 23:48:31 -04:00
|
|
|
|
2019-06-25 16:34:48 -04:00
|
|
|
if __name__ == "__main__":
|
2016-11-01 23:48:31 -04:00
|
|
|
unittest.main()
|