diff --git a/e2e/test/scenarios/permissions/view-data.cy.spec.js b/e2e/test/scenarios/permissions/view-data.cy.spec.js index c3e73fecf16e56df26ddbb27e1dd8c2fc7bd2d1d..5b52028664b1d1fb5dc390323492e3efeec6fa61 100644 --- a/e2e/test/scenarios/permissions/view-data.cy.spec.js +++ b/e2e/test/scenarios/permissions/view-data.cy.spec.js @@ -58,6 +58,20 @@ describeEE("scenarios > admin > permissions > view data > blocked", () => { assertPermissionForItem(g, DOWNLOAD_PERM_IDX, "No", true); }); + cy.log( + "assert that user properly sees native query warning related to table level blocking", + ); + getPermissionRowPermissions("All Users") + .eq(DATA_ACCESS_PERM_IDX) + .findByLabelText("warning icon") + .realHover(); + + cy.findByRole("tooltip") + .findByText( + /Users in groups with Blocked on a table can't view native queries on this database/, + ) + .should("exist"); + cy.visit(`/admin/permissions/data/database/${SAMPLE_DB_ID}`); // database level assertPermissionForItem(g, DATA_ACCESS_PERM_IDX, "Granular", false); diff --git a/frontend/src/metabase/admin/permissions/selectors/confirmations.tsx b/frontend/src/metabase/admin/permissions/selectors/confirmations.tsx index f407f9e39249f96bdaa9ebf5e43d33f78a8e76cc..44bf8539d7043ec20d3c3ae89f4fae909b947447 100644 --- a/frontend/src/metabase/admin/permissions/selectors/confirmations.tsx +++ b/frontend/src/metabase/admin/permissions/selectors/confirmations.tsx @@ -90,6 +90,24 @@ export function getPermissionWarning( return null; } +export function getTableBlockWarning( + dbValue: DataPermissionValue, + schemaValue: DataPermissionValue, + tableValue?: DataPermissionValue, +) { + if (dbValue === DataPermissionValue.BLOCKED) { + return; + } + + if (schemaValue === DataPermissionValue.BLOCKED) { + return t`Users in groups with Blocked on a schema can't view native queries on this database.`; + } + + if (tableValue === DataPermissionValue.BLOCKED) { + return t`Users in groups with Blocked on a table can't view native queries on this database.`; + } +} + function getEntityTypeFromId(entityId: EntityId): [string, string] { return isTableEntityId(entityId) ? [t`table`, t`tables`] diff --git a/frontend/src/metabase/admin/permissions/selectors/data-permissions/fields.ts b/frontend/src/metabase/admin/permissions/selectors/data-permissions/fields.ts index d17b991e6160d44e13e746a219e5db93907b3a0b..d3f535aee1cf35aa448986c78f576d0d07d604e2 100644 --- a/frontend/src/metabase/admin/permissions/selectors/data-permissions/fields.ts +++ b/frontend/src/metabase/admin/permissions/selectors/data-permissions/fields.ts @@ -3,6 +3,7 @@ import _ from "underscore"; import { getNativePermissionDisabledTooltip } from "metabase/admin/permissions/selectors/data-permissions/shared"; import { getFieldsPermission, + getSchemasPermission, getTablesPermission, } from "metabase/admin/permissions/utils/graph"; import { @@ -28,6 +29,7 @@ import { getPermissionWarning, getPermissionWarningModal, getRevokingAccessToAllTablesWarningModal, + getTableBlockWarning, getWillRevokeNativeAccessWarningModal, } from "../confirmations"; @@ -53,6 +55,7 @@ const buildAccessPermission = ( entityId, DataPermission.VIEW_DATA, ); + const defaultGroupValue = getFieldsPermission( permissions, defaultGroup.id, @@ -60,7 +63,21 @@ const buildAccessPermission = ( DataPermission.VIEW_DATA, ); - const warning = getPermissionWarning( + const dbValue = getSchemasPermission( + originalPermissions, + groupId, + entityId, + DataPermission.VIEW_DATA, + ); + + const schemaValue = getTablesPermission( + originalPermissions, + groupId, + entityId, + DataPermission.VIEW_DATA, + ); + + const permissionWarning = getPermissionWarning( value, defaultGroupValue, "fields", @@ -68,6 +85,10 @@ const buildAccessPermission = ( groupId, ); + const blockWarning = getTableBlockWarning(dbValue, schemaValue, value); + + const warning = permissionWarning || blockWarning; + const confirmations = (newValue: DataPermissionValue) => [ getPermissionWarningModal( newValue, diff --git a/frontend/src/metabase/admin/permissions/selectors/data-permissions/tables.ts b/frontend/src/metabase/admin/permissions/selectors/data-permissions/tables.ts index 55560b54f0a60cced4301a4f50c7073b884d5ce8..421601303873a3653a8ceecac67d3da0c2714edb 100644 --- a/frontend/src/metabase/admin/permissions/selectors/data-permissions/tables.ts +++ b/frontend/src/metabase/admin/permissions/selectors/data-permissions/tables.ts @@ -25,6 +25,7 @@ import { import { getPermissionWarning, getPermissionWarningModal, + getTableBlockWarning, getViewDataPermissionsTooRestrictiveWarningModal, getWillRevokeNativeAccessWarningModal, } from "../confirmations"; @@ -58,7 +59,14 @@ const buildAccessPermission = ( DataPermission.VIEW_DATA, ); - const warning = getPermissionWarning( + const dbValue = getSchemasPermission( + originalPermissions, + groupId, + entityId, + DataPermission.VIEW_DATA, + ); + + const permissionWarning = getPermissionWarning( value, defaultGroupValue, "tables", @@ -66,6 +74,10 @@ const buildAccessPermission = ( groupId, ); + const blockWarning = getTableBlockWarning(dbValue, value); + + const warning = permissionWarning || blockWarning; + const confirmations = (newValue: DataPermissionValue) => [ getPermissionWarningModal( newValue,