def test_update_role(self): update_role_str = 'update_me' sm.add_role(update_role_str) db.session.commit() resp = self.client.post( '/superset/update_role/', data=json.dumps({ 'usernames': ['gamma'], 'role_name': update_role_str }), follow_redirects=True ) update_role = sm.find_role(update_role_str) self.assertEquals( update_role.user, [sm.find_user(username='******')]) self.assertEquals(resp.status_code, 201) resp = self.client.post( '/superset/update_role/', data=json.dumps({ 'usernames': ['alpha', 'unknown'], 'role_name': update_role_str }), follow_redirects=True ) self.assertEquals(resp.status_code, 201) update_role = sm.find_role(update_role_str) self.assertEquals( update_role.user, [sm.find_user(username='******')]) db.session.delete(update_role) db.session.commit()
def test_clean_requests_after_alpha_grant(self): session = db.session # Case 2. Two access requests from gamma and gamma2 # Gamma becomes alpha, gamma2 gets granted # Check if request by gamma has been deleted access_request1 = create_access_request(session, 'table', 'birth_names', TEST_ROLE_1, 'gamma') access_request2 = create_access_request(session, 'table', 'birth_names', TEST_ROLE_2, 'gamma2') ds_1_id = access_request1.datasource_id # gamma becomes alpha alpha_role = sm.find_role('Alpha') gamma_user = sm.find_user(username='******') gamma_user.roles.append(alpha_role) session.commit() access_requests = self.get_access_requests('gamma', 'table', ds_1_id) self.assertTrue(access_requests) self.client.get( EXTEND_ROLE_REQUEST.format('table', ds_1_id, 'gamma2', TEST_ROLE_2)) access_requests = self.get_access_requests('gamma', 'table', ds_1_id) self.assertFalse(access_requests) gamma_user = sm.find_user(username='******') gamma_user.roles.remove(sm.find_role('Alpha')) session.commit()
def test_clean_requests_after_db_grant(self): session = db.session # Case 3. Two access requests from gamma and gamma2 # Gamma gets database access, gamma2 access request granted # Check if request by gamma has been deleted gamma_user = sm.find_user(username='******') access_request1 = create_access_request(session, 'table', 'long_lat', TEST_ROLE_1, 'gamma') access_request2 = create_access_request(session, 'table', 'long_lat', TEST_ROLE_2, 'gamma2') ds_1_id = access_request1.datasource_id # gamma gets granted database access database = session.query(models.Database).first() security.merge_perm(sm, 'database_access', database.perm) ds_perm_view = sm.find_permission_view_menu('database_access', database.perm) sm.add_permission_role(sm.find_role(DB_ACCESS_ROLE), ds_perm_view) gamma_user.roles.append(sm.find_role(DB_ACCESS_ROLE)) session.commit() access_requests = self.get_access_requests('gamma', 'table', ds_1_id) self.assertTrue(access_requests) # gamma2 request gets fulfilled self.client.get( EXTEND_ROLE_REQUEST.format('table', ds_1_id, 'gamma2', TEST_ROLE_2)) access_requests = self.get_access_requests('gamma', 'table', ds_1_id) self.assertFalse(access_requests) gamma_user = sm.find_user(username='******') gamma_user.roles.remove(sm.find_role(DB_ACCESS_ROLE)) session.commit()
def test_clean_requests_after_alpha_grant(self): session = db.session # Case 2. Two access requests from gamma and gamma2 # Gamma becomes alpha, gamma2 gets granted # Check if request by gamma has been deleted access_request1 = create_access_request( session, 'table', 'birth_names', TEST_ROLE_1, 'gamma') create_access_request( session, 'table', 'birth_names', TEST_ROLE_2, 'gamma2') ds_1_id = access_request1.datasource_id # gamma becomes alpha alpha_role = sm.find_role('Alpha') gamma_user = sm.find_user(username='******') gamma_user.roles.append(alpha_role) session.commit() access_requests = self.get_access_requests('gamma', 'table', ds_1_id) self.assertTrue(access_requests) self.client.get(EXTEND_ROLE_REQUEST.format( 'table', ds_1_id, 'gamma2', TEST_ROLE_2)) access_requests = self.get_access_requests('gamma', 'table', ds_1_id) self.assertFalse(access_requests) gamma_user = sm.find_user(username='******') gamma_user.roles.remove(sm.find_role('Alpha')) session.commit()
