Restrict charts

[keanec27]

Hi,

Is there a way to restrict access to charts such that a user can only view charts created by them and the charts created by admin

[dosubot[bot]]

Hi @keanec27! I'm Dosu and I’m helping the superset team.

Superset supports chart-level access control based on ownership and admin privileges. By default, users can view charts they own or have created, and admins can view all charts. Recent updates allow filtering charts by fields like owners, created_by, and changed_by, which you can use to restrict chart visibility in the API or UI to those created by the user or by admins (see code reference, PR #29287).

There isn't a built-in filter that directly combines "charts created by the user OR by admin," but you can achieve this by customizing filters or queries to include both the current user's ID and the admin's user ID in the created_by field. Access checks also consider dataset permissions, so users must have access to the underlying data source as well (unit test reference).

If you need this restriction in the UI, you may need to extend the existing filters or implement a custom filter that matches charts where created_by is either the current user or an admin.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[keanec27]

@dosu Instead of owners can you filter by created by ?

[dosubot[bot]]

Yes, you can filter charts by the user who created them using the created_by field instead of owners. In Superset, this is done by filtering on the Slice.created_by_fk field, which is a single user ID (not a list like owners) reference.

To filter charts created by the current user and/or a list of users (by email or username), resolve those identifiers to user IDs, then filter with Slice.created_by_fk.in_(user_ids). Here’s an example filter for superset/charts/filters.py:

from superset.charts.filters import BaseFilter
from superset.models.slice import Slice
from superset.security import get_username, security_manager
from sqlalchemy.orm import Query

class ChartCreatedByUsersFilter(BaseFilter):
    name = "Created by users"
    arg_name = "chart_created_by_users"

    def apply(self, query: Query, value) -> Query:
        if security_manager.is_admin():
            return query  # Admins see all charts

        # value should be a list of emails or usernames
        user_ids = []
        current_user = security_manager.get_user_by_username(get_username())
        if current_user:
            user_ids.append(current_user.id)
        for identifier in value or []:
            user = security_manager.get_user_by_username(identifier)
            if not user:
                user = security_manager.get_session.query(security_manager.user_model).filter(
                    security_manager.user_model.email == identifier
                ).one_or_none()
            if user:
                user_ids.append(user.id)
        user_ids = list(set(user_ids))
        if not user_ids:
            return query.filter(False)
        return query.filter(Slice.created_by_fk.in_(user_ids))

Register this filter in base_filters in superset/charts/api.py to enforce it globally. This approach matches how Superset handles filtering by created_by in the API and frontend reference.

Let me know if you want a version that only uses emails or only usernames!

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[keanec27]

@dosu Modify the filter so it should return charts created by username admin or charts where the current user is an owner

[dosubot[bot]]

You've reached the anonymous usage limit of 10 interactions per month. Your usage will reset on 2025-12-01. If you'd like to use Dosu before then, please register to increase your limit to 100 interactions per month for free.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}

   

[gpandolfino]

Is there a way to filter the user list by role?