feat(dashboard_rbac): dashboard lists

superset/config.py

@@ -343,6 +343,7 @@ def _try_json_readsha(  # pylint: disable=unused-argument
     "ALERT_REPORTS": False,
     # Enable experimental feature to search for other dashboards
     "OMNIBAR": False,
+    "DASHBOARD_RBAC": False,
 }
 
 # Set the default view to card/grid view if thumbnail support is enabled.

superset/dashboards/filters.py

@@ -16,15 +16,16 @@
 # under the License.
 from typing import Any
 
+from flask_appbuilder.security.sqla.models import Role
 from flask_babel import lazy_gettext as _
 from sqlalchemy import and_, or_
 from sqlalchemy.orm.query import Query
 
-from superset import db, security_manager
+from superset import db, is_feature_enabled, security_manager
 from superset.models.core import FavStar
 from superset.models.dashboard import Dashboard
 from superset.models.slice import Slice
-from superset.views.base import BaseFilter, is_user_admin
+from superset.views.base import BaseFilter, get_user_roles, is_user_admin
 from superset.views.base_api import BaseFavoriteFilter
 
 
@@ -74,12 +75,19 @@ def apply(self, query: Query, value: Any) -> Query:
 
         datasource_perms = security_manager.user_view_menu_names("datasource_access")
         schema_perms = security_manager.user_view_menu_names("schema_access")
-        published_dash_query = (
+
+        is_rbac_disabled_filter = []
+        dashboard_has_roles = Dashboard.roles.any()
+        if is_feature_enabled("DASHBOARD_RBAC"):
+            is_rbac_disabled_filter.append(~dashboard_has_roles)
+
+        datasource_perm_query = (
             db.session.query(Dashboard.id)
             .join(Dashboard.slices)
             .filter(
                 and_(
-                    Dashboard.published == True,  # pylint: disable=singleton-comparison
+                    Dashboard.published.is_(True),
+                    *is_rbac_disabled_filter,
                     or_(
                         Slice.perm.in_(datasource_perms),
                         Slice.schema_perm.in_(schema_perms),
@@ -104,11 +112,29 @@ def apply(self, query: Query, value: Any) -> Query:
             )
         )
 
+        dashboard_rbac_or_filters = []
+        if is_feature_enabled("DASHBOARD_RBAC"):
+            roles_based_query = (
+                db.session.query(Dashboard.id)
+                    .join(Dashboard.roles)
+                    .filter(
+                    and_(
+                        Dashboard.published.is_(True),
+                        dashboard_has_roles,
+                        Role.id.in_([x.id for x in get_user_roles()]),
+                    ),
+                )
+            )
+
+            dashboard_rbac_or_filters.append(Dashboard.id.in_(roles_based_query))
+
+
         query = query.filter(
             or_(
                 Dashboard.id.in_(owner_ids_query),
-                Dashboard.id.in_(published_dash_query),
+                Dashboard.id.in_(datasource_perm_query),
                 Dashboard.id.in_(users_favorite_dash_query),
+                *dashboard_rbac_or_filters,
             )
         )
 

superset/migrations/versions/11ccdd12658_add_roles_relationship_to_dashboard.py

@@ -0,0 +1,42 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+"""add roles relationship to dashboard
+Revision ID: e11ccdd12658
+Revises: 260bf0649a77
+Create Date: 2021-01-14 19:12:43.406230
+"""
+# revision identifiers, used by Alembic.
+revision = "e11ccdd12658"
+down_revision = "260bf0649a77"
+import sqlalchemy as sa
+from alembic import op
+
+
+def upgrade():
+    op.create_table(
+        "dashboard_roles",
+        sa.Column("id", sa.Integer(), nullable=False),
+        sa.Column("role_id", sa.Integer(), nullable=False),
+        sa.Column("dashboard_id", sa.Integer(), nullable=True),
+        sa.ForeignKeyConstraint(["dashboard_id"], ["dashboards.id"]),
+        sa.ForeignKeyConstraint(["role_id"], ["ab_role.id"]),
+        sa.PrimaryKeyConstraint("id"),
+    )
+
+
+def downgrade():
+    op.drop_table("dashboard_roles")

superset/models/dashboard.py

@@ -115,6 +115,15 @@ def copy_dashboard(
 )
 