def test_clean_requests_after_db_grant(self): session = db.session # Case 3. Two access requests from gamma and gamma2 # Gamma gets database access, gamma2 access request granted # Check if request by gamma has been deleted gamma_user = sm.find_user(username='******') access_request1 = create_access_request( session, 'table', 'long_lat', TEST_ROLE_1, 'gamma') create_access_request( session, 'table', 'long_lat', TEST_ROLE_2, 'gamma2') ds_1_id = access_request1.datasource_id # gamma gets granted database access database = session.query(models.Database).first() security.merge_perm( sm, 'database_access', database.perm) ds_perm_view = sm.find_permission_view_menu( 'database_access', database.perm) sm.add_permission_role( sm.find_role(DB_ACCESS_ROLE), ds_perm_view) gamma_user.roles.append(sm.find_role(DB_ACCESS_ROLE)) session.commit() access_requests = self.get_access_requests('gamma', 'table', ds_1_id) self.assertTrue(access_requests) # gamma2 request gets fulfilled self.client.get(EXTEND_ROLE_REQUEST.format( 'table', ds_1_id, 'gamma2', TEST_ROLE_2)) access_requests = self.get_access_requests('gamma', 'table', ds_1_id) self.assertFalse(access_requests) gamma_user = sm.find_user(username='******') gamma_user.roles.remove(sm.find_role(DB_ACCESS_ROLE)) session.commit()
def test_update_role(self): update_role_str = 'update_me' sm.add_role(update_role_str) db.session.commit() resp = self.client.post( '/superset/update_role/', data=json.dumps({ 'user_emails': ['*****@*****.**'], 'role_name': update_role_str }), follow_redirects=True ) update_role = sm.find_role(update_role_str) self.assertEquals( update_role.user, [sm.find_user(email='*****@*****.**')]) self.assertEquals(resp.status_code, 201) resp = self.client.post( '/superset/update_role/', data=json.dumps({ 'user_emails': ['*****@*****.**', '*****@*****.**'], 'role_name': update_role_str }), follow_redirects=True ) self.assertEquals(resp.status_code, 201) update_role = sm.find_role(update_role_str) self.assertEquals( update_role.user, [sm.find_user(email='*****@*****.**')]) db.session.delete(update_role) db.session.commit()
def test_update_role(self): update_role_str = 'update_me' sm.add_role(update_role_str) db.session.commit() resp = self.client.post( '/superset/update_role/', data=json.dumps({ 'users': [{ 'username': '******', 'first_name': 'Gamma', 'last_name': 'Gamma', 'email': '*****@*****.**', }], 'role_name': update_role_str, }), follow_redirects=True, ) update_role = sm.find_role(update_role_str) self.assertEquals(update_role.user, [sm.find_user(username='******')]) self.assertEquals(resp.status_code, 201) resp = self.client.post( '/superset/update_role/', data=json.dumps({ 'users': [{ 'username': '******', 'first_name': 'Alpha', 'last_name': 'Alpha', 'email': '*****@*****.**', }, { 'username': '******', 'first_name': 'Unknown1', 'last_name': 'Unknown2', 'email': '*****@*****.**', }], 'role_name': update_role_str, }), follow_redirects=True, ) self.assertEquals(resp.status_code, 201) update_role = sm.find_role(update_role_str) self.assertEquals(update_role.user, [ sm.find_user(username='******'), sm.find_user(username='******'), ]) unknown = sm.find_user(username='******') self.assertEquals('Unknown2', unknown.last_name) self.assertEquals('Unknown1', unknown.first_name) self.assertEquals('*****@*****.**', unknown.email) db.session.delete(update_role) db.session.delete(unknown) db.session.commit()
def test_update_role(self): update_role_str = 'update_me' sm.add_role(update_role_str) db.session.commit() resp = self.client.post( '/superset/update_role/', data=json.dumps({ 'users': [{ 'username': '******', 'first_name': 'Gamma', 'last_name': 'Gamma', 'email': '*****@*****.**' }], 'role_name': update_role_str }), follow_redirects=True ) update_role = sm.find_role(update_role_str) self.assertEquals( update_role.user, [sm.find_user(username='******')]) self.assertEquals(resp.status_code, 201) resp = self.client.post( '/superset/update_role/', data=json.dumps({ 'users': [{ 'username': '******', 'first_name': 'Alpha', 'last_name': 'Alpha', 'email': '*****@*****.**' }, { 'username': '******', 'first_name': 'Unknown1', 'last_name': 'Unknown2', 'email': '*****@*****.**' }], 'role_name': update_role_str }), follow_redirects=True ) self.assertEquals(resp.status_code, 201) update_role = sm.find_role(update_role_str) self.assertEquals( update_role.user, [ sm.find_user(username='******'), sm.find_user(username='******'), ]) unknown = sm.find_user(username='******') self.assertEquals('Unknown2', unknown.last_name) self.assertEquals('Unknown1', unknown.first_name) self.assertEquals('*****@*****.**', unknown.email) db.session.delete(update_role) db.session.delete(unknown) db.session.commit()
