`.
@font-family-monospace: Menlo, Monaco, Consolas, "Courier New", monospace;
-@font-family-base: @font-family-sans-serif;
+@font-family-base: @font-family-montserrat;
@font-size-base: 14px;
@font-size-large: ceil((@font-size-base * 1.25)); // ~18px
diff --git a/superset/assets/stylesheets/less/index.less b/superset/assets/stylesheets/less/index.less
index b1fc604323c0..9508c2d31fd3 100644
--- a/superset/assets/stylesheets/less/index.less
+++ b/superset/assets/stylesheets/less/index.less
@@ -22,6 +22,8 @@
@import "./cosmo/variables.less";
@import "./cosmo/bootswatch.less";
+@import (css) url("https://fonts.googleapis.com/css?family=Montserrat");
+
@stroke-primary: @brand-primary;
body {
diff --git a/superset/assets/stylesheets/superset.less b/superset/assets/stylesheets/superset.less
index a8aa49a4ba08..a8fcf306da72 100644
--- a/superset/assets/stylesheets/superset.less
+++ b/superset/assets/stylesheets/superset.less
@@ -258,7 +258,7 @@ table.table-no-hover tr:hover {
}
.editable-title.datasource-sql-expression {
- font-family: @font-family-monospace;
+ font-family: @font-family-montserrat;
font-size: 95%;
display: inline-block;
min-width: @datasource-sql-expression-width;
diff --git a/superset/config.py b/superset/config.py
index f92246f42866..161147b82a0c 100644
--- a/superset/config.py
+++ b/superset/config.py
@@ -35,6 +35,8 @@
from superset.stats_logger import DummyStatsLogger
from superset.utils.logging_configurator import DefaultLoggingConfigurator
+from werkzeug.contrib.cache import RedisCache
+from .custom_auth import CustomSecurityManager
# Realtime stats logger, a StatsD implementation exists
STATS_LOGGER = DummyStatsLogger()
@@ -70,8 +72,8 @@ def _try_json_readfile(filepath):
PACKAGE_JSON_FILE
)
-ROW_LIMIT = 50000
-VIZ_ROW_LIMIT = 10000
+ROW_LIMIT = 50000000
+VIZ_ROW_LIMIT = 10000000
# max rows retrieved by filter select auto complete
FILTER_SELECT_ROW_LIMIT = 10000
SUPERSET_WORKERS = 2 # deprecated
@@ -84,21 +86,26 @@ def _try_json_readfile(filepath):
# [load balancer / proxy / envoy / kong / ...] timeout settings.
# You should also make sure to configure your WSGI server
# (gunicorn, nginx, apache, ...) timeout setting to be <= to this setting
-SUPERSET_WEBSERVER_TIMEOUT = 60
+SUPERSET_WEBSERVER_TIMEOUT = 120
SUPERSET_DASHBOARD_POSITION_DATA_LIMIT = 65535
EMAIL_NOTIFICATIONS = False
-CUSTOM_SECURITY_MANAGER = None
+CUSTOM_SECURITY_MANAGER = CustomSecurityManager
SQLALCHEMY_TRACK_MODIFICATIONS = False
# ---------------------------------------------------------
+TENANT = os.environ['TENANT']
# Your App secret key
-SECRET_KEY = "\2\1thisismyscretkey\1\2\e\y\y\h" # noqa
+SECRET_KEY = "\2\1thisis{}secretkey\1\2\e\y\y\h".format(TENANT) # noqa
+
+REDIS_ENDPOINT = os.environ['REDIS_ENDPOINT']
+SQLALCHEMY_ENGINE_OPTIONS = json.loads(os.environ['SQLALCHEMY_ENGINE_OPTIONS'])