 
+DashboardRoles = Table(
+    "dashboard_roles",
+    metadata,
+    Column("id", Integer, primary_key=True),
+    Column("dashboard_id", Integer, ForeignKey("dashboards.id"), nullable=False),
+    Column("role_id", Integer, ForeignKey("ab_role.id"), nullable=False),
+)
+
+
 class Dashboard(  # pylint: disable=too-many-instance-attributes
     Model, AuditMixinNullable, ImportExportMixin
 ):
@@ -132,7 +141,7 @@ class Dashboard(  # pylint: disable=too-many-instance-attributes
     slices = relationship(Slice, secondary=dashboard_slices, backref="dashboards")
     owners = relationship(security_manager.user_model, secondary=dashboard_user)
     published = Column(Boolean, default=False)
-
+    roles = relationship(security_manager.role_model, secondary=DashboardRoles)
     export_fields = [
         "dashboard_title",
         "position_json",

superset/views/dashboard/mixin.py

@@ -33,6 +33,7 @@ class DashboardMixin:  # pylint: disable=too-few-public-methods
         "dashboard_title",
         "slug",
         "owners",
+        "roles",
         "position_json",
         "css",
         "json_metadata",
@@ -62,6 +63,12 @@ class DashboardMixin:  # pylint: disable=too-few-public-methods
             "want to alter specific parameters."
         ),
         "owners": _("Owners is a list of users who can alter the dashboard."),
+        "roles": _(
+            "Roles is a list which defines access to the dashboard. "
+            "These roles are always applied in addition to restrictions on dataset "
+            "level access. "
+            "If no roles defined then the dashboard is available to all roles."
+        ),
         "published": _(
             "Determines whether or not this dashboard is "
             "visible in the list of all dashboards"
@@ -74,6 +81,7 @@ class DashboardMixin:  # pylint: disable=too-few-public-methods
         "slug": _("Slug"),
         "charts": _("Charts"),
         "owners": _("Owners"),
+        "roles": _("Roles"),
         "published": _("Published"),
         "creator": _("Creator"),
         "modified": _("Modified"),

tests/base_tests.py

@@ -111,7 +111,6 @@ def logged_in_admin():
 
 
 class SupersetTestCase(TestCase):
-
     default_schema_backend_map = {
         "sqlite": "main",
         "mysql": "superset",
@@ -135,7 +134,9 @@ def get_birth_names_dataset():
         )
 
     @staticmethod
-    def create_user_with_roles(username: str, roles: List[str]):
+    def create_user_with_roles(
+        username: str, roles: List[str], should_create_roles: bool = False
+    ):
         user_to_create = security_manager.find_user(username)
         if not user_to_create:
             security_manager.add_user(
@@ -149,7 +150,12 @@ def create_user_with_roles(username: str, roles: List[str]):
             db.session.commit()
             user_to_create = security_manager.find_user(username)
             assert user_to_create
-        user_to_create.roles = [security_manager.find_role(r) for r in roles]
+        user_to_create.roles = []
+        for chosen_user_role in roles:
+            if should_create_roles:
+                ## copy role from gamma but without data permissions
+                security_manager.copy_role("Gamma", chosen_user_role, merge=False)
+            user_to_create.roles.append(security_manager.find_role(chosen_user_role))
         db.session.commit()
         return user_to_create
 
@@ -290,18 +296,26 @@ def logout(self):
         self.client.get("/logout/", follow_redirects=True)
 
     def grant_public_access_to_table(self, table):
-        public_role = security_manager.find_role("Public")
+        role_name = "Public"
+        self.grant_role_access_to_table(table, role_name)
+
+    def grant_role_access_to_table(self, table, role_name):
+        role = security_manager.find_role(role_name)
         perms = db.session.query(ab_models.PermissionView).all()
         for perm in perms:
             if (
                 perm.permission.name == "datasource_access"
                 and perm.view_menu
                 and table.perm in perm.view_menu.name
             ):
-                security_manager.add_permission_role(public_role, perm)
+                security_manager.add_permission_role(role, perm)
 
     def revoke_public_access_to_table(self, table):
-        public_role = security_manager.find_role("Public")
+        role_name = "Public"
+        self.revoke_role_access_to_table(role_name, table)
+
+    def revoke_role_access_to_table(self, role_name, table):
+        public_role = security_manager.find_role(role_name)
         perms = db.session.query(ab_models.PermissionView).all()
         for perm in perms:
             if (

tests/dashboard_tests.py

@@ -453,24 +453,6 @@ def test_only_owners_can_save(self):
         db.session.commit()
         self.test_save_dash("alpha")
 