def test_clean_requests_after_role_extend(self): session = db.session # Case 1. Gamma and gamma2 requested test_role1 on energy_usage access # Gamma already has role test_role1 # Extend test_role1 with energy_usage access for gamma2 # Check if access request for gamma at energy_usage was deleted # gamma2 and gamma request table_role on energy usage access_request1 = create_access_request(session, 'table', 'random_time_series', TEST_ROLE_1, 'gamma2') ds_1_id = access_request1.datasource_id access_request2 = create_access_request(session, 'table', 'random_time_series', TEST_ROLE_1, 'gamma') access_requests = self.get_access_requests('gamma', 'table', ds_1_id) self.assertTrue(access_requests) # gamma gets test_role1 self.get_resp( GRANT_ROLE_REQUEST.format('table', ds_1_id, 'gamma', TEST_ROLE_1)) # extend test_role1 with access on energy usage self.client.get( EXTEND_ROLE_REQUEST.format('table', ds_1_id, 'gamma2', TEST_ROLE_1)) access_requests = self.get_access_requests('gamma', 'table', ds_1_id) self.assertFalse(access_requests) gamma_user = sm.find_user(username='******') gamma_user.roles.remove(sm.find_role('test_role1'))
def get_access_requests(self, username, ds_type, ds_id): DAR = models.DatasourceAccessRequest return (db.session.query(DAR).filter( DAR.created_by == sm.find_user(username=username), DAR.datasource_type == ds_type, DAR.datasource_id == ds_id, ).first())
def test_clean_requests_after_role_extend(self): session = db.session # Case 1. Gamma and gamma2 requested test_role1 on energy_usage access # Gamma already has role test_role1 # Extend test_role1 with energy_usage access for gamma2 # Check if access request for gamma at energy_usage was deleted # gamma2 and gamma request table_role on energy usage if app.config.get('ENABLE_ACCESS_REQUEST'): access_request1 = create_access_request( session, 'table', 'random_time_series', TEST_ROLE_1, 'gamma2') ds_1_id = access_request1.datasource_id create_access_request( session, 'table', 'random_time_series', TEST_ROLE_1, 'gamma') access_requests = self.get_access_requests('gamma', 'table', ds_1_id) self.assertTrue(access_requests) # gamma gets test_role1 self.get_resp(GRANT_ROLE_REQUEST.format( 'table', ds_1_id, 'gamma', TEST_ROLE_1)) # extend test_role1 with access on energy usage self.client.get(EXTEND_ROLE_REQUEST.format( 'table', ds_1_id, 'gamma2', TEST_ROLE_1)) access_requests = self.get_access_requests('gamma', 'table', ds_1_id) self.assertFalse(access_requests) gamma_user = sm.find_user(username='******') gamma_user.roles.remove(sm.find_role('test_role1'))
def get_access_requests(self, username, ds_type, ds_id): DAR = models.DatasourceAccessRequest return ( db.session.query(DAR) .filter( DAR.created_by == sm.find_user(username=username), DAR.datasource_type == ds_type, DAR.datasource_id == ds_id, ) .first() )
def test_clean_requests_after_schema_grant(self): session = db.session # Case 4. Two access requests from gamma and gamma2 # Gamma gets schema access, gamma2 access request granted # Check if request by gamma has been deleted gamma_user = sm.find_user(username='******') access_request1 = create_access_request(session, 'table', 'wb_health_population', TEST_ROLE_1, 'gamma') access_request2 = create_access_request(session, 'table', 'wb_health_population', TEST_ROLE_2, 'gamma2') ds_1_id = access_request1.datasource_id ds = session.query(models.SqlaTable).filter_by( table_name='wb_health_population').first() ds.schema = 'temp_schema' security.merge_perm(sm, 'schema_access', ds.schema_perm) schema_perm_view = sm.find_permission_view_menu( 'schema_access', ds.schema_perm) sm.add_permission_role(sm.find_role(SCHEMA_ACCESS_ROLE), schema_perm_view) gamma_user.roles.append(sm.find_role(SCHEMA_ACCESS_ROLE)) session.commit() # gamma2 request gets fulfilled self.client.get( EXTEND_ROLE_REQUEST.format('table', ds_1_id, 'gamma2', TEST_ROLE_2)) access_requests = self.get_access_requests('gamma', 'table', ds_1_id) self.assertFalse(access_requests) gamma_user = sm.find_user(username='******') gamma_user.roles.remove(sm.find_role(SCHEMA_ACCESS_ROLE)) ds = session.query(models.SqlaTable).filter_by( table_name='wb_health_population').first() ds.schema = None session.commit()