# The SQLAlchemy connection string.
-SQLALCHEMY_DATABASE_URI = "sqlite:///" + os.path.join(DATA_DIR, "superset.db")
-# SQLALCHEMY_DATABASE_URI = 'mysql://myapp@localhost/myapp'
-# SQLALCHEMY_DATABASE_URI = 'postgresql://root:password@localhost/myapp'
+SQLALCHEMY_DATABASE_URI = os.environ['SQLALCHEMY_DATABASE_URI']
+# SQLALCHEMY_DATABASE_URI="sqlite:///" + os.path.join(DATA_DIR, "superset.db")
+# SQLALCHEMY_DATABASE_URI='mysql://myapp@localhost/myapp'
+# SQLALCHEMY_DATABASE_URI='postgresql://root:password@localhost/myapp'
# In order to hook up a custom password store for all SQLACHEMY connections
# implement a function that takes a single argument of type 'sqla.engine.url',
@@ -136,11 +143,11 @@ def _try_json_readfile(filepath):
# GLOBALS FOR APP Builder
# ------------------------------
# Uncomment to setup Your App name
-APP_NAME = "Superset"
+APP_NAME = "{}-Superset".format(TENANT)
# Uncomment to setup an App icon
APP_ICON = "/static/assets/images/superset-logo@2x.png"
-APP_ICON_WIDTH = 126
+APP_ICON_WIDTH = 60
# Uncomment to specify where clicking the logo would take the user
# e.g. setting it to '/welcome' would take the user to '/superset/welcome'
@@ -168,7 +175,7 @@ def _try_json_readfile(filepath):
AUTH_TYPE = AUTH_DB
# Uncomment to setup Full admin role name
-# AUTH_ROLE_ADMIN = 'Admin'
+AUTH_ROLE_ADMIN = 'Admin'
# Uncomment to setup Public role name, no authentication needed
# AUTH_ROLE_PUBLIC = 'Public'
@@ -262,12 +269,22 @@ def _try_json_readfile(filepath):
# IMG_SIZE = (300, 200, True)
CACHE_DEFAULT_TIMEOUT = 60 * 60 * 24
-CACHE_CONFIG = {"CACHE_TYPE": "null"}
+CACHE_CONFIG = {
+ 'CACHE_TYPE': 'redis',
+ 'CACHE_DEFAULT_TIMEOUT': 300,
+ 'CACHE_KEY_PREFIX': '{}_superset_'.format(TENANT),
+ 'CACHE_REDIS_HOST': 'redis',
+ 'CACHE_REDIS_PORT': 6379,
+ 'CACHE_REDIS_DB': 1,
+ 'CACHE_REDIS_URL': 'redis://{}/1'.format(REDIS_ENDPOINT)
+}
TABLE_NAMES_CACHE_CONFIG = {"CACHE_TYPE": "null"}
# CORS Options
-ENABLE_CORS = False
-CORS_OPTIONS = {}
+ENABLE_CORS = True
+CORS_OPTIONS = {
+ 'origins': '*',
+}
# Chrome allows up to 6 open connections per domain at a time. When there are more
# than 6 slices in dashboard, a lot of time fetch requests are queued up and wait for
@@ -406,26 +423,20 @@ def _try_json_readfile(filepath):
class CeleryConfig(object):
- BROKER_URL = "sqla+sqlite:///celerydb.sqlite"
- CELERY_IMPORTS = ("superset.sql_lab", "superset.tasks")
- CELERY_RESULT_BACKEND = "db+sqlite:///celery_results.sqlite"
- CELERYD_LOG_LEVEL = "DEBUG"
- CELERYD_PREFETCH_MULTIPLIER = 1
- CELERY_ACKS_LATE = False
- CELERY_ANNOTATIONS = {
- "sql_lab.get_sql_results": {"rate_limit": "100/s"},
- "email_reports.send": {
- "rate_limit": "1/s",
- "time_limit": 120,
- "soft_time_limit": 150,
- "ignore_result": True,
- },
- }
+ BROKER_URL = 'redis://{}/0'.format(REDIS_ENDPOINT)
+ CELERY_IMPORTS = ('superset.sql_lab', 'superset.tasks')
+ CELERY_RESULT_BACKEND = 'redis://{}/0'.format(REDIS_ENDPOINT)
+ CELERY_ANNOTATIONS = {'tasks.add': {'rate_limit': '10/s'}}
CELERYBEAT_SCHEDULE = {
- "email_reports.schedule_hourly": {
- "task": "email_reports.schedule_hourly",
- "schedule": crontab(minute=1, hour="*"),
- }
+ 'cache-warmup-hourly': {
+ 'task': 'cache-warmup',
+ 'schedule': crontab(minute=0, hour='*'), # hourly
+ 'kwargs': {
+ 'strategy_name': 'top_n_dashboards',
+ 'top_n': 5,
+ 'since': '7 days ago',
+ },
+ },
}
@@ -457,7 +468,12 @@ class CeleryConfig(object):
