Apache Superset permissions for Public role, manually or through cli

solution.md

1. You can add these permissions through superset ui.
2. Or you can import them from the json file using superset cli: superset fab import-roles -p superset-public-permissions.json
3. Tested with iframes in versions 1.3 and 1.5

---

• can_read on DashboardFilterStateRestApi|
• can_read on Dataset
• can_read on Dashboard
• can_read on CssTemplate
• can_read on SavedQuery
• can_read on Database
• can_read on Chart
• can_write on DashboardFilterStateRestApi
• can_get on OpenApi
• can_query on Api
• can_query_form_data on Api
• can_explore_json on Superset
• can_sql_json on Superset
• can_dashboard on Superset
• can_csv on Superset
• can_validate_sql_json on Superset
• can_slice_json on Superset
• can_annotation_json on Superset
• all_datasource_access on all_datasource_access
• can_csrf_token on Superset
• can_favstar on Superset

superset-public-permissions.json

[{"name": "Public", "permissions": [{"permission": {"name": "can_read"}, "view_menu": {"name": "DashboardFilterStateRestApi"}}, {"permission": {"name": "can_read"}, "view_menu": {"name": "Dataset"}}, {"permission": {"name": "can_read"}, "view_menu": {"name": "Dashboard"}}, {"permission": {"name": "can_read"}, "view_menu": {"name": "CssTemplate"}}, {"permission": {"name": "can_read"}, "view_menu": {"name": "SavedQuery"}}, {"permission": {"name": "can_read"}, "view_menu": {"name": "Database"}}, {"permission": {"name": "can_read"}, "view_menu": {"name": "Chart"}}, {"permission": {"name": "can_write"}, "view_menu": {"name": "DashboardFilterStateRestApi"}}, {"permission": {"name": "can_get"}, "view_menu": {"name": "OpenApi"}}, {"permission": {"name": "can_query"}, "view_menu": {"name": "Api"}}, {"permission": {"name": "can_query_form_data"}, "view_menu": {"name": "Api"}}, {"permission": {"name": "can_explore_json"}, "view_menu": {"name": "Superset"}}, {"permission": {"name": "can_sql_json"}, "view_menu": {"name": "Superset"}}, {"permission": {"name": "can_dashboard"}, "view_menu": {"name": "Superset"}}, {"permission": {"name": "can_csv"}, "view_menu": {"name": "Superset"}}, {"permission": {"name": "can_validate_sql_json"}, "view_menu": {"name": "Superset"}}, {"permission": {"name": "can_slice_json"}, "view_menu": {"name": "Superset"}}, {"permission": {"name": "can_annotation_json"}, "view_menu": {"name": "Superset"}}, {"permission": {"name": "all_datasource_access"}, "view_menu": {"name": "all_datasource_access"}}, {"permission": {"name": "can_csrf_token"}, "view_menu": {"name": "Superset"}}, {"permission": {"name": "can_favstar"}, "view_menu": {"name": "Superset"}}]}]

I found another permission necessary for Superset 1.5.0: can time range on Api is necessary to be able to filter time ranges for a dashboard via native filters.