"Open in Iodide" button should not be available for queries accessing restricted datasets (e.g. search) about redash-iodide

[openjck]

I'd like to help on this.

@jezdez Do you agree with @wlach that we could restrict the button to only working for queries that are made using these data sources? How could I programmatically check the data source in the extension?

https://sql.telemetry.mozilla.org/queries/65817/source

[jezdez]

@openjck Ah I hadn't seen that query yet, that should be fairly easy to query in the backend and provide an API endpoint to check.

Basically the flow would be:

1. when the query page loads we should hide the button by default
2. send a POST request to a new API endpoint with the query ID
3. get the data source group of the query's data source using the provided query ID and check if it's a configured "allowed data source group" (e.g. the default group as used in Will's query)
4. depending on the boolean result of the data source group check in (3), show or keep hiding the button

The same step as (3) needs to happen when submitting the notebook to Iodide, so writing the check in a separate function would simplify the code.

I'd be happy to provide the database query if you want.

[openjck]

Thanks for those helpful steps, @jezdez. I'm working on this issue again after a break.

I appreciate your offer to help with the SQL query. I may need that help. I was playing around in Redash and came up with this:

SELECT group_id FROM data_source_groups
  LEFT JOIN queries ON queries.data_source_id = data_source_groups.data_source_id
  WHERE queries.id=<provided_query_id>;

Does that look correct to you? I notice it returns multiple rows. Is that because each data source can be associated with multiple groups?

I was thinking the new API endpoint could return an array of group IDs, something like this:

{
    "groupIDs": [
        1,
        2,
        3,
        4
    ]
}

and the JavaScript could show the button if group 2 (default) is included in that array. Does that sound about right?

[openjck]

Also, can you say more about what the default group (ID: 2) is used for? Do all employees have access to data associated with the default group?

[openjck]

Note to self: It looks like all_groups_for_query_ids does what my SQL query does. That certainly makes things easier!

[openjck]

I think this is done. I'm going to send up a PR tomorrow after testing it with fresh eyes.