{"action":"created","issue":{"url":"https://api.github.com/repos/EverythingMe/redash/issues/636","labels_url":"https://api.github.com/repos/EverythingMe/redash/issues/636/labels{/name}","comments_url":"https://api.github.com/repos/EverythingMe/redash/issues/636/comments","events_url":"https://api.github.com/repos/EverythingMe/redash/issues/636/events","html_url":"https://github.com/EverythingMe/redash/pull/636","id":114921916,"number":636,"title":"Limit access to query using access groups","user":{"login":"tjwudi","id":5257816,"avatar_url":"https://avatars.githubusercontent.com/u/5257816?v=3","gravatar_id":"","url":"https://api.github.com/users/tjwudi","html_url":"https://github.com/tjwudi","followers_url":"https://api.github.com/users/tjwudi/followers","following_url":"https://api.github.com/users/tjwudi/following{/other_user}","gists_url":"https://api.github.com/users/tjwudi/gists{/gist_id}","starred_url":"https://api.github.com/users/tjwudi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tjwudi/subscriptions","organizations_url":"https://api.github.com/users/tjwudi/orgs","repos_url":"https://api.github.com/users/tjwudi/repos","events_url":"https://api.github.com/users/tjwudi/events{/privacy}","received_events_url":"https://api.github.com/users/tjwudi/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-11-03T22:09:54Z","updated_at":"2015-11-08T03:41:52Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/EverythingMe/redash/pulls/636","html_url":"https://github.com/EverythingMe/redash/pull/636","diff_url":"https://github.com/EverythingMe/redash/pull/636.diff","patch_url":"https://github.com/EverythingMe/redash/pull/636.patch"},"body":"I've created a minimal demo of Re:dash Access Group Model, in respond to our previous concern on re:dash security issues. The idea of Access Group Model works like this: \r\n\r\n1. every user belongs to one or more groups (set groups_a)\r\n2. every query has its one or more access groups  (set groups_b)\r\n3. an user can access a query iff groups_a ∩ groups_b != empty_set\r\n4. only admins can manage user's groups\r\n5. each query defaults to have access group ['default']\r\n6. each user defaults to have group ['default']\r\n7. only admins can manage groups in admin dashboard (host-of-redash.com/admin)\r\n8. every group has its permissions (among create_dashboard, create_query, edit_dashboard, edit_query, view_query, view_source, execute_query, list_users and admin)\r\n\r\nScreenshots:\r\n\r\n(1) Editing user groups\r\n![image](https://cloud.githubusercontent.com/assets/5257816/10923210/7198c768-8234-11e5-8226-190ebc219b50.png)\r\n\r\n\r\n(2) Editing query access groups\r\n![768bc09a-8234-11e5-91a6-607bc96b5631](https://cloud.githubusercontent.com/assets/5257816/10923256/dda9c7d6-8234-11e5-9295-1f49029a1d97.png)\r\n\r\n\r\n(3) Managing Groups\r\n\r\n![image](https://cloud.githubusercontent.com/assets/5257816/10923214/7b6f712e-8234-11e5-9fda-dfeffb3e307a.png)\r\n"},"comment":{"url":"https://api.github.com/repos/EverythingMe/redash/issues/comments/154773940","html_url":"https://github.com/EverythingMe/redash/pull/636#issuecomment-154773940","issue_url":"https://api.github.com/repos/EverythingMe/redash/issues/636","id":154773940,"user":{"login":"tjwudi","id":5257816,"avatar_url":"https://avatars.githubusercontent.com/u/5257816?v=3","gravatar_id":"","url":"https://api.github.com/users/tjwudi","html_url":"https://github.com/tjwudi","followers_url":"https://api.github.com/users/tjwudi/followers","following_url":"https://api.github.com/users/tjwudi/following{/other_user}","gists_url":"https://api.github.com/users/tjwudi/gists{/gist_id}","starred_url":"https://api.github.com/users/tjwudi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tjwudi/subscriptions","organizations_url":"https://api.github.com/users/tjwudi/orgs","repos_url":"https://api.github.com/users/tjwudi/repos","events_url":"https://api.github.com/users/tjwudi/events{/privacy}","received_events_url":"https://api.github.com/users/tjwudi/received_events","type":"User","site_admin":false},"created_at":"2015-11-08T03:41:52Z","updated_at":"2015-11-08T03:41:52Z","body":"Hah, haven't thought about it before. Are you implying that rather than provide access restrictions to queries, we should provide it to data source?"}}