def test_clean_requests_after_schema_grant(self): session = db.session # Case 4. Two access requests from gamma and gamma2 # Gamma gets schema access, gamma2 access request granted # Check if request by gamma has been deleted gamma_user = sm.find_user(username='******') access_request1 = create_access_request( session, 'table', 'wb_health_population', TEST_ROLE_1, 'gamma') access_request2 = create_access_request( session, 'table', 'wb_health_population', TEST_ROLE_2, 'gamma2') ds_1_id = access_request1.datasource_id ds = session.query(SqlaTable).filter_by( table_name='wb_health_population').first() ds.schema = 'temp_schema' security.merge_perm( sm, 'schema_access', ds.schema_perm) schema_perm_view = sm.find_permission_view_menu( 'schema_access', ds.schema_perm) sm.add_permission_role( sm.find_role(SCHEMA_ACCESS_ROLE) , schema_perm_view) gamma_user.roles.append(sm.find_role(SCHEMA_ACCESS_ROLE)) session.commit() # gamma2 request gets fulfilled self.client.get(EXTEND_ROLE_REQUEST.format( 'table', ds_1_id, 'gamma2', TEST_ROLE_2)) access_requests = self.get_access_requests('gamma', 'table', ds_1_id) self.assertFalse(access_requests) gamma_user = sm.find_user(username='******') gamma_user.roles.remove(sm.find_role(SCHEMA_ACCESS_ROLE)) ds = session.query(SqlaTable).filter_by( table_name='wb_health_population').first() ds.schema = None session.commit()
def create_access_request(session, ds_type, ds_name, role_name, user_name): ds_class = SourceRegistry.sources[ds_type] # TODO: generalize datasource names if ds_type == 'table': ds = session.query(ds_class).filter( ds_class.table_name == ds_name).first() else: ds = session.query(ds_class).filter( ds_class.datasource_name == ds_name).first() ds_perm_view = sm.find_permission_view_menu('datasource_access', ds.perm) sm.add_permission_role(sm.find_role(role_name), ds_perm_view) access_request = models.DatasourceAccessRequest( datasource_id=ds.id, datasource_type=ds_type, created_by_fk=sm.find_user(username=user_name).id, ) session.add(access_request) session.commit() return access_request
def create_access_request(ds_type, ds_name, role_name): ds_class = SourceRegistry.sources[ds_type] # TODO: generalize datasource names if ds_type == 'table': ds = session.query(ds_class).filter( ds_class.table_name == ds_name).first() else: ds = session.query(ds_class).filter( ds_class.datasource_name == ds_name).first() ds_perm_view = sm.find_permission_view_menu( 'datasource_access', ds.perm) sm.add_permission_role(sm.find_role(role_name), ds_perm_view) access_request = models.DatasourceAccessRequest( datasource_id=ds.id, datasource_type=ds_type, created_by_fk=sm.find_user(username='******').id, ) session.add(access_request) session.commit() return access_request
def test_approve(self): session = db.session TEST_ROLE_NAME = 'table_role' sm.add_role(TEST_ROLE_NAME) def create_access_request(ds_type, ds_name, role_name): ds_class = SourceRegistry.sources[ds_type] # TODO: generalize datasource names if ds_type == 'table': ds = session.query(ds_class).filter( ds_class.table_name == ds_name).first() else: ds = session.query(ds_class).filter( ds_class.datasource_name == ds_name).first() ds_perm_view = sm.find_permission_view_menu( 'datasource_access', ds.perm) sm.add_permission_role(sm.find_role(role_name), ds_perm_view) access_request = models.DatasourceAccessRequest( datasource_id=ds.id, datasource_type=ds_type, created_by_fk=sm.find_user(username='******').id, ) session.add(access_request) session.commit() return access_request EXTEND_ROLE_REQUEST = ( '/superset/approve?datasource_type={}&datasource_id={}&' 