-    def test_owners_can_view_empty_dashboard(self):
-        dash = db.session.query(Dashboard).filter_by(slug="empty_dashboard").first()
-        if not dash:
-            dash = Dashboard()
-            dash.dashboard_title = "Empty Dashboard"
-            dash.slug = "empty_dashboard"
-        else:
-            dash.slices = []
-            dash.owners = []
-        db.session.merge(dash)
-        db.session.commit()
-
-        gamma_user = security_manager.find_user("gamma")
-        self.login(gamma_user.username)
-
-        resp = self.get_resp("/api/v1/dashboard/")
-        self.assertNotIn("/superset/dashboard/empty_dashboard/", resp)
-
     @pytest.mark.usefixtures("load_energy_table_with_slice", "load_dashboard")
     def test_users_can_view_published_dashboard(self):
         resp = self.get_resp("/api/v1/dashboard/")

tests/dashboards/base_case.py

@@ -0,0 +1,114 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+import json
+from typing import Any, Dict, Union
+
+import prison
+from flask import Response
+
+from superset import app, security_manager
+from tests.base_tests import SupersetTestCase
+from tests.dashboards.consts import *
+from tests.dashboards.dashboard_test_utils import build_save_dash_parts
+from tests.dashboards.superset_factory_util import delete_all_inserted_objects
+
+
+class DashboardTestCase(SupersetTestCase):
+    def get_dashboard_via_api_by_id(self, dashboard_id: int) -> Response:
+        uri = DASHBOARD_API_URL_FORMAT.format(dashboard_id)
+        return self.get_assert_metric(uri, "get")
+
+    def get_dashboard_view_response(self, dashboard_to_access) -> Response:
+        return self.client.get(dashboard_to_access.url)
+
+    def get_dashboard_api_response(self, dashboard_to_access) -> Response:
+        return self.client.get(DASHBOARD_API_URL_FORMAT.format(dashboard_to_access.id))
+
+    def get_dashboards_list_response(self) -> Response:
+        return self.client.get(GET_DASHBOARDS_LIST_VIEW)
+
+    def get_dashboards_api_response(self) -> Response:
+        return self.client.get(DASHBOARDS_API_URL)
+
+    def save_dashboard_via_view(
+        self, dashboard_id: Union[str, int], dashboard_data: Dict[str, Any]
+    ) -> Response:
+        save_dash_url = SAVE_DASHBOARD_URL_FORMAT.format(dashboard_id)
+        return self.get_resp(save_dash_url, data=dict(data=json.dumps(dashboard_data)))
+
+    def save_dashboard(
+        self, dashboard_id: Union[str, int], dashboard_data: Dict[str, Any]
+    ) -> Response:
+        return self.save_dashboard_via_view(dashboard_id, dashboard_data)
+
+    def delete_dashboard_via_view(self, dashboard_id: int) -> Response:
+        delete_dashboard_url = DELETE_DASHBOARD_VIEW_URL_FORMAT.format(dashboard_id)
+        return self.get_resp(delete_dashboard_url, {})
+
+    def delete_dashboard_via_api(self, dashboard_id):
+        uri = DASHBOARD_API_URL_FORMAT.format(dashboard_id)
+        return self.delete_assert_metric(uri, "delete")
+
+    def bulk_delete_dashboard_via_api(self, dashboard_ids):
+        uri = DASHBOARDS_API_URL_WITH_QUERY_FORMAT.format(prison.dumps(dashboard_ids))
+        return self.delete_assert_metric(uri, "bulk_delete")
+
+    def delete_dashboard(self, dashboard_id: int) -> Response:
+        return self.delete_dashboard_via_view(dashboard_id)
+
+    def assert_permission_was_created(self, dashboard):
+        view_menu = security_manager.find_view_menu(dashboard.view_name)
+        self.assertIsNotNone(view_menu)
+        self.assertEqual(len(security_manager.find_permissions_view_menu(view_menu)), 1)
+
+    def assert_permission_kept_and_changed(self, updated_dashboard, excepted_view_id):
+        view_menu_after_title_changed = security_manager.find_view_menu(
+            updated_dashboard.view_name
+        )
+        self.assertIsNotNone(view_menu_after_title_changed)
+        self.assertEqual(view_menu_after_title_changed.id, excepted_view_id)
+
+    def assert_permissions_were_deleted(self, deleted_dashboard):
+        view_menu = security_manager.find_view_menu(deleted_dashboard.view_name)
+        self.assertIsNone(view_menu)
+
+    def save_dash_basic_case(self, username=ADMIN_USERNAME):
+        # arrange
+        self.login(username=username)
+        (
+            dashboard_to_save,
+            data_before_change,
+            data_after_change,
+        ) = build_save_dash_parts()
+
+        # act
+        save_dash_response = self.save_dashboard_via_view(
+            dashboard_to_save.id, data_after_change
+        )
+
+        # assert
+        self.assertIn("SUCCESS", save_dash_response)
+
+        # post test
+        self.save_dashboard(dashboard_to_save.id, data_before_change)
+
+    def clean_created_objects(self):
+        with app.test_request_context():
+            self.logout()
+            self.login("admin")
+            delete_all_inserted_objects()
+            self.logout()