metabase / metabase/metabase

Sandboxed/Impersonated group managers can't see other users in the People tab

Open
#23,689 6 comments 0 reactions 0 assignees View on GitHub
.Backend .Reproduced .Team/UXWest Administration/Data Sandboxes Administration/People Administration/Permissions Priority:P3 Type:Bug
Dominant language
Clojure
Stars
49.3k
Forks
6.8k
Avg merge
1d 13h
Merged PRs (30d)
653

Description

**Describe the bug**
A group manager that has sandboxed access to any database can't see other users in the People tab in the Admin panel.

As @calherries found:

One strange thing I noticed with the query is that if a group manager has sandboxed permissions, they can't see any other users in the group. Perhaps we should make a separate issue for this?

Below is an example query that runs to load users in a group on this page. Note the clause core_user.id = 272. That restriction is included in the query if the user has any sandboxed permissions on their account.

```
SELECT "core_user"."id", "core_user"."email", "core_user"."first_name", "core_user"."last_name", "core_user"."is_superuser", "core_user"."last_login"
FROM "core_user" RIGHT JOIN "permissions_group_membership" ON "core_user"."id" = "permissions_group_membership"."user_id"
WHERE ("is_active" = TRUE AND "core_user"."id" = 272 AND "permissions_group_membership"."group_id" = 162)
ORDER BY "core_user"."is_superuser" DESC, "is_group_manager" DESC, lower("last_name") ASC, lower("first_name")
```

**To Reproduce**
Steps to reproduce the behavior:

1. As an admin, go to the People tab, create a group, add at least 2 users, promote one of them to group manager and restrict their access to any database to a sandbox.
2. Log in as the group manager and access the people tab. You can't see the other group members besides yourself.

**Expected behavior**
The group manager should see every other instance user in the People/People tab and the users in their group in the People/Groups tab.

**Severity**
This makes group managers useless for sandboxed managers. But there shouldn't be a lot of sandboxed group managers.

**Additional context**
Related to [#23246]()

Not sure why we are restricting the people tab in the admin panel for sandboxed users, it may be wise to investigate why we are doing it.

Contributor guide

Open the contributing guide

Research direction

Start with the Admin panel People tab and the query shown in the issue, then compare the behavior with related issue #23246. Trace why sandboxed permissions add the current-user restriction and verify that group managers can see all instance users and members of their group when the fix is complete.

Written by the indexing model from the issue text.

Assessment

Tech stack
clojure
Domain
authorization, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.