'created_by={}&role_to_extend={}') GRANT_ROLE_REQUEST = ( '/superset/approve?datasource_type={}&datasource_id={}&' 'created_by={}&role_to_grant={}') # Case 1. Grant new role to the user. access_request1 = create_access_request( 'table', 'unicode_test', TEST_ROLE_NAME) ds_1_id = access_request1.datasource_id self.get_resp(GRANT_ROLE_REQUEST.format( 'table', ds_1_id, 'gamma', TEST_ROLE_NAME)) access_requests = self.get_access_requests('gamma', 'table', ds_1_id) # request was removed self.assertFalse(access_requests) # user was granted table_role user_roles = [r.name for r in sm.find_user('gamma').roles] self.assertIn(TEST_ROLE_NAME, user_roles) # Case 2. Extend the role to have access to the table access_request2 = create_access_request('table', 'long_lat', TEST_ROLE_NAME) ds_2_id = access_request2.datasource_id long_lat_perm = access_request2.datasource.perm self.client.get(EXTEND_ROLE_REQUEST.format( 'table', access_request2.datasource_id, 'gamma', TEST_ROLE_NAME)) access_requests = self.get_access_requests('gamma', 'table', ds_2_id) # request was removed self.assertFalse(access_requests) # table_role was extended to grant access to the long_lat table/ perm_view = sm.find_permission_view_menu( 'datasource_access', long_lat_perm) TEST_ROLE = sm.find_role(TEST_ROLE_NAME) self.assertIn(perm_view, TEST_ROLE.permissions) # Case 3. Grant new role to the user to access the druid datasource. sm.add_role('druid_role') access_request3 = create_access_request('druid', 'druid_ds_1', 'druid_role') self.get_resp(GRANT_ROLE_REQUEST.format( 'druid', access_request3.datasource_id, 'gamma', 'druid_role')) # user was granted table_role user_roles = [r.name for r in sm.find_user('gamma').roles] self.assertIn('druid_role', user_roles) # Case 4. Extend the role to have access to the druid datasource access_request4 = create_access_request('druid', 'druid_ds_2', 'druid_role') druid_ds_2_perm = access_request4.datasource.perm self.client.get(EXTEND_ROLE_REQUEST.format( 'druid', access_request4.datasource_id, 'gamma', 'druid_role')) # druid_role was extended to grant access to the druid_access_ds_2 druid_role = sm.find_role('druid_role') perm_view = sm.find_permission_view_menu( 'datasource_access', druid_ds_2_perm) self.assertIn(perm_view, druid_role.permissions) # cleanup gamma_user = sm.find_user(username='******') gamma_user.roles.remove(sm.find_role('druid_role')) gamma_user.roles.remove(sm.find_role(TEST_ROLE_NAME)) session.delete(sm.find_role('druid_role')) session.delete(sm.find_role(TEST_ROLE_NAME)) session.commit()
def test_request_access(self): session = db.session self.logout() self.login(username='******') gamma_user = sm.find_user(username='******') sm.add_role('dummy_role') gamma_user.roles.append(sm.find_role('dummy_role')) session.commit() ACCESS_REQUEST = ('/superset/request_access?' 'datasource_type={}&' 'datasource_id={}&' 'action={}&') ROLE_EXTEND_LINK = ( '<a href="/superset/approve?datasource_type={}&datasource_id={}&' 'created_by={}&role_to_extend={}">Extend {} Role</a>') ROLE_GRANT_LINK = ( '<a href="/superset/approve?datasource_type={}&datasource_id={}&' 'created_by={}&role_to_grant={}">Grant {} Role</a>') # Request table access, there are no roles have this table. table1 = session.query(models.SqlaTable).filter_by( table_name='random_time_series').first() table_1_id = table1.id # request access to the table resp = self.get_resp(ACCESS_REQUEST.format('table', table_1_id, 'go')) assert "Access was requested" in resp access_request1 = self.get_access_requests('gamma', 'table', table_1_id) assert access_request1 is not None # Request access, roles exist that contains the table. # add table to the existing roles table3 = session.query( models.SqlaTable).filter_by(table_name='energy_usage').first() table_3_id = table3.id table3_perm = table3.perm sm.add_role('energy_usage_role') alpha_role = sm.find_role('Alpha') sm.add_permission_role( alpha_role, sm.find_permission_view_menu('datasource_access', table3_perm)) sm.add_permission_role( sm.find_role("energy_usage_role"), sm.find_permission_view_menu('datasource_access', table3_perm)) session.commit() self.get_resp(ACCESS_REQUEST.format('table', table_3_id, 