feat: Add student role with minimal access in Superset

[nandodev-net]

Description:

This pull request introduces a new role for students, designed to be similar to the instructor role but with read-only access. The aim is to ensure students can only access and view assets for which they have permissions.

Changes:

• Defined a base student role with minimal permissions.
• Automated role assignment for students upon login.

Testing:

• Logged in as a student at Superset dashboard

Please review the changes and provide feedback.

[openedx-webhooks]

Thanks for the pull request, @nandodev-net! Please note that it may take us up to several weeks or months to complete a review and merge your PR.

Feel free to add as much of the following information to the ticket as you can:

• supporting documentation
• Open edX discussion forum threads
• timeline information ("this must be merged by XX date", and why that is)
• partner information ("this is a course on edx.org")
• any other information that can help Product understand the context for the PR

All technical communication about the code itself will be done via the GitHub pull request interface. As a reminder, our process documentation is here.

Please let us know once your PR is ready for our review and all tests are green.

[Ian2012]

You are missing the part where the role should be assigned automatically at login.

tutor-contrib-aspects/tutoraspects/templates/aspects/apps/superset/pythonpath/openedx_sso_security_manager.py

Lines 177 to 178 in 8a5c236

	if bool("{{SUPERSET_BLOCK_STUDENT_ACCESS}}") and not roles:
	raise Exception(f"Student {username} tried to access Superset")

You can use something similar to this:

if roles:
    return roles
if not bool("{{SUPERSET_BLOCK_STUDENT_ACCESS}}"):
   return ["student", f"student - {language}"]
raise Exception(f"Student {username} tried to access Superset")

[Ian2012]

Also, as you are replicating the permissions for the instructor role. Can you create a template that holds the shared permissions for both roles and inject it where it corresponds?

[Ian2012]

cc @nandodev-net

[bmtcril]

I'm somewhat concerned about this logic. Having a student role returned here would override SUPERSET_BLOCK_STUDENT_ACCESS. Maybe not a big deal, but can we add a check for that and throw an exception if it happens?

[bmtcril]

Thanks @nandodev-net , looks good to me!

[openedx-webhooks]

@nandodev-net 🎉 Your pull request was merged! Please take a moment to answer a two question survey so we can improve your experience in the future.