rusackas commented on code in PR #42122:
URL: https://github.com/apache/superset/pull/42122#discussion_r3600679056
##########
tests/unit_tests/jinja_context_test.py:
##########
@@ -684,6 +684,104 @@ def test_user_macros_without_user_info(mocker:
MockerFixture):
assert cache.current_user_rls_rules() is None
+def _user_metadata_cache_keys(
+ mocker: MockerFixture,
+ *,
+ user_id: int | None,
+ username: str | None,
+ email: str | None,
+ roles: list[str],
+) -> list[Any]:
+ """
+ Render the user-metadata macros for a given user and return the values they
+ contributed to the query cache key.
+ """
+ mock_g = mocker.patch("superset.utils.core.g")
+ if user_id is None:
+ mock_g.user = None
+ else:
+ mock_g.user.id = user_id
+ mock_g.user.username = username
+ mock_g.user.email = email
+ mocker.patch(
+ "superset.security_manager.get_user_roles",
+ return_value=[Role(name=name) for name in roles],
+ )
+ keys: list[Any] = []
+ cache = ExtraCache(extra_cache_keys=keys, table=mocker.MagicMock())
+ cache.current_user_id()
+ cache.current_username()
+ cache.current_user_email()
+ cache.current_user_roles()
+ return keys
+
+
+def test_user_metadata_cache_keys_isolate_distinct_users(mocker:
MockerFixture):
Review Comment:
Good catch, added `-> None` here, and to the other three new test functions
in this block for consistency.
##########
tests/unit_tests/jinja_context_test.py:
##########
@@ -684,6 +684,104 @@ def test_user_macros_without_user_info(mocker:
MockerFixture):
assert cache.current_user_rls_rules() is None
+def _user_metadata_cache_keys(
+ mocker: MockerFixture,
+ *,
+ user_id: int | None,
+ username: str | None,
+ email: str | None,
+ roles: list[str],
+) -> list[Any]:
+ """
+ Render the user-metadata macros for a given user and return the values they
+ contributed to the query cache key.
+ """
+ mock_g = mocker.patch("superset.utils.core.g")
+ if user_id is None:
+ mock_g.user = None
+ else:
+ mock_g.user.id = user_id
+ mock_g.user.username = username
+ mock_g.user.email = email
+ mocker.patch(
+ "superset.security_manager.get_user_roles",
+ return_value=[Role(name=name) for name in roles],
+ )
+ keys: list[Any] = []
+ cache = ExtraCache(extra_cache_keys=keys, table=mocker.MagicMock())
+ cache.current_user_id()
+ cache.current_username()
+ cache.current_user_email()
+ cache.current_user_roles()
+ return keys
+
+
+def test_user_metadata_cache_keys_isolate_distinct_users(mocker:
MockerFixture):
+ """
+ Two different users contribute disjoint values to the cache key, so neither
+ can be served the other's cached result. This is the property that keeps
the
+ ``current_user_*`` macro family safe for per-user (and multi-tenant)
queries.
+ """
+ alice = _user_metadata_cache_keys(
+ mocker, user_id=1, username="alice", email="[email protected]",
roles=["Admin"]
+ )
+ bob = _user_metadata_cache_keys(
+ mocker, user_id=2, username="bob", email="[email protected]",
roles=["Gamma"]
+ )
+ assert alice
+ assert bob
+ assert set(alice).isdisjoint(set(