search

apache / superset

Apache Superset is a Data Visualization and Data Exploration Platform
https://superset.apache.org/
Apache License 2.0
61.59k stars 13.45k forks source link

Published Dashboard without charts can only be reached by owners #28515

Open giuseppecg opened 3 months ago

giuseppecg commented 3 months ago

Bug description

We've are communicating templates in our company through dashboards without charts, but already with text boxes, tabs, etc. But we can't spread adoption because we need to always add new owners.

To bypass this we are leaving a empty chart so the dashboard becomes available

It seems to me it's because of the gamma role setup and the lack of chart, the dash is blocked, but not quite.

How to reproduce the bug

Version 3.0.2

You'll need at least 2 users with gamma and a single db connection should do. Both of them would have access to this same DB

  1. create a dashboard with only text boxes, tabs, and/or any layout feat
  2. Publish this dashboard
  3. Use the other account and search for the dash name on the dash tab and it should not appear
  4. Use the other account to try to access this dashboard and this should return an unexpected error on the front

Looking at the logs you should find this error

werkzeug.exceptions.NotFound: 404 Not Found: The requested URL was not found on the server. If you entered the URL manually please check your spelling and try again. File "/usr/local/lib/python3.9/site-packages/flask/app.py", line 1799, in dispatch_request return werkzeug.utils.send_from_directory( # type: ignore[return-value] Traceback (most recent call last): File "/usr/local/lib/python3.9/site-packages/flask/app.py", line 1823, in full_dispatch_request raise NotFound() return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args) ...

  1. come back to the first user and add any chart, can be a select 1 dataset.
  2. Now the second user must be able to access the dashboard

Screenshots/recordings

No response

Superset version

3.0.2

Python version

3.9

Node version

16

Browser

Chrome

Additional context

the issue occured on all browsers

Checklist

dosubot[bot] commented 3 months ago

The issue you're encountering with dashboards without charts not being accessible to users with the gamma role seems to stem from how Superset manages dashboard visibility and access permissions. In Superset, access to dashboards is controlled by user roles, permissions, and checks for administrative status or ownership. Specifically, the gamma role is designed to limit access to only those data sources and the associated dashboards and charts that the user has been explicitly given access to. Since dashboards without charts do not have any associated data sources, they might not be visible to gamma users based on the current permission setup.

The 404 Not Found error you're seeing when a gamma user attempts to access a dashboard without charts is likely due to the system's inability to find a valid permission set that allows access to the dashboard. The workaround you've discovered, adding an empty chart to make the dashboard accessible, aligns with this understanding, as it introduces a data source to the dashboard, potentially making it visible to gamma users based on their permissions for that data source.

To address this issue, it might be necessary to explore modifications to the Superset codebase or configuration to allow gamma users access to dashboards without associated data sources. This approach, however, would require a deeper dive into the specifics of Superset's permission handling mechanisms and might not be straightforward depending on your setup and requirements.

This explanation is based on the current understanding of Superset's security model and the behavior you've described. If you have further questions or need more detailed assistance, please feel free to ask.

#### Details **Sources** - [superset-frontend/src/dashboard/util/permissionUtils.ts](https://github.com/apache/superset/blob/master/superset-frontend/src/dashboard/util/permissionUtils.ts) - [superset/security/manager.py](https://github.com/apache/superset/blob/master/superset/security/manager.py) - [tests/integration_tests/security_tests.py](https://github.com/apache/superset/blob/master/tests/integration_tests/security_tests.py) - [superset-frontend/src/dashboard/components/Dashboard.jsx](https://github.com/apache/superset/blob/master/superset-frontend/src/dashboard/components/Dashboard.jsx) - [docs/docs/security/security.mdx](https://github.com/apache/superset/blob/master/docs/docs/security/security.mdx) - [superset-frontend/src/components/Chart/Chart.jsx](https://github.com/apache/superset/blob/master/superset-frontend/src/components/Chart/Chart.jsx) - [superset/errors.py](https://github.com/apache/superset/blob/master/superset/errors.py) - [superset/commands/dashboard/exceptions.py](https://github.com/apache/superset/blob/master/superset/commands/dashboard/exceptions.py) - [superset-frontend/src/setup/setupErrorMessages.ts](https://github.com/apache/superset/blob/master/superset-frontend/src/setup/setupErrorMessages.ts) - [superset/models/dashboard.py](https://github.com/apache/superset/blob/master/superset/models/dashboard.py) - [superset-frontend/src/dashboard/components/PublishedStatus/index.jsx](https://github.com/apache/superset/blob/master/superset-frontend/src/dashboard/components/PublishedStatus/index.jsx) - [superset-frontend/src/dashboard/util/isDashboardEmpty.ts](https://github.com/apache/superset/blob/master/superset-frontend/src/dashboard/util/isDashboardEmpty.ts) - [superset-frontend/src/explore/components/useExploreAdditionalActionsMenu/DashboardsSubMenu.tsx](https://github.com/apache/superset/blob/master/superset-frontend/src/explore/components/useExploreAdditionalActionsMenu/DashboardsSubMenu.tsx) - [superset/views/dashboard/mixin.py](https://github.com/apache/superset/blob/master/superset/views/dashboard/mixin.py) - [superset-frontend/src/dashboard/actions/sliceEntities.ts](https://github.com/apache/superset/blob/master/superset-frontend/src/dashboard/actions/sliceEntities.ts)
**About Dosu** This response is meant to be useful and save you time. It is **not meant to be a precise solution**, but rather a starting point for your own research. Help me be more useful! Please leave a 👍 if this is helpful and 👎 if it is irrelevant.

To continue the conversation, mention @dosu.