'go')) access_request3 = self.get_access_requests('gamma', 'table', table_3_id) approve_link_3 = ROLE_GRANT_LINK.format('table', table_3_id, 'gamma', 'energy_usage_role', 'energy_usage_role') self.assertEqual(access_request3.roles_with_datasource, '<ul><li>{}</li></ul>'.format(approve_link_3)) # Request druid access, there are no roles have this table. druid_ds_4 = session.query(models.DruidDatasource).filter_by( datasource_name='druid_ds_1').first() druid_ds_4_id = druid_ds_4.id # request access to the table self.get_resp(ACCESS_REQUEST.format('druid', druid_ds_4_id, 'go')) access_request4 = self.get_access_requests('gamma', 'druid', druid_ds_4_id) self.assertEqual(access_request4.roles_with_datasource, '<ul></ul>'.format(access_request4.id)) # Case 5. Roles exist that contains the druid datasource. # add druid ds to the existing roles druid_ds_5 = session.query(models.DruidDatasource).filter_by( datasource_name='druid_ds_2').first() druid_ds_5_id = druid_ds_5.id druid_ds_5_perm = druid_ds_5.perm druid_ds_2_role = sm.add_role('druid_ds_2_role') admin_role = sm.find_role('Admin') sm.add_permission_role( admin_role, sm.find_permission_view_menu('datasource_access', druid_ds_5_perm)) sm.add_permission_role( druid_ds_2_role, sm.find_permission_view_menu('datasource_access', druid_ds_5_perm)) session.commit() self.get_resp(ACCESS_REQUEST.format('druid', druid_ds_5_id, 'go')) access_request5 = self.get_access_requests('gamma', 'druid', druid_ds_5_id) approve_link_5 = ROLE_GRANT_LINK.format('druid', druid_ds_5_id, 'gamma', 'druid_ds_2_role', 'druid_ds_2_role') self.assertEqual(access_request5.roles_with_datasource, '<ul><li>{}</li></ul>'.format(approve_link_5)) # cleanup gamma_user = sm.find_user(username='******') gamma_user.roles.remove(sm.find_role('dummy_role')) session.commit()
def test_approve(self, mock_send_mime): session = db.session TEST_ROLE_NAME = 'table_role' sm.add_role(TEST_ROLE_NAME) # Case 1. Grant new role to the user. access_request1 = create_access_request(session, 'table', 'unicode_test', TEST_ROLE_NAME, 'gamma') ds_1_id = access_request1.datasource_id resp = self.get_resp( GRANT_ROLE_REQUEST.format('table', ds_1_id, 'gamma', TEST_ROLE_NAME)) # Test email content. self.assertTrue(mock_send_mime.called) call_args = mock_send_mime.call_args[0] self.assertEqual([ sm.find_user(username='******').email, sm.find_user(username='******').email ], call_args[1]) self.assertEqual( '[Superset] Access to the datasource {} was granted'.format( self.get_table(ds_1_id).full_name), call_args[2]['Subject']) self.assertIn(TEST_ROLE_NAME, call_args[2].as_string()) self.assertIn('unicode_test', call_args[2].as_string()) access_requests = self.get_access_requests('gamma', 'table', ds_1_id) # request was removed self.assertFalse(access_requests) # user was granted table_role user_roles = [r.name for r in sm.find_user('gamma').roles] self.assertIn(TEST_ROLE_NAME, user_roles) # Case 2. Extend the role to have access to the table access_request2 = create_access_request(session, 'table', 'long_lat', TEST_ROLE_NAME, 'gamma') ds_2_id = access_request2.datasource_id long_lat_perm = access_request2.datasource.perm self.client.get( EXTEND_ROLE_REQUEST.format('table', access_request2.datasource_id, 'gamma', TEST_ROLE_NAME)) access_requests = self.get_access_requests('gamma', 'table', ds_2_id) # Test email content. self.assertTrue(mock_send_mime.called) call_args = mock_send_mime.call_args[0] self.assertEqual([ sm.find_user(username='******').email, sm.find_user(username='******').email ], call_args[1]) self.assertEqual( '[Superset] Access to the datasource {} was granted'.format( self.get_table(ds_2_id).full_name), call_args[2]['Subject']) self.assertIn(TEST_ROLE_NAME, call_args[2].as_string()) self.assertIn('long_lat', call_args[2].as_string()) # request was removed self.assertFalse(access_requests) # table_role was extended to grant access to the long_lat table/ perm_view = sm.find_permission_view_menu('datasource_access', long_lat_perm) TEST_ROLE = sm.find_role(TEST_ROLE_NAME) self.assertIn(perm_view, TEST_ROLE.permissions) # Case 