Publishing and permissions¶

Exercise publishing-and-permissions-annex.pdf · PDF

Quick question. Apart from you and your teacher, who has seen your Steam market dashboard?

Nobody. You built the KPI row, the tabs and the filters, and the whole thing still lives where only you can open it. That is a problem, because a dashboard is made to be read by someone else. A dashboard nobody can open is read by nobody, however good its charts are.

So in this lesson you change seats. You stop being the author and become the reader: you log in as a person with almost no rights, find out why they see nothing, and fix it one step at a time.

A game server with two locks¶

Think of a multiplayer game server. While the owner is still building the world, the server is private: only the owner and the admins get in. One day it opens. But even then, each player has a rank, and the rank decides which areas they may enter.

Superset works the same way. Between your dashboard and a reader there are two locks, and each one needs its own key:

flowchart LR
    R["<b>A reader</b><br>logged in to Superset"] --> L1{"<b>Lock 1</b><br>Is the dashboard<br>Published?"}
    L1 -- "No: Draft" --> X1["Not in their list"]
    L1 -- "Yes" --> L2{"<b>Lock 2</b><br>Does one of their roles<br>have access to the dataset?"}
    L2 -- "No" --> X2["Still not in their list"]
    L2 -- "Yes" --> OK["<b>They read the dashboard</b><br>and the filters work"]

We will keep the game server for the whole page. Remember the shape of the diagram: two questions, in that order.

Lock 1: Draft or Published¶

A draft dashboard is one that is still being built: only its owners and the admins can see it. A published dashboard is one the author has declared ready.

Open your Steam market dashboard and look next to its title. There is a small label: Draft. Superset's documentation is blunt about what it means:

"Draft dashboards are only visible to the dashboard owners and admins."

Click the label and it turns into Published. In the Dashboards list, the Status column changes too.

Who are the owners? The users who have permission to edit the dashboard. You are one, because you created it. An owner is the builder of that world; publishing is the moment the builder opens the server.

Lock 2: roles and datasets¶

A role is a named bundle of permissions. Every user has one or more roles, and a user can do exactly what their roles allow.

A permission is one single right: see this menu, read this dataset, edit that chart. Nobody hands out permissions one by one to each user: that would be endless. You put the permissions in a role, and you give the role to people. The role is the rank on the game server.

Superset ships with three main roles. Its documentation describes them like this:

On your own virtual machine you are Admin. That is why everything has always worked: an admin walks through every door. A real reader is usually Gamma.

Now the question that matters. A Gamma user, and a dashboard you have just published. Do they see it?

Not yet. Superset's documentation again:

"Published dashboards are visible to all users with access to the underlying datasets."

Read the last four words slowly. In Superset, permissions hang from the dataset, and the dashboard inherits them. Your Steam market dashboard is built on the dataset games_clean. A Gamma user with no access to games_clean cannot see any chart made from it, so they cannot see the dashboard either.

Published opens the first lock; access to the dataset opens the second.

The least that lets them read¶

You could skip all of this and make every reader an Admin. The dashboard would appear at once. It would also let every reader delete every dashboard and read every dataset on the server.

Security people have a name for the right instinct, and it is older than you might think. In 1975, Jerome Saltzer and Michael Schroeder published a paper called The Protection of Information in Computer Systems. One of its design principles became famous as the principle of least privilege: every user should work with the smallest set of rights that lets them do their job, and nothing more.

For a dashboard reader, that smallest set is easy to write down:

Gamma plus one role. That is the whole recipe, and it is what you will build now.

Try it: the reader's eyes¶

You need two browser windows. The normal one is you, the Admin. A private (incognito) window is the reader. A private window does not share your session, so it is how one person logs in as two users at the same time.

Work on your own VM, in order, and write down each result before you go on. The experiment only makes sense if you see every "no" before you fix it.

Step 1 — A reader who sees nothing. Check that Steam market still says Draft. Then create the reader:

You should see an empty Dashboards list. Charts and Datasets are empty as well. And the menus are shorter: the SQL menu (with SQL Lab) is gone, and so are the Security entries under Settings. A Gamma user cannot even reach the screen where users are created.

Step 2 — Open the first lock. In the Admin window, open Steam market and click Draft → Published. In the private window, reload Dashboards.

Still empty. Do not fix anything yet: this is the most important moment of the lesson. The dashboard is published and the reader still does not see it. The first lock is open. The second is not.

Step 3 — Open the second lock. Now give the reader a rank that reaches the data:

Now the reader opens the dashboard. The KPI row reads 26,685 · 11.6% · 4.99 · 623, exactly as it does for you, and the filters work.

Those four numbers are not a coincidence. The reader's charts run the same query on the same data as yours:

SELECT COUNT(*), ROUND(100 * AVG(is_free::int), 1),
       PERCENTILE_CONT(0.5) WITHIN GROUP (ORDER BY price),
       COUNT(*) FILTER (WHERE owners_tier = 'Hit')
FROM games_clean;

A role decides whether you may read a dataset. It does not change what the dataset says.

Step 4 — A link is not a key. On the dashboard, in the Admin window: the three dots → Share → Copy permalink to clipboard. In the private window, log out and paste the link. Then log in again as viewer and paste it once more.

Logged out, the link sends you to the login page. Logged in as viewer, it opens the dashboard, with the filters exactly as they were when the link was copied. A permalink (permanent link) is an address that remembers the state of the dashboard. It carries no rights at all.

The four states¶

Put your notes side by side. This table is the whole lesson:

In state 2, where was the problem: in the dashboard or in the data? In the data. The dashboard was ready. The reader's rank did not reach the dataset.

Key takeaways¶

• A dashboard exists to be read by someone else. Between it and a reader there are two locks.
• Lock 1 — Draft or Published. A draft is visible only to its owners (the users who may edit it) and to admins. Published means "no longer a draft", not "public on the internet".
• Lock 2 — roles and datasets. A role is a bundle of permissions. Admin can do everything, Alpha sees all data but only alters what it owns, Gamma only sees what is built on datasets it was given.
• Permissions hang from the dataset; the dashboard inherits them. Giving access to a dataset opens everything built on it.
• Least privilege (Saltzer and Schroeder, 1975): give a reader the least that lets them read — Gamma plus one role.
• A permalink is an address, not a key. And roles live in Superset: the database gets no new user.

Quick check¶

Your dashboard now has readers. But what if those readers work somewhere that has never heard of Superset? Next: Reports with Power BI, where you rebuild three of your Steam charts in another tool and check that what you know still works.