对于 BigQuery 以外的数据库，如何为 Data Studio 中的同一行授予多个用户访问权限？

Question

为了启用行级安全性，我按照此处的建议使用了Filter By Email选项。 但我想知道我能否为多个用户启用对同一行的访问，以及如何启用可以查看所有行的超级用户。 例如，如果下面是示例数据，那么我希望根据登录者的不同，设置不同的 output。

userId  age email
A       20  usera@gmail.com
B       15  userb@gmail.com
C       25  userc@gmail.com
Z       30  admin@gmail.com

A登录时

userId  age email
A       20  usera@gmail.com

B登录时

userId  age email
A       20  usera@gmail.com
B       15 userb@gmail.com

当 Z 登录时

userId  age email
A       20  usera@gmail.com
B       15  userb@gmail.com
C       25  userc@gmail.com
Z       30  admin@gmail.com

Update1：我正在使用 postgres 实例进行报告（不是 bigQuery），因此使用@DS_USER_EMAIL的解决方案将不起作用

Answer 1

email 的过滤器只是为您提供当前登录用户的 email。 您必须使用它来过滤您的查询。 我设计了一个像这样的简单测试

with sample as (
  select "a" as userId, 10 as age, "usera@gmail.com" as email
  UNION ALL
  select "b" as userId, 20 as age, "userb@gmail.com" as email
  UNION ALL
  select "c" as userId, 30 as age, "userc@gmail.com" as email
), auth as (
  select "usera@gmail.com" as user, "usera@gmail.com" as permission
  UNION ALL
  select "userb@gmail.com" as user, "usera@gmail.com" as permission
  UNION ALL
  select "userb@gmail.com" as user, "userb@gmail.com" as permission
  UNION ALL
  select "admin@gmail.com" as user, ".*" as permission
)
select * from sample
where REGEXP_CONTAINS(email,(select STRING_AGG(permission,"|") from auth where auth.user = @DS_USER_EMAIL))

我有包含您的数据的sample表。 我创建了一个auth表，其中包含用户 email 和视图授权之间的链接。

在最后的请求中，我使用正则表达式来检查该行是否被授权。 管理员具有值.*以查看所有数据。 另一个是所有行的简单聚合，由 pipe |分隔 （或正则表达式语言）

编辑

BigQuery 的强大之处在于它符合 SQL2011 标准，在 postgres 中的工作查询也是类似的。 对于正则表达式模式，请使用SIMILAR TO 。 查看管理正则表达式模式，它不是常规的正则表达式，但它可以工作

string_agg是现有的 function

with sample as (
  select 'a' as userId, 10 as age, 'usera@gmail.com' as email
  UNION ALL
  select 'b' as userId, 20 as age, 'userb@gmail.com' as email
  UNION ALL
  select 'c' as userId, 30 as age, 'userc@gmail.com' as email
), auth as (
  select 'usera@gmail.com' as user, 'usera@gmail.com' as permission
  UNION ALL
  select 'userb@gmail.com' as user, 'usera@gmail.com' as permission
  UNION ALL
  select 'userb@gmail.com' as user, 'userb@gmail.com' as permission
  UNION ALL
  select 'admin@gmail.com' as user, '%' as permission
)
select * from sample
where email SIMILAR TO (select STRING_AGG(permission,'|') from auth where auth.user = @DS_USER_EMAIL)

该查询有效，但不适用于 Datastudio，因为@DS_USER_EMAIL仅存在于 BigQuery

解决方法是使用Cloud SQL 联合查询。 最后的请求是两个数据库引擎之间的混合

with sample as (
SELECT * FROM EXTERNAL_QUERY("gbl-imt-homerider-basguillaueb.us.vertx-postgres", """ select 'a' as userId, 10 as age, 'usera@gmail.com' as email
  UNION ALL
  select 'b' as userId, 20 as age, 'userb@gmail.com' as email
  UNION ALL
  select 'c' as userId, 30 as age, 'userc@gmail.com' as email""")), auth as (
SELECT * FROM EXTERNAL_QUERY("gbl-imt-homerider-basguillaueb.us.vertx-postgres", """ select 'usera@gmail.com' as user, 'usera@gmail.com' as permission
  UNION ALL
  select 'userb@gmail.com' as user, 'usera@gmail.com' as permission
  UNION ALL
  select 'userb@gmail.com' as user, 'userb@gmail.com' as permission
  UNION ALL
  select 'admin@gmail.com' as user, '.*' as permission"""))
select * from sample
where REGEXP_CONTAINS(email,(select STRING_AGG(permission,"|") from auth where auth.user = @DS_USER_EMAIL))