QT/superset2
1
0
Fork 0
mirror of https://github.com/apache/superset.git synced 2026-04-20 08:34:37 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: shut off unneeded endpoints (#8960)

Browse Source 
* fix: shut off all uneeded endpoints

We recently added a new feature to FAB allowing to whitelist the needed
endpoints in ModelView and ModelRestApi.

First, we set our base wrapper class to an empty set, forcing each
class inheriting from it to explicitely turn on the endpoints that
Superset intends to use.

Second, we go ModelView by ModelView to whitelist the actual endpoints
used in the app.

Notes:
* as a result a large set of [unneeded] permissions should be cleaned up
* outside of the "private" use of endpoints in the app, people that have
  been using endpoints in their environment for other purposes may
  experience loss of functionality

* Tweaking

* Reduce the amount of endpoints using white lists

* Fix, included needed endpoints for dashboard and druid

* Drying things up

* fixes

* limiting more endpoints

* Read only on some FAB model views

* fixing some tests

* fixes

* Fixing more tests

* Addressing comments

* Drying up route_methods

* further drying

Co-authored-by: Daniel Vaz Gaspar <danielvazgaspar@gmail.com>
This commit is contained in:
Maxime Beauchemin
2020-01-23 11:25:15 -05:00
committed by GitHub
parent 22699a204d
commit 315a11dfe2
25 changed files with 176 additions and 190 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
tests/security_tests.py
View File

