Skip to content

chore: Fix/remove hardcode of admin role #27779

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Always-prog wants to merge 8 commits into
base: master
Choose a base branch
from
+6 −6
Open

chore: Fix/remove hardcode of admin role #27779

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
b7e9497
fix(chore): Removed hardcode of admin role from permission utils
Always-prog Mar 27, 2024
65424d5
added adminRole type to Window
Always-prog Mar 27, 2024
9972913
fix tests cases that can't read adminRole
Always-prog Mar 27, 2024
cc20ec8
comment AUTH_ROLE_ADMIN
Always-prog Apr 2, 2024
3fb0954
moved adminRole to shim
Always-prog Apr 3, 2024
2baff80
using admin role from bootstrap
Always-prog Apr 15, 2024
95ef7cc
default value for admin role at the frontend
Always-prog Jun 3, 2024
828cc5e
chore: revert accidental file-mode change on shim.tsx
rusackas Jul 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions superset-frontend/src/dashboard/util/permissionUtils.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,17 +24,17 @@ import {
} from 'src/types/bootstrapTypes';
import { Dashboard } from 'src/types/Dashboard';
import { findPermission } from 'src/utils/findPermission';
import getBootstrapData from 'src/utils/getBootstrapData';

// this should really be a config value,
// but is hardcoded in backend logic already, so...
const ADMIN_ROLE_NAME = 'admin';
const bootstrapData = getBootstrapData();
const ADMIN_ROLE_NAME = bootstrapData.common.conf.AUTH_ROLE_ADMIN || 'Admin';

@mistercrunch mistercrunch Aug 12, 2025

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mmmmh, seems ADMIN_ROLE_NAME != AUTH_ROLE_ADMIN. AUTH_ROLE_ADMIN probably exist do it can diverge from the global ADMIN_ROLE - assuming this exists. Maybe FAB exposes it somewhere? Would have to be carried to the frontend?

Comment on lines +29 to +30

@bito-code-review bito-code-review Bot Jun 27, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Incomplete test coverage for configurable admin role

The module-level getBootstrapData() call is not mocked in tests, creating a testing gap for the new configurable ADMIN_ROLE_NAME functionality. Tests rely on DEFAULT_BOOTSTRAP_DATA which has conf: {}, so the custom AUTH_ROLE_ADMIN path is never exercised. Consider adding mock setup in beforeAll to control the admin role name and verify case-insensitive matching behavior for both default and custom values.

Code Review Run #080cad

Should Bito avoid suggestions like this for future reviews? (Manage Rules)

  • Yes, avoid them


export const isUserAdmin = (
user?: UserWithPermissionsAndRoles | UndefinedUser,
) =>
isUserWithPermissionsAndRoles(user) &&
Object.keys(user.roles || {}).some(
role => role.toLowerCase() === ADMIN_ROLE_NAME,
role => role.toLowerCase() === ADMIN_ROLE_NAME.toLowerCase(),
);

const isUserDashboardOwner = (
Expand Down
3 changes: 1 addition & 2 deletions superset/config.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -460,8 +460,7 @@ def _try_json_readsha(filepath: str, length: int) -> str | None:
# AUTH_REMOTE_USER : Is for using REMOTE_USER from web server
AUTH_TYPE = AUTH_DB

# Uncomment to setup Full admin role name
# AUTH_ROLE_ADMIN = 'Admin'
# AUTH_ROLE_ADMIN = "Admin"

# Uncomment to setup Public role name, no authentication needed
# AUTH_ROLE_PUBLIC = 'Public'
Expand Down
1 change: 1 addition & 0 deletions superset/views/base.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,7 @@
from .utils import bootstrap_user_data, get_config_value

FRONTEND_CONF_KEYS = (
"AUTH_ROLE_ADMIN",
"SUPERSET_WEBSERVER_TIMEOUT",
"SUPERSET_DASHBOARD_POSITION_DATA_LIMIT",
"SUPERSET_DASHBOARD_PERIODICAL_REFRESH_LIMIT",
Expand Down
Loading