mirror of https://github.com/apache/superset.git
Make edit / add / delete perms available to all users. (#1722)
* Make edit / add / delete perms available to all users. * Add tests and restrict from editing the datasources.
This commit is contained in:
parent
32fc0ff6d0
commit
e822d5a1b7
|
@ -15,6 +15,19 @@ READ_ONLY_MODELVIEWS = {
|
||||||
'DatabaseView',
|
'DatabaseView',
|
||||||
'DruidClusterModelView',
|
'DruidClusterModelView',
|
||||||
}
|
}
|
||||||
|
|
||||||
|
GAMMA_READ_ONLY_MODELVIEWS = {
|
||||||
|
'ColumnInlineView',
|
||||||
|
'SqlMetricInlineView',
|
||||||
|
'TableColumnInlineView',
|
||||||
|
'TableModelView',
|
||||||
|
'DatasourceModelView',
|
||||||
|
'DruidColumnInlineView',
|
||||||
|
'MetricInlineView',
|
||||||
|
'DruidDatasourceModelView',
|
||||||
|
'DruidMetricInlineView',
|
||||||
|
} | READ_ONLY_MODELVIEWS
|
||||||
|
|
||||||
ADMIN_ONLY_VIEW_MENUES = {
|
ADMIN_ONLY_VIEW_MENUES = {
|
||||||
'AccessRequestsModelView',
|
'AccessRequestsModelView',
|
||||||
'Manage',
|
'Manage',
|
||||||
|
@ -45,11 +58,6 @@ READ_ONLY_PERMISSION = {
|
||||||
}
|
}
|
||||||
|
|
||||||
ALPHA_ONLY_PERMISSIONS = set([
|
ALPHA_ONLY_PERMISSIONS = set([
|
||||||
'can_add',
|
|
||||||
'can_download',
|
|
||||||
'can_delete',
|
|
||||||
'can_edit',
|
|
||||||
'can_save',
|
|
||||||
'datasource_access',
|
'datasource_access',
|
||||||
'schema_access',
|
'schema_access',
|
||||||
'database_access',
|
'database_access',
|
||||||
|
@ -59,6 +67,10 @@ ALPHA_ONLY_PERMISSIONS = set([
|
||||||
READ_ONLY_PRODUCT = set(
|
READ_ONLY_PRODUCT = set(
|
||||||
product(READ_ONLY_PERMISSION, READ_ONLY_MODELVIEWS))
|
product(READ_ONLY_PERMISSION, READ_ONLY_MODELVIEWS))
|
||||||
|
|
||||||
|
GAMMA_READ_ONLY_PRODUCT = set(
|
||||||
|
product(READ_ONLY_PERMISSION, GAMMA_READ_ONLY_MODELVIEWS))
|
||||||
|
|
||||||
|
|
||||||
OBJECT_SPEC_PERMISSIONS = set([
|
OBJECT_SPEC_PERMISSIONS = set([
|
||||||
'database_access',
|
'database_access',
|
||||||
'schema_access',
|
'schema_access',
|
||||||
|
@ -147,10 +159,12 @@ def sync_role_definitions():
|
||||||
if (
|
if (
|
||||||
(
|
(
|
||||||
p.view_menu.name not in ADMIN_ONLY_VIEW_MENUES and
|
p.view_menu.name not in ADMIN_ONLY_VIEW_MENUES and
|
||||||
|
p.view_menu.name not in GAMMA_READ_ONLY_MODELVIEWS and
|
||||||
p.permission.name not in ADMIN_ONLY_PERMISSIONS and
|
p.permission.name not in ADMIN_ONLY_PERMISSIONS and
|
||||||
p.permission.name not in ALPHA_ONLY_PERMISSIONS
|
p.permission.name not in ALPHA_ONLY_PERMISSIONS
|
||||||
) or
|
) or
|
||||||
(p.permission.name, p.view_menu.name) in READ_ONLY_PRODUCT
|
(p.permission.name, p.view_menu.name) in
|
||||||
|
GAMMA_READ_ONLY_PRODUCT
|
||||||
):
|
):
|
||||||
sm.add_permission_role(gamma, p)
|
sm.add_permission_role(gamma, p)
|
||||||
if PUBLIC_ROLE_LIKE_GAMMA:
|
if PUBLIC_ROLE_LIKE_GAMMA:
|
||||||
|
|
|
@ -25,10 +25,10 @@ class SupersetTestCase(unittest.TestCase):
|
||||||
|
|
||||||
def __init__(self, *args, **kwargs):
|
def __init__(self, *args, **kwargs):
|
||||||
if (
|
if (
|
||||||
self.requires_examples and
|
self.requires_examples and
|
||||||
not os.environ.get('SOLO_TEST') and
|
not os.environ.get('SOLO_TEST') and
|
||||||
not os.environ.get('examples_loaded')
|
not os.environ.get('examples_loaded')
|
||||||
):
|
):
|
||||||
logging.info("Loading examples")
|
logging.info("Loading examples")
|
||||||
cli.load_examples(load_test_data=True)
|
cli.load_examples(load_test_data=True)
|
||||||
logging.info("Done loading examples")
|
logging.info("Done loading examples")
|
||||||
|
@ -95,7 +95,6 @@ class SupersetTestCase(unittest.TestCase):
|
||||||
session.add(druid_datasource2)
|
session.add(druid_datasource2)
|
||||||
session.commit()
|
session.commit()
|
||||||
|
|
||||||
|
|
||||||
def get_or_create(self, cls, criteria, session):
|
def get_or_create(self, cls, criteria, session):
|
||||||
obj = session.query(cls).filter_by(**criteria).first()
|
obj = session.query(cls).filter_by(**criteria).first()
|
||||||
if not obj:
|
if not obj:
|
||||||
|
@ -118,8 +117,8 @@ class SupersetTestCase(unittest.TestCase):
|
||||||
session = db.create_scoped_session()
|
session = db.create_scoped_session()
|
||||||
query = (
|
query = (
|
||||||
session.query(models.Query)
|
session.query(models.Query)
|
||||||
.order_by(models.Query.id.desc())
|
.order_by(models.Query.id.desc())
|
||||||
.first()
|
.first()
|
||||||
)
|
)
|
||||||
session.close()
|
session.close()
|
||||||
return query
|
return query
|
||||||
|
@ -127,8 +126,8 @@ class SupersetTestCase(unittest.TestCase):
|
||||||
def get_slice(self, slice_name, session):
|
def get_slice(self, slice_name, session):
|
||||||
slc = (
|
slc = (
|
||||||
session.query(models.Slice)
|
session.query(models.Slice)
|
||||||
.filter_by(slice_name=slice_name)
|
.filter_by(slice_name=slice_name)
|
||||||
.one()
|
.one()
|
||||||
)
|
)
|
||||||
session.expunge_all()
|
session.expunge_all()
|
||||||
return slc
|
return slc
|
||||||
|
@ -159,21 +158,21 @@ class SupersetTestCase(unittest.TestCase):
|
||||||
def get_main_database(self, session):
|
def get_main_database(self, session):
|
||||||
return (
|
return (
|
||||||
db.session.query(models.Database)
|
db.session.query(models.Database)
|
||||||
.filter_by(database_name='main')
|
.filter_by(database_name='main')
|
||||||
.first()
|
.first()
|
||||||
)
|
)
|
||||||
|
|
||||||
def get_access_requests(self, username, ds_type, ds_id):
|
def get_access_requests(self, username, ds_type, ds_id):
|
||||||
DAR = models.DatasourceAccessRequest
|
DAR = models.DatasourceAccessRequest
|
||||||
return (
|
return (
|
||||||
db.session.query(DAR)
|
db.session.query(DAR)
|
||||||
.filter(
|
.filter(
|
||||||
DAR.created_by == sm.find_user(username=username),
|
DAR.created_by == sm.find_user(username=username),
|
||||||
DAR.datasource_type == ds_type,
|
DAR.datasource_type == ds_type,
|
||||||
DAR.datasource_id == ds_id,
|
DAR.datasource_id == ds_id,
|
||||||
)
|
)
|
||||||
.first()
|
.first()
|
||||||
)
|
)
|
||||||
|
|
||||||
def logout(self):