# An instantiated derivative of werkzeug.contrib.cache.BaseCache
# if enabled, it can be used to store the results of long-running queries
# in SQL Lab by using the "Run Async" button/feature
-RESULTS_BACKEND = None
+[redis_host, redis_port] = REDIS_ENDPOINT.split(':')
+RESULTS_BACKEND = RedisCache(
+ host=redis_host,
+ port=int(redis_port),
+ key_prefix='{}_superset_results'.format(TENANT),
+)
# Use PyArrow and MessagePack for async query results serialization,
# rather than JSON. This feature requires additional testing from the
diff --git a/superset/custom_auth.py b/superset/custom_auth.py
new file mode 100644
index 000000000000..16982b0c8931
--- /dev/null
+++ b/superset/custom_auth.py
@@ -0,0 +1,70 @@
+from flask import redirect, g, flash, request, app
+from flask_appbuilder.security.views import UserDBModelView, AuthDBView
+from superset.security import SupersetSecurityManager
+from flask_appbuilder.security.views import expose
+from flask_appbuilder.security.manager import BaseSecurityManager
+from flask_login import login_user, logout_user
+from ais_service_discovery import call
+from datetime import timedelta, datetime
+from json import loads
+from os import environ
+
+
+app.permanent_session_lifetime = timedelta(minutes=60)
+
+
+def has_resource_access(privileges):
+ for config in privileges['level']['tenant']['tenants']:
+ if config['tenant'] == environ['TENANT']:
+ for resource in config['resources']:
+ if ('appId' in resource) and resource['appId'] == 'customerAi':
+ return True
+ return False
+
+
+class CustomAuthDBView(AuthDBView):
+
+ @expose('/login/', methods=['GET', 'POST'])
+ def login(self):
+ redirect_url = self.appbuilder.get_url_for_index
+ user = 'guest'
+ try:
+ if request.args.get('redirect') is not None:
+ redirect_url = request.args.get('redirect')
+
+ if request.args.get('authToken') is not None:
+ token = 'Bearer {}'.format(request.args.get('authToken'))
+ auth_response = loads(call(
+ 'ais-{}'.format(environ['STAGE']),
+ 'authentication',
+ 'auth', {
+ 'authorizationToken': token
+ }))['context']
+ if not auth_response['tenant'] == environ['TENANT']:
+ raise Exception('Tenant mismatch in token')
+ if auth_response['role'] in ['tenantManager', 'tenantAdmin']:
+ user = 'admin'
+ else:
+ privileges = loads(auth_response['privileges'])
+ if not has_resource_access(privileges):
+ raise Exception('Insufficient Resource Permissions')
+ user = self.appbuilder.sm.find_user(user)
+ login_user(user, remember=False,
+ duration=timedelta(
+ auth_response['exp'] - int(
+ datetime.now().timestamp())))
+ return redirect(redirect_url)
+ elif g.user is not None and g.user.is_authenticated:
+ return redirect(redirect_url)
+ else:
+ raise Exception('Login is valid only through "authToken"')
+ except Exception as e:
+ flash(e, 'warning')
+ return super(CustomAuthDBView, self).login()
+
+
+class CustomSecurityManager(SupersetSecurityManager):
+ authdbview = CustomAuthDBView
+
+ def __init__(self, appbuilder):
+ super(CustomSecurityManager, self).__init__(appbuilder)
diff --git a/superset/models/core.py b/superset/models/core.py
index e3dcafa0a701..c152686e4218 100755
--- a/superset/models/core.py
+++ b/superset/models/core.py
@@ -861,7 +861,7 @@ def get_effective_user(self, url, user_name=None):
return effective_username
@utils.memoized(watch=("impersonate_user", "sqlalchemy_uri_decrypted", "extra"))
- def get_sqla_engine(self, schema=None, nullpool=True, user_name=None, source=None):
+ def get_sqla_engine(self, schema=None, nullpool=False, user_name=None, source=None):
extra = self.get_extra()
url = make_url(self.sqlalchemy_uri_decrypted)
url = self.db_engine_spec.adjust_database_uri(url, schema)
diff --git a/superset/security.py b/superset/security.py
index 8c95f8147118..f786c74bf190 100644
--- a/superset/security.py
+++ b/superset/security.py
@@ -100,6 +100,9 @@ class SupersetSecurityManager(SecurityManager):
"ResetPasswordView",
"RoleModelView",
"Security",
+ "Sources",
+ "Dashboards",
+ "Charts",
} | USER_MODEL_VIEWS
ALPHA_ONLY_VIEW_MENUS = {"Upload a CSV"}
@@ -111,6 +114,9 @@ class SupersetSecurityManager(SecurityManager):
"can_override_role_permissions",
"can_approve",
"can_update_role",
+ "can_edit",
+ "can_explore",
+ "can_csv"
}
READ_ONLY_PERMISSION = {"can_show", "can_list"}
@@ -131,6 +137,8 @@ class SupersetSecurityManager(SecurityManager):
ACCESSIBLE_PERMS = {"can_userinfo"}
+ GAMMA_ACCESSIBLE_PERMS = {"all_datasource_access"}
+
def get_schema_perm(
self, database: Union["Database", str], schema: Optional[str] = None
) -> Optional[str]:
@@ -649,6 +657,16 @@ def _is_accessible_to_all(self, pvm: PermissionModelView) -> bool:
return pvm.permission.name in self.ACCESSIBLE_PERMS
+ def _is_accessible_to_gamma(self, pvm: PermissionModelView) -> bool:
+ """
+ Return True if the FAB permission/view is accessible to gamma users, False
+ otherwise.
+
+ :param pvm: The FAB permission/view
+ :returns: Whether the FAB object is accessible to gamma users
+ """
+ return pvm.permission.name in self.GAMMA_ACCESSIBLE_PERMS
+
def _is_admin_pvm(self, pvm: PermissionModelView) -> bool:
"""
Return True if the FAB permission/view is Admin user related, False
@@ -686,7 +704,7 @@ def _is_gamma_pvm(self, pvm: PermissionModelView) -> bool:
self._is_user_defined_permission(pvm)
or self._is_admin_only(pvm)
or self._is_alpha_only(pvm)
- ) or self._is_accessible_to_all(pvm)
+ ) or self._is_accessible_to_all(pvm) or self._is_accessible_to_gamma(pvm)
def _is_sql_lab_pvm(self, pvm: PermissionModelView) -> bool:
"""
@@ -791,3 +809,6 @@ def assert_datasource_permission(self, datasource: "BaseDatasource") -> None:
self.get_datasource_access_error_msg(datasource),
self.get_datasource_access_link(datasource),
)
+
+ def contains_gamma_role(self, roles) -> None:
+ return "Gamma" in roles
diff --git a/superset/templates/appbuilder/navbar.html b/superset/templates/appbuilder/navbar.html
index 29c22411299e..4fd2d59c0980 100644
--- a/superset/templates/appbuilder/navbar.html
+++ b/superset/templates/appbuilder/navbar.html
@@ -30,20 +30,14 @@
-
- 
-
+
-
+
\ No newline at end of file
diff --git a/superset/templates/appbuilder/navbar_right.html b/superset/templates/appbuilder/navbar_right.html
index 73c545e3974a..2f2520f1f300 100644
--- a/superset/templates/appbuilder/navbar_right.html
+++ b/superset/templates/appbuilder/navbar_right.html
@@ -21,81 +21,72 @@
{% set documentation_url = appbuilder.app.config.get('DOCUMENTATION_URL') %}
{% set locale = session['locale'] %}
{% if not locale %}
- {% set locale = 'en' %}
+{% set locale = 'en' %}
{% endif %}
-
-{% if not current_user.is_anonymous %}
-
-
-
-
+
+
+
+
+
- 
-
- {% endblock %}
+
+ {% block navbar %}
+ {% if not standalone_mode %}
+
-
-
-
-
-
-
-
-
-
-
+ {% block body %}
+
+
+
+ {% endblock %}
+
+
+
+
+
+ {% block tail_js %}
+ {% if entry %}
+ {% with filename=entry %}
+ {% include "superset/partials/_script_tag.html" %}
+ {% endwith %}
+ {% endif %}
+ {% endblock %}
+
+
+
+
- {% block tail_js %}
- {% if entry %}
- {% with filename=entry %}
- {% include "superset/partials/_script_tag.html" %}
- {% endwith %}
- {% endif %}
- {% endblock %}
-
-
+