@@ -486,14 +486,6 @@ class RolePermissionTests(SupersetTestCase):
example_db.expose_in_sqllab = True
session.commit()
OLD_FLASK_GET_SQL_DBS_REQUEST = (
"databaseasync/api/read?_flt_0_expose_in_sqllab=1&"
"_oc_DatabaseAsync=database_name&_od_DatabaseAsync=asc"
)
self.login(username="gamma")
databases_json = self.client.get(OLD_FLASK_GET_SQL_DBS_REQUEST).json
self.assertEquals(databases_json["count"], 1)
arguments = {
"keys": ["none"],
"filters": [{"col": "expose_in_sqllab", "opr": "eq", "value": True}],
@@ -509,18 +501,15 @@ class RolePermissionTests(SupersetTestCase):
self.logout()
def assert_can_read(self, view_menu, permissions_set):
self.assertIn(("can_show", view_menu), permissions_set)
self.assertIn(("can_list", view_menu), permissions_set)
def assert_can_write(self, view_menu, permissions_set):
self.assertIn(("can_add", view_menu), permissions_set)
self.assertIn(("can_download", view_menu), permissions_set)
self.assertIn(("can_delete", view_menu), permissions_set)
self.assertIn(("can_edit", view_menu), permissions_set)
def assert_cannot_write(self, view_menu, permissions_set):
self.assertNotIn(("can_add", view_menu), permissions_set)
self.assertNotIn(("can_download", view_menu), permissions_set)
self.assertNotIn(("can_delete", view_menu), permissions_set)
self.assertNotIn(("can_edit", view_menu), permissions_set)
self.assertNotIn(("can_save", view_menu), permissions_set)
@@ -530,7 +519,6 @@ class RolePermissionTests(SupersetTestCase):
self.assert_can_write(view_menu, permissions_set)
def assert_can_gamma(self, perm_set):
self.assert_can_read("DatabaseAsync", perm_set)
self.assert_can_read("TableModelView", perm_set)
# make sure that user can create slices and dashboards
@@ -554,8 +542,6 @@ class RolePermissionTests(SupersetTestCase):
self.assertIn(("can_userinfo", "UserDBModelView"), perm_set)
def assert_can_alpha(self, perm_set):
self.assert_can_all("SqlMetricInlineView", perm_set)
self.assert_can_all("TableColumnInlineView", perm_set)
self.assert_can_all("TableModelView", perm_set)
self.assertIn(("all_datasource_access", "all_datasource_access"), perm_set)
@@ -569,7 +555,6 @@ class RolePermissionTests(SupersetTestCase):
self.assert_cannot_write("UserDBModelView", perm_set)
def assert_can_admin(self, perm_set):
self.assert_can_read("DatabaseAsync", perm_set)
self.assert_can_all("DatabaseView", perm_set)
self.assert_can_all("RoleModelView", perm_set)
self.assert_can_all("UserDBModelView", perm_set)
@@ -583,7 +568,7 @@ class RolePermissionTests(SupersetTestCase):
def test_is_admin_only(self):
self.assertFalse(
security_manager._is_admin_only(
security_manager.find_permission_view_menu("can_show", "TableModelView")
security_manager.find_permission_view_menu("can_list", "TableModelView")
)
)
self.assertFalse(
@@ -603,7 +588,7 @@ class RolePermissionTests(SupersetTestCase):
self.assertTrue(
security_manager._is_admin_only(
security_manager.find_permission_view_menu(
"can_show", "AccessRequestsModelView"
"can_list", "AccessRequestsModelView"
)
)
)
@@ -626,7 +611,7 @@ class RolePermissionTests(SupersetTestCase):
def test_is_alpha_only(self):
self.assertFalse(
security_manager._is_alpha_only(
security_manager.find_permission_view_menu("can_show", "TableModelView")
security_manager.find_permission_view_menu("can_list", "TableModelView")
)
)
@@ -644,13 +629,6 @@ class RolePermissionTests(SupersetTestCase):
)
)
)
self.assertTrue(
security_manager._is_alpha_only(
security_manager.find_permission_view_menu(
"can_edit", "SqlMetricInlineView"
)
)
)
self.assertTrue(
security_manager._is_alpha_only(
security_manager.find_permission_view_menu(
@@ -662,7 +640,7 @@ class RolePermissionTests(SupersetTestCase):
def test_is_gamma_pvm(self):
self.assertTrue(
security_manager._is_gamma_pvm(
security_manager.find_permission_view_menu("can_show", "TableModelView")
security_manager.find_permission_view_menu("can_list", "TableModelView")
)
)
@@ -674,9 +652,10 @@ class RolePermissionTests(SupersetTestCase):
SupersetTestCase.is_module_installed("pydruid"), "pydruid not installed"
)
def test_alpha_permissions(self):
self.assert_can_gamma(get_perm_tuples("Alpha"))
self.assert_can_alpha(get_perm_tuples("Alpha"))
self.assert_cannot_alpha(get_perm_tuples("Alpha"))
alpha_perm_tuples = get_perm_tuples("Alpha")
self.assert_can_gamma(alpha_perm_tuples)
self.assert_can_alpha(alpha_perm_tuples)
self.assert_cannot_alpha(alpha_perm_tuples)
@unittest.skipUnless(
SupersetTestCase.is_module_installed("pydruid"), "pydruid not installed"
@@ -703,18 +682,15 @@ class RolePermissionTests(SupersetTestCase):
def test_gamma_permissions(self):
def assert_can_read(view_menu):
self.assertIn(("can_show", view_menu), gamma_perm_set)
self.assertIn(("can_list", view_menu), gamma_perm_set)
def assert_can_write(view_menu):
self.assertIn(("can_add", view_menu), gamma_perm_set)
self.assertIn(("can_download", view_menu), gamma_perm_set)
self.assertIn(("can_delete", view_menu), gamma_perm_set)
self.assertIn(("can_edit", view_menu), gamma_perm_set)
def assert_cannot_write(view_menu):
self.assertNotIn(("can_add", view_menu), gamma_perm_set)
self.assertNotIn(("can_download", view_menu), gamma_perm_set)
self.assertNotIn(("can_delete", view_menu), gamma_perm_set)
self.assertNotIn(("can_edit", view_menu), gamma_perm_set)
self.assertNotIn(("can_save", view_menu), gamma_perm_set)