|
def logout(self):
|
||||||
self.client.get('/logout/', follow_redirects=True)
|
self.client.get('/logout/', follow_redirects=True)
|
||||||
|
@ -205,3 +204,56 @@ class SupersetTestCase(unittest.TestCase):
|
||||||
client_id=client_id),
|
client_id=client_id),
|
||||||
)
|
)
|
||||||
return resp
|
return resp
|
||||||
|
|
||||||
|
def test_gamma_permissions(self):
|
||||||
|
def assert_can_read(view_menu):
|
||||||
|
self.assertIn(('can_show', view_menu), gamma_perm_set)
|
||||||
|
self.assertIn(('can_list', view_menu), gamma_perm_set)
|
||||||
|
|
||||||
|
def assert_can_write(view_menu):
|
||||||
|
self.assertIn(('can_add', view_menu), gamma_perm_set)
|
||||||
|
self.assertIn(('can_download', view_menu), gamma_perm_set)
|
||||||
|
self.assertIn(('can_delete', view_menu), gamma_perm_set)
|
||||||
|
self.assertIn(('can_edit', view_menu), gamma_perm_set)
|
||||||
|
|
||||||
|
def assert_cannot_write(view_menu):
|
||||||
|
self.assertNotIn(('can_add', view_menu), gamma_perm_set)
|
||||||
|
self.assertNotIn(('can_download', view_menu), gamma_perm_set)
|
||||||
|
self.assertNotIn(('can_delete', view_menu), gamma_perm_set)
|
||||||
|
self.assertNotIn(('can_edit', view_menu), gamma_perm_set)
|
||||||
|
self.assertNotIn(('can_save', view_menu), gamma_perm_set)
|
||||||
|
|
||||||
|
def assert_can_all(view_menu):
|
||||||
|
assert_can_read(view_menu)
|
||||||
|
assert_can_write(view_menu)
|
||||||
|
|
||||||
|
gamma_perm_set = set()
|
||||||
|
for perm in sm.find_role('Gamma').permissions:
|
||||||
|
gamma_perm_set.add((perm.permission.name, perm.view_menu.name))
|
||||||
|
|
||||||
|
# check read only perms
|
||||||
|
assert_can_read('TableModelView')
|
||||||
|
assert_cannot_write('DruidColumnInlineView')
|
||||||
|
|
||||||
|
# make sure that user can create slices and dashboards
|
||||||
|
assert_can_all('SliceModelView')
|
||||||
|
assert_can_all('DashboardModelView')
|
||||||
|
|
||||||
|
self.assertIn(('can_add_slices', 'Superset'), gamma_perm_set)
|
||||||
|
self.assertIn(('can_copy_dash', 'Superset'), gamma_perm_set)
|
||||||
|
self.assertIn(('can_activity_per_day', 'Superset'), gamma_perm_set)
|
||||||
|
self.assertIn(('can_created_dashboards', 'Superset'), gamma_perm_set)
|
||||||
|
self.assertIn(('can_created_slices', 'Superset'), gamma_perm_set)
|
||||||
|
self.assertIn(('can_csv', 'Superset'), gamma_perm_set)
|
||||||
|
self.assertIn(('can_dashboard', 'Superset'), gamma_perm_set)
|
||||||
|
self.assertIn(('can_explore', 'Superset'), gamma_perm_set)
|
||||||
|
self.assertIn(('can_explore_json', 'Superset'), gamma_perm_set)
|
||||||
|
self.assertIn(('can_fave_dashboards', 'Superset'), gamma_perm_set)
|
||||||
|
self.assertIn(('can_fave_slices', 'Superset'), gamma_perm_set)
|
||||||
|
self.assertIn(('can_save_dash', 'Superset'), gamma_perm_set)
|
||||||
|
self.assertIn(('can_slice', 'Superset'), gamma_perm_set)
|
||||||
|
self.assertIn(('can_update_explore', 'Superset'), gamma_perm_set)
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue