{"record":{"id":"fe96ba5291002bcf","repo":"apache/superset","slug":"regular-rls-filters-require-at-least-one-subject","errorCode":null,"errorMessage":"Regular RLS filters require at least one subject.","messagePattern":"Regular RLS filters require at least one subject\\.","errorType":"validation","errorClass":"ValidationError","httpStatus":422,"severity":"error","filePath":"superset/commands/security/create.py","lineNumber":85,"sourceCode":"            .all()\n        )\n        if len(tables) != len(self._tables):\n            raise DatasourceNotFoundValidationError()\n        raise_for_datasource_access(tables)\n        self._properties[\"tables\"] = tables\n\n        name = self._properties.get(\"name\")\n        if name and not RLSDAO.validate_uniqueness(name):\n            raise ValidationError(\n                {\"name\": [_(\"A rule with this name already exists.\")]}\n            )\n\n        if (\n            self._properties.get(\"filter_type\")\n            == RowLevelSecurityFilterType.REGULAR.value\n            and not self._subjects\n        ):\n            raise ValidationError(\n                {\"subjects\": [\"Regular RLS filters require at least one subject.\"]}\n            )\n\n        if self._subjects:\n            subjects = populate_subject_list(\n                self._subjects,\n                default_to_user=False,\n            )\n            self._properties[\"subjects\"] = subjects\n","sourceCodeStart":67,"sourceCodeEnd":95,"githubUrl":"https://github.com/apache/superset/blob/f4587218dd19d046c3e4d00063e7d27f8a2ed354/superset/commands/security/create.py#L67-L95","documentation":"ValidationError raised in CreateRLSRuleCommand.validate when filter_type equals RowLevelSecurityFilterType.REGULAR and the subjects list is empty — regular RLS filters must be bound to at least one user/role subject. (Base filter types are exempt.)","triggerScenarios":"POST /api/v1/rowlevelsecurity with filter_type='Regular' and an empty or missing 'subjects' array.","commonSituations":"Authors intending a rule that applies to everyone and omitting subjects (they should add the Public role or use a Base filter for shared clauses); form defaults that drop the subjects field.","solutions":["Add at least one subject, e.g. {'subject_type': 'Role', 'subject': 'Public'} or a specific user/role","If the clause must apply to all users regardless of role, consider a Base filter (filter_type='Base') which needs no subject","Re-submit the POST with the populated subjects array"],"exampleFix":"# before\n{'name': 'r', 'filter_type': 'Regular', 'tables': [1], 'subjects': []}\n\n# after\n{'name': 'r', 'filter_type': 'Regular', 'tables': [1],\n 'subjects': [{'subject_type': 'Role', 'subject': 'Public'}]}","handlingStrategy":"validation","validationCode":"if payload['filter_type'] == 'Regular':\n    assert payload.get('subjects'), 'Regular RLS rules need >=1 subject'","typeGuard":"def rls_subjects_satisfied(payload: dict) -> bool:\n    if payload.get('filter_type') != 'Regular':\n        return True\n    return bool(payload.get('subjects'))","tryCatchPattern":"from superset.commands.exceptions import ValidationError\ntry:\n    CreateRLSRuleCommand(props).run()\nexcept ValidationError as e:\n    if 'subjects' in e.normalized_messages():\n        props.setdefault('subjects', []).append({'subject_type': 'Role', 'subject': 'Public'})\n        CreateRLSRuleCommand(props).run()","preventionTips":["Default Regular rules to a Public role subject in templates","Remember Base filters are the subject-independent variant","Validate subject presence client-side before POST"],"tags":["rls","validation","subjects"],"backgroundTag":null,"analyzedSha":"f4587218dd19d046c3e4d00063e7d27f8a2ed354","analyzedAt":"2026-08-14T22:39:27.425Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}