fix: database alpha permissions (apache#12136)

* fix: database alpha permissions * add test (cherry picked from commit 2f0add3)
preset-io · Dec 21, 2020 · ce05a3d · ce05a3d
1 parent c6a08fd
commit ce05a3d
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/superset/security/manager.py b/superset/security/manager.py
@@ -109,7 +109,7 @@ class SupersetSecurityManager(  # pylint: disable=too-many-public-methods
     SecurityManager
 ):
     userstatschartview = None
-    READ_ONLY_MODEL_VIEWS = {"DatabaseAsync", "DatabaseView", "DruidClusterModelView"}
+    READ_ONLY_MODEL_VIEWS = {"Database", "DruidClusterModelView", "DynamicPlugin"}
 
     USER_MODEL_VIEWS = {
         "UserDBModelView",

diff --git a/tests/security_tests.py b/tests/security_tests.py
@@ -685,6 +685,7 @@ def assert_can_alpha(self, perm_set):
         self.assert_can_all("CssTemplate", perm_set)
         self.assert_can_all("Dataset", perm_set)
         self.assert_can_read("Query", perm_set)
+        self.assert_can_read("Database", perm_set)
         self.assertIn(("can_import_dashboards", "Superset"), perm_set)
         self.assertIn(("can_this_form_post", "CsvToDatabaseView"), perm_set)
         self.assertIn(("can_this_form_get", "CsvToDatabaseView"), perm_set)
@@ -701,6 +702,7 @@ def assert_cannot_alpha(self, perm_set):
         self.assert_cannot_write("Queries", perm_set)
         self.assert_cannot_write("RoleModelView", perm_set)
         self.assert_cannot_write("UserDBModelView", perm_set)
+        self.assert_cannot_write("Database", perm_set)
 
     def assert_can_admin(self, perm_set):
         self.assert_can_all("Database", perm_set)