Fix permissions checking when Card contains Metric or Segment

src/metabase/models/card.clj

@@ -12,9 +12,8 @@
                              [revision :as revision]
                              [user :as user])
             [metabase.query :as q]
-            [metabase.query-processor.expand :as expand]
+            [metabase.query-processor :as qp]
             [metabase.query-processor.permissions :as qp-perms]
-            [metabase.query-processor.resolve :as resolve]
             [metabase.util :as u]))
 
 
@@ -41,7 +40,7 @@
 
 (defn- permissions-path-set:mbql [{database-id :database, :as query}]
   {:pre [(integer? database-id) (map? (:query query))]}
-  (let [{{:keys [source-table join-tables]} :query} (resolve/resolve (expand/expand query))]
+  (let [{{:keys [source-table join-tables]} :query} (qp/expand query)]
     (set (for [table (cons source-table join-tables)]
            (perms/object-path database-id
                               (:schema table)

src/metabase/query_processor.clj

@@ -526,7 +526,6 @@
 ;;
 ;; Post-processing then happens in order from bottom-to-top; i.e. POST-ANNOTATE gets to modify the results, then LIMIT, then CUMULATIVE-SUM, etc.
 
-
 (defn process-query
   "Process an MBQL structured or native query, and return the result."
   {:style/indent 0}
@@ -556,6 +555,16 @@
             run-query) (assoc query :driver driver)))))
 
 
+(def ^{:arglists '([query])} expand
+  "Expand a QUERY the same way it would normally be done as part of query processing.
+   This is useful for things that need to look at an expanded query, such as permissions checking for Cards."
+  (comp expand-resolve
+        substitute-parameters
+        expand-macros))
+
+
+
+
 ;;; +----------------------------------------------------------------------------------------------------+
 ;;; |                                     DATASET-QUERY PUBLIC API                                       |
 ;;; +----------------------------------------------------------------------------------------------------+