diff --git a/ee/api/rbac/test/test_access_control.py b/ee/api/rbac/test/test_access_control.py index fe113568964c4..9be05d3ff07dd 100644 --- a/ee/api/rbac/test/test_access_control.py +++ b/ee/api/rbac/test/test_access_control.py @@ -329,6 +329,11 @@ def test_query_counts(self): # We call this endpoint as we don't want to include all the extra queries that rendering the project uses self.client.get("/api/projects/@current/is_generating_demo_data") + # When accessing the list of notebooks we have extra queries due to checking for role based access and filtering out items + baseline = 9 + with self.assertNumQueries(baseline + 4): # 1 roles, 1 project, 1 global, 1 for listing what to filter out + self.client.get("/api/projects/@current/notebooks/") + class TestAccessControlFiltering(BaseAccessControlTest): def setUp(self): diff --git a/posthog/api/dashboards/dashboard_templates.py b/posthog/api/dashboards/dashboard_templates.py index 6e8752e0cbd39..23ef13ed33f21 100644 --- a/posthog/api/dashboards/dashboard_templates.py +++ b/posthog/api/dashboards/dashboard_templates.py @@ -73,6 +73,7 @@ class DashboardTemplateViewSet(TeamAndOrgViewSetMixin, ForbidDestroyModel, views scope_object = "dashboard_template" permission_classes = [OnlyStaffCanEditDashboardTemplate] serializer_class = DashboardTemplateSerializer + queryset = DashboardTemplate.objects.all() @method_decorator(cache_page(60 * 2)) # cache for 2 minutes @action(methods=["GET"], detail=False) @@ -80,7 +81,9 @@ def json_schema(self, request: request.Request, **kwargs) -> response.Response: # Could switch from this being a static file to being dynamically generated from the serializer return response.Response(dashboard_template_schema) - def get_queryset(self, *args, **kwargs): + def filter_queryset(self, queryset): + # NOTE: We override the default filtering as we don't want parent based filtering here + filters = self.request.GET.dict() scope = filters.pop("scope", None) search = filters.pop("search", None) @@ -100,4 +103,4 @@ def get_queryset(self, *args, **kwargs): Q(template_name__search=search) | Q(dashboard_description__search=search) | Q(tags__contains=[search]) ) - return DashboardTemplate.objects.filter(query_condition) + return queryset.filter(query_condition)