Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: RLS for SQL Lab #19999

Merged
merged 6 commits into from
May 12, 2022
Merged

feat: RLS for SQL Lab #19999

merged 6 commits into from
May 12, 2022

Conversation

betodealmeida
Copy link
Member

@betodealmeida betodealmeida commented May 9, 2022

SUMMARY

Add a new feature flag RLS_IN_SQLLAB that when enabled will make Superset apply relevant RLS rules to queries ran in SQL Lab.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

Created a simple RLS on bart_lines:

Screenshot 2022-05-09 at 11-38-25 Superset

Confirmed that it works in Explore, as expected:

Screenshot 2022-05-09 at 11-38-45 Explore - bart_lines

Ran query in SQL Lab, RLS is also applied:

Screenshot 2022-05-09 at 11-39-07 Superset

TESTING INSTRUCTIONS

WIP

ADDITIONAL INFORMATION

  • Has associated issue:
  • Required feature flags:
  • Changes UI
  • Includes DB Migration (follow approval process in SIP-59)
    • Migration is atomic, supports rollback & is backwards-compatible
    • Confirm DB migration upgrade and downgrade tested
    • Runtime estimates and downtime expectations provided
  • Introduces new feature or API
  • Removes existing feature or API

@codecov
Copy link

codecov bot commented May 9, 2022

Codecov Report

Merging #19999 (aef0026) into master (62e1c34) will decrease coverage by 0.13%.
The diff coverage is 85.97%.

❗ Current head aef0026 differs from pull request most recent head 14848ac. Consider uploading reports for the commit 14848ac to get more accurate results

@@            Coverage Diff             @@
##           master   #19999      +/-   ##
==========================================
- Coverage   66.28%   66.15%   -0.14%     
==========================================
  Files        1712     1713       +1     
  Lines       63968    64071     +103     
  Branches     6731     6731              
==========================================
- Hits        42404    42386      -18     
- Misses      19853    19974     +121     
  Partials     1711     1711              
Flag Coverage Δ
hive ?
mysql 82.04% <95.83%> (+0.04%) ⬆️
postgres 82.10% <97.50%> (+0.05%) ⬆️
presto ?
python 82.14% <97.50%> (-0.34%) ⬇️
sqlite ?
unit ?

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files Coverage Δ
.../plugin-chart-echarts/src/Funnel/transformProps.ts 71.73% <ø> (ø)
...lugins/plugin-chart-echarts/src/Gauge/constants.ts 100.00% <ø> (ø)
...hart-echarts/src/MixedTimeseries/transformProps.ts 0.00% <0.00%> (ø)
...ins/plugin-chart-echarts/src/Pie/transformProps.ts 55.07% <ø> (ø)
...s/plugin-chart-echarts/src/Radar/transformProps.ts 0.00% <ø> (ø)
...plugin-chart-echarts/src/Treemap/transformProps.ts 51.51% <ø> (ø)
...ns/plugin-chart-word-cloud/src/chart/WordCloud.tsx 0.00% <0.00%> (ø)
...ins/preset-chart-xy/src/components/Line/Encoder.ts 100.00% <ø> (ø)
superset-frontend/src/SqlLab/actions/sqlLab.js 60.39% <0.00%> (ø)
...rc/SqlLab/components/ScheduleQueryButton/index.tsx 20.75% <0.00%> (ø)
... and 110 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 62e1c34...14848ac. Read the comment docs.

superset/sql_lab.py Outdated Show resolved Hide resolved
superset/sql_lab.py Outdated Show resolved Hide resolved
parsed_query = ParsedQuery(sql_statement)
if is_feature_enabled("RLS_IN_SQLLAB"):
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the core of the PR, the rest is just passing username around.

elif username:
user = self.find_user(username=username)
else:
return []
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nice if flip, less indentation

Copy link
Member

@villebro villebro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

One minor docstring comment. Also, would be nice to have at least minimal tests for this, as this is a fairly central security feature. If it's a lot of work, which I assume it is, I can try to help out!

self, template_processor: BaseTemplateProcessor
self,
template_processor: BaseTemplateProcessor,
username: Optional[str] = None,
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: username is missing in the docstring here and in security_manager.get_rls_filters. The main description says it retrieves rls filters for "the current user" - we should perhaps remove that text from both docstrings and state that if username is missing, it will fall back to the current user.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah, good catch and good point, @villebro! Let me fix the docstrings and add tests.

Copy link
Member

@villebro villebro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM with a very minor non-blocking nit. This is really great, as it will open up SQL Lab to RLS users 🚀

superset/connectors/sqla/models.py Outdated Show resolved Hide resolved
@betodealmeida betodealmeida merged commit f2881e5 into apache:master May 12, 2022
philipher29 pushed a commit to ValtechMobility/superset that referenced this pull request Jun 9, 2022
* feat: RLS for SQL Lab

* Small fixes

* Pass username to security manager

* Update docstrings

* Add tests

* Remove type from docstring
@mistercrunch mistercrunch added 🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels 🚢 2.0.0 labels Mar 13, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels size/L 🚢 2.0.0
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants