fix: grant SELECT access to a subset of superset metadata tables

openedx · Oct 26, 2023 · 60d0f37 · 60d0f37
1 parent cc86114
commit 60d0f37
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/tutoraspects/templates/aspects/jobs/init/init-mysql.sh b/tutoraspects/templates/aspects/jobs/init/init-mysql.sh
@@ -25,4 +25,7 @@ mysql -u {{ MYSQL_ROOT_USERNAME }} --password="{{ MYSQL_ROOT_PASSWORD }}" --host
 # Superset metadata user (read-only)
 mysql -u {{ MYSQL_ROOT_USERNAME }} --password="{{ MYSQL_ROOT_PASSWORD }}" --host "{{ MYSQL_HOST }}" --port {{ MYSQL_PORT }} -e "CREATE USER IF NOT EXISTS '{{ SUPERSET_DB_METADATA_USERNAME }}';"
 mysql -u {{ MYSQL_ROOT_USERNAME }} --password="{{ MYSQL_ROOT_PASSWORD }}" --host "{{ MYSQL_HOST }}" --port {{ MYSQL_PORT }} -e "ALTER USER '{{ SUPERSET_DB_METADATA_USERNAME }}'@'%' IDENTIFIED BY '{{ SUPERSET_DB_METADATA_PASSWORD }}';"
-mysql -u {{ MYSQL_ROOT_USERNAME }} --password="{{ MYSQL_ROOT_PASSWORD }}" --host "{{ MYSQL_HOST }}" --port {{ MYSQL_PORT }} -e "GRANT SELECT, EXECUTE ON {{ SUPERSET_DB_METADATA_NAME }}.* TO '{{ SUPERSET_DB_METADATA_USERNAME }}'@'%';"
+# Grant SELECT access to a subset of superset tables:
+for TABLE in ab_user dashboards logs slices tables; do
+    mysql -u {{ MYSQL_ROOT_USERNAME }} --password="{{ MYSQL_ROOT_PASSWORD }}" --host "{{ MYSQL_HOST }}" --port {{ MYSQL_PORT }} -e "GRANT SELECT ON {{ SUPERSET_DB_METADATA_NAME }}.${TABLE} TO '{{ SUPERSET_DB_METADATA_USERNAME }}'@'%';"
+done