feat(ui): Disable user selection of data when user does not have export permissions

[MialLewis]

SUMMARY

Disables the user selection of data from the sqllab resultTable, plugin-chart-pivot-table and plugin-chart-table if the user does not have the can_export_csv / can_csv role. This is based off: #28429.

Relevant discussion: #29078

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

[github-actions]

Congrats on making your first PR and thank you for contributing to Superset! 🎉 ❤️

We hope to see you in our Slack community too! Not signed up? Use our Slack App to self-register.

[MialLewis]

@rusackas I'm pinging you as you merged a related PR #28429.

I'm working to disable user select for data, which is required for our sensitive data. The more blockers we can put in the place of data export the better, even if they can be circumvented.

We are willing to fork superset to do this, but getting it merged would obviously be better! Do you think there would be any appetite for this change, willing to put behind a feature flag if necessary.

Also, any suggestions/examples of how best to use the permissions model inside the frontend plugins?

Thanks!

[MialLewis]

This is ready for someone to take a look. I'm very open to feedback as this is the first time I've used react. I do have very limited time to work on this though, it's already serving our purposes as it.

Thanks!

[justinpark]

For similar reasons above, adding a user state to ChartContainer and ChartRenderer and including this kind of logic would not be flexible in terms of component reusability. Therefore, it would be more appropriate to handle this at the dashboard or explore component level. (Additionally, in the case of the findPermission logic, if there are many charts in the dashboard, repeating the same n+1 search logic for each chart in the user permission list would lead to inefficiency.)

In other words, this permission logic should be included in DashboardBuilder and passed as a property value to DashboardComponent, allowing access through this.props.canExportData.
Similarly, if it's included in ExploreChartPanel and passed as a property to ChartContainer, it can be accessed in the same way.

[MialLewis]

With regards to dashboards, there is already an equivalent property supersetCanCSV passed through to dashboard/components/gridCompnents/Chart.jsx, so we can pass that to ChartContainer: canExportData={supersetCanCSV}

[rusackas]

Running CI. Ping us if it gets stuck!

[MialLewis]

Thanks for the review @justinpark, I've made the changes you suggested.

@rusackas would you mind running the CI again, it wasn't quite ready last time. I've run prettier locally so hopefully that will stop the failures.

[MialLewis]

@rusackas could you re-run the CI please? Turns out the "unneeded" test change I removed in an above commit was in fact needed.

I've built the js packages locally and see no test failures now. I haven't been able to run the cypress tests however as I see a message": "400 Bad Request: The CSRF token is missing when cypress attempts to login.

[rusackas]

Running CI 🤞

[rusackas]

Hi there... sorry this thing seems to have fallen under our radar. We're trying to thin the backlog of unmergeable things, so we can keep a better handle on the situation and have this happen less often. I'm not sure how hard this is to rebase, but if you want to give it a go, we can try to get it merged (finally). I'll convert it to a draft in the meantime, and nowadays when you mark it ready for review, it'll get our attention again.

[rusackas]

This draft hasn't been updated in >90 days, so it will be closed. Please feel free to reopen it at any time, or ping us on this thread for further help.