Methods and systems for deriving permissions for external data objects

1 . A method comprising:

at a server system of a data visualization platform:

accessing a directed graph having directed links between one or more workbooks and one or more data objects, wherein the one or more workbooks are internal to the data visualization platform and the one or more data objects are external to the data visualization platform;

receiving, via the data visualization platform, a request from a user to access metadata of a first data object in the graph;

in response to receiving the request from the user and in accordance with a determination that the user does not have permission to access content of the first data object, determining whether to grant permission to the user to access the metadata of the first data object by:

identifying, using the graph, a first workbook, of the one or more workbooks, that references the first data object;

determining that the user has permission to access the identified first workbook; and

in accordance with the determination that the user has permission to access the first workbook, providing the user with access to the metadata of the first data object.

2 . The method of claim 1 , wherein the first workbook is identified as referencing the first data object when the directed graph includes a directed link from the first workbook to the first data object.

3 . The method of claim 1 , wherein the first workbook is identified as referencing the first data object when the directed graph includes at least one continuous path having one or more directed links, beginning at the first workbook and ending at the first data object.

4 . The method of claim 1 , wherein the directed graph links the first data object with the first workbook in accordance with a determination that the first data object and the first workbook are owned by a same user.

5 . The method of claim 1 , further comprising:

generating one or more calculated groups for the identified first workbook;

wherein determining that a user has permission to access the identified first workbook comprises determining that the user belongs to a respective calculated group for the first workbook.

6 . The method of claim 1 , wherein the user is not granted permission to access a second data object in accordance with a determination that there is no continuous path of directed links in the directed graph (i) from a workbook for which the user has permission (ii) to the second data object.

7 . A computer system of a data visualization platform, comprising:

one or more processors;

memory; and

one or more programs stored in the memory and configured for execution by the one or more processors, the one or more programs comprising instructions for:

accessing a directed graph having directed links between one or more workbooks and one or more data objects, wherein the one or more workbooks are internal to the data visualization platform and the one or more data objects are external to the data visualization platform;

receiving, via the data visualization platform, a request from a user to access metadata of a first data object in the graph;

in response to receiving the request from the user and in accordance with a determination that the user does not have permission to access content of the first data object, determining whether to grant permission to the user to access the metadata of the first data object by:

identifying, using the graph, a first workbook, of the one or more workbooks, that references the first data object;

determining that the user has permission to access the identified first workbook; and

in accordance with the determination that the user has permission to access the first workbook, providing the user with access to the metadata of the first data object.

8 . The computer system of claim 7 , wherein the first workbook is identified as referencing the first data object when the directed graph includes a directed link from the first workbook to the first data object.

9 . The computer system of claim 7 , wherein the first workbook is identified as referencing the first data object when the directed graph includes at least one continuous path having one or more directed links, beginning at the first workbook and ending at the first data object.

10 . The computer system of claim 7 , wherein the directed graph links the first data object with the first workbook in accordance with a determination that the first data object and the first workbook are owned by a same user.

11 . The computer system of claim 7 , further comprising:

generating one or more calculated groups for the identified first workbook;

wherein determining that a user has permission to access the identified first workbook comprises determining that the user belongs to a respective calculated group for the first workbook.

12 . The computer system of claim 7 , wherein the user is not granted permission to access a second data object in accordance with a determination that there is no continuous path of directed links in the directed graph (i) from a workbook for which the user has permission (ii) to the second data object.

13 . A non-transitory computer-readable storage medium storing one or more programs configured for execution by a computer system having one or more processors, and memory, the one or more programs comprising instructions for:

accessing a directed graph having directed links between one or more workbooks and one or more data objects, wherein the one or more workbooks are internal to a data visualization platform and the one or more data objects are external to the data visualization platform;

receiving, via the data visualization platform, a request from a user to access metadata of a first data object in the graph;

in response to receiving the request from the user and in accordance with a determination that the user does not have permission to access content of the first data object, determining whether to grant permission to the user to access the metadata of the first data object by:

identifying, using the graph, a first workbook, of the one or more workbooks, that references the first data object;

determining that the user has permission to access the identified first workbook; and

in accordance with the determination that the user has permission to access the first workbook, providing the user with access to the metadata of the first data object.

14 . The computer-readable storage medium of claim 13 , wherein the first workbook is identified as referencing the first data object when the directed graph includes a directed link from the first workbook to the first data object.

15 . The computer-readable storage medium of claim 13 , wherein the first workbook is identified as referencing the first data object when the directed graph includes at least one continuous path having one or more directed links, beginning at the first workbook and ending at the first data object.

16 . The computer-readable storage medium of claim 13 , wherein the directed graph links the first data object with the first workbook in accordance with a determination that the first data object and the first workbook are owned by a same user.

17 . The computer-readable storage medium of claim 13 , further comprising:

generating one or more calculated groups for the identified first workbook;

wherein determining that a user has permission to access the identified first workbook comprises determining that the user belongs to a respective calculated group for the first workbook.

18 . The computer-readable storage medium of claim 13 , wherein the user is not granted permission to access a second data object in accordance with a determination that there is no continuous path of directed links in the directed graph (i) from a workbook for which the user has permission (ii) to the second data object.

19 . The method of claim 1 , wherein the directed graph includes one or more data sources and links between the one or more data sources, the one or more workbooks, and the one or more data objects.