3. Grant new role to the user to access the druid datasource. sm.add_role('druid_role') access_request3 = create_access_request(session, 'druid', 'druid_ds_1', 'druid_role', 'gamma') self.get_resp( GRANT_ROLE_REQUEST.format('druid', access_request3.datasource_id, 'gamma', 'druid_role')) # user was granted table_role user_roles = [r.name for r in sm.find_user('gamma').roles] self.assertIn('druid_role', user_roles) # Case 4. Extend the role to have access to the druid datasource access_request4 = create_access_request(session, 'druid', 'druid_ds_2', 'druid_role', 'gamma') druid_ds_2_perm = access_request4.datasource.perm self.client.get( EXTEND_ROLE_REQUEST.format('druid', access_request4.datasource_id, 'gamma', 'druid_role')) # druid_role was extended to grant access to the druid_access_ds_2 druid_role = sm.find_role('druid_role') perm_view = sm.find_permission_view_menu('datasource_access', druid_ds_2_perm) self.assertIn(perm_view, druid_role.permissions) # cleanup gamma_user = sm.find_user(username='******') gamma_user.roles.remove(sm.find_role('druid_role')) gamma_user.roles.remove(sm.find_role(TEST_ROLE_NAME)) session.delete(sm.find_role('druid_role')) session.delete(sm.find_role(TEST_ROLE_NAME)) session.commit()
def test_approve(self, mock_send_mime): if app.config.get('ENABLE_ACCESS_REQUEST'): session = db.session TEST_ROLE_NAME = 'table_role' sm.add_role(TEST_ROLE_NAME) # Case 1. Grant new role to the user. access_request1 = create_access_request( session, 'table', 'unicode_test', TEST_ROLE_NAME, 'gamma') ds_1_id = access_request1.datasource_id self.get_resp(GRANT_ROLE_REQUEST.format( 'table', ds_1_id, 'gamma', TEST_ROLE_NAME)) # Test email content. self.assertTrue(mock_send_mime.called) call_args = mock_send_mime.call_args[0] self.assertEqual([sm.find_user(username='******').email, sm.find_user(username='******').email], call_args[1]) self.assertEqual( '[Superset] Access to the datasource {} was granted'.format( self.get_table(ds_1_id).full_name), call_args[2]['Subject']) self.assertIn(TEST_ROLE_NAME, call_args[2].as_string()) self.assertIn('unicode_test', call_args[2].as_string()) access_requests = self.get_access_requests('gamma', 'table', ds_1_id) # request was removed self.assertFalse(access_requests) # user was granted table_role user_roles = [r.name for r in sm.find_user('gamma').roles] self.assertIn(TEST_ROLE_NAME, user_roles) # Case 2. Extend the role to have access to the table access_request2 = create_access_request( session, 'table', 'long_lat', TEST_ROLE_NAME, 'gamma') ds_2_id = access_request2.datasource_id long_lat_perm = access_request2.datasource.perm self.client.get(EXTEND_ROLE_REQUEST.format( 'table', access_request2.datasource_id, 'gamma', TEST_ROLE_NAME)) access_requests = self.get_access_requests('gamma', 'table', ds_2_id) # Test email content. self.assertTrue(mock_send_mime.called) call_args = mock_send_mime.call_args[0] self.assertEqual([sm.find_user(username='******').email, sm.find_user(username='******').email], call_args[1]) self.assertEqual( '[Superset] Access to the datasource {} was granted'.format( self.get_table(ds_2_id).full_name), call_args[2]['Subject']) self.assertIn(TEST_ROLE_NAME, call_args[2].as_string()) self.assertIn('long_lat', call_args[2].as_string()) # request was removed self.assertFalse(access_requests) # table_role was extended to grant access to the long_lat table/ perm_view = sm.find_permission_view_menu( 'datasource_access', long_lat_perm) TEST_ROLE = sm.find_role(TEST_ROLE_NAME) self.assertIn(perm_view, TEST_ROLE.permissions) # Case 3. Grant new role to the user to access the druid datasource. sm.add_role('druid_role') access_request3 = create_access_request( session, 'druid', 'druid_ds_1', 'druid_role', 'gamma') self.get_resp(GRANT_ROLE_REQUEST.format( 'druid', access_request3.datasource_id, 'gamma', 'druid_role')) # user was granted table_role user_roles = [r.name for r in sm.find_user('gamma').roles] self.assertIn('druid_role', user_roles) # Case 4. Extend the role to have access to the druid datasource access_request4 = create_access_request( session, 'druid', 'druid_ds_2', 