superset 6 permissions

[srijani-smsrc]

what are the initial permissions given to pubic role in superset 6

@dosubot

[dosubot[bot]]

By default, the Public role in Superset has NO permissions — it starts empty [1]. It only receives permissions when you explicitly set PUBLIC_ROLE_LIKE in your configuration and run superset init.

When configured with PUBLIC_ROLE_LIKE = "Public", the Public role gets these permissions after running superset init [2]:

• Read access: Dashboard, Chart, DashboardPermalinkRestApi, ExplorePermalinkRestApi, EmbeddedDashboard, Annotation, AnnotationLayerRestApi, CssTemplate
• Read/Write: DashboardFilterStateRestApi
• Datasource: can_get, can_external_metadata on Datasource
• API: can_time_range, can_query_form_data, can_query on Api

A few things to keep in mind:

1. Without setting PUBLIC_ROLE_LIKE, anonymous users are always redirected to login [2].
2. Any manual permission changes made via the UI get overwritten whenever you run superset init or upgrade Superset [3].
3. Known issue in 6.0.0: The Public role is missing the can_read permission on Theme, which causes unauthenticated users to be redirected to login when a dashboard has a theme assigned [4].

The Public role is intentionally more restrictive than the Gamma role, as it's designed for anonymous/unauthenticated access.

To reply, just mention @dosu.

---

^{How did I do? Good | Irrelevant | Incorrect | Verbose | Hallucination | Report 🐛 | Other}