commit ce05a3dde3f57029174699d3525070bfd4c6bed7
author Daniel Vaz Gaspar <danielvazgaspar@gmail.com> Mon Dec 21 19:17:58 2020 +0000
committer Henry Yeh <henry@preset.io> Mon Dec 21 15:18:19 2020 -0800
tree 4c5f575b30fa3d463384f573409528186af2b25a
parent c6a08fdc46bdb5eb9872331fae76e87c9dbaa797

fix: database alpha permissions (#12136)

* fix: database alpha permissions

* add test

(cherry picked from commit 2f0add3aec8f168fb8c37c648f0e29e507f39294)

superset/security/manager.py

diff --git a/superset/security/manager.py b/superset/security/manager.py
index 46ccbb1..43461f1 100644
--- a/superset/security/manager.py
+++ b/superset/security/manager.py
@@ -109,7 +109,7 @@
     SecurityManager
 ):
     userstatschartview = None
-    READ_ONLY_MODEL_VIEWS = {"DatabaseAsync", "DatabaseView", "DruidClusterModelView"}
+    READ_ONLY_MODEL_VIEWS = {"Database", "DruidClusterModelView", "DynamicPlugin"}
 
     USER_MODEL_VIEWS = {
         "UserDBModelView",

tests/security_tests.py

diff --git a/tests/security_tests.py b/tests/security_tests.py
index 5f3b2a6..388770e 100644
--- a/tests/security_tests.py
+++ b/tests/security_tests.py
@@ -685,6 +685,7 @@
         self.assert_can_all("CssTemplate", perm_set)
         self.assert_can_all("Dataset", perm_set)
         self.assert_can_read("Query", perm_set)
+        self.assert_can_read("Database", perm_set)
         self.assertIn(("can_import_dashboards", "Superset"), perm_set)
         self.assertIn(("can_this_form_post", "CsvToDatabaseView"), perm_set)
         self.assertIn(("can_this_form_get", "CsvToDatabaseView"), perm_set)
@@ -701,6 +702,7 @@
         self.assert_cannot_write("Queries", perm_set)
         self.assert_cannot_write("RoleModelView", perm_set)
         self.assert_cannot_write("UserDBModelView", perm_set)
+        self.assert_cannot_write("Database", perm_set)
 
     def assert_can_admin(self, perm_set):
         self.assert_can_all("Database", perm_set)