'druid_role', 'gamma') druid_ds_2_perm = access_request4.datasource.perm self.client.get(EXTEND_ROLE_REQUEST.format( 'druid', access_request4.datasource_id, 'gamma', 'druid_role')) # druid_role was extended to grant access to the druid_access_ds_2 druid_role = sm.find_role('druid_role') perm_view = sm.find_permission_view_menu( 'datasource_access', druid_ds_2_perm) self.assertIn(perm_view, druid_role.permissions) # cleanup gamma_user = sm.find_user(username='******') gamma_user.roles.remove(sm.find_role('druid_role')) gamma_user.roles.remove(sm.find_role(TEST_ROLE_NAME)) session.delete(sm.find_role('druid_role')) session.delete(sm.find_role(TEST_ROLE_NAME)) session.commit()
def test_request_access(self): session = db.session self.logout() self.login(username='******') gamma_user = sm.find_user(username='******') sm.add_role('dummy_role') gamma_user.roles.append(sm.find_role('dummy_role')) session.commit() ACCESS_REQUEST = ( '/superset/request_access?' 'datasource_type={}&' 'datasource_id={}&' 'action={}&') ROLE_EXTEND_LINK = ( '<a href="/superset/approve?datasource_type={}&datasource_id={}&' 'created_by={}&role_to_extend={}">Extend {} Role</a>') ROLE_GRANT_LINK = ( '<a href="/superset/approve?datasource_type={}&datasource_id={}&' 'created_by={}&role_to_grant={}">Grant {} Role</a>') # Request table access, there are no roles have this table. table1 = session.query(models.SqlaTable).filter_by( table_name='random_time_series').first() table_1_id = table1.id # request access to the table resp = self.get_resp( ACCESS_REQUEST.format('table', table_1_id, 'go')) assert "Access was requested" in resp access_request1 = self.get_access_requests('gamma', 'table', table_1_id) assert access_request1 is not None # Request access, roles exist that contains the table. # add table to the existing roles table3 = session.query(models.SqlaTable).filter_by( table_name='energy_usage').first() table_3_id = table3.id table3_perm = table3.perm sm.add_role('energy_usage_role') alpha_role = sm.find_role('Alpha') sm.add_permission_role( alpha_role, sm.find_permission_view_menu('datasource_access', table3_perm)) sm.add_permission_role( sm.find_role("energy_usage_role"), sm.find_permission_view_menu('datasource_access', table3_perm)) session.commit() self.get_resp( ACCESS_REQUEST.format('table', table_3_id, 'go')) access_request3 = self.get_access_requests('gamma', 'table', table_3_id) approve_link_3 = ROLE_GRANT_LINK.format( 'table', table_3_id, 'gamma', 'energy_usage_role', 'energy_usage_role') self.assertEqual(access_request3.roles_with_datasource, '<ul><li>{}</li></ul>'.format(approve_link_3)) # Request druid access, there are no roles have this table. druid_ds_4 = session.query(models.DruidDatasource).filter_by( datasource_name='druid_ds_1').first() druid_ds_4_id = druid_ds_4.id # request access to the table self.get_resp(ACCESS_REQUEST.format('druid', druid_ds_4_id, 'go')) access_request4 = self.get_access_requests('gamma', 'druid', druid_ds_4_id) self.assertEqual( access_request4.roles_with_datasource, '<ul></ul>'.format(access_request4.id)) # Case 5. Roles exist that contains the druid datasource. # add druid ds to the existing roles druid_ds_5 = session.query(models.DruidDatasource).filter_by( datasource_name='druid_ds_2').first() druid_ds_5_id = druid_ds_5.id druid_ds_5_perm = druid_ds_5.perm druid_ds_2_role = sm.add_role('druid_ds_2_role') admin_role = sm.find_role('Admin') sm.add_permission_role( admin_role, sm.find_permission_view_menu('datasource_access', druid_ds_5_perm)) sm.add_permission_role( druid_ds_2_role, sm.find_permission_view_menu('datasource_access', druid_ds_5_perm)) session.commit() self.get_resp(ACCESS_REQUEST.format('druid', druid_ds_5_id, 'go')) access_request5 = self.get_access_requests( 'gamma', 'druid', druid_ds_5_id) approve_link_5 = ROLE_GRANT_LINK.format( 'druid', druid_ds_5_id, 'gamma', 'druid_ds_2_role', 'druid_ds_2_role') self.assertEqual(access_request5.roles_with_datasource, '<ul><li>{}</li></ul>'.format(approve_link_5)) # cleanup gamma_user = sm.find_user(username='******') gamma_user.roles.remove(sm.find_role('dummy_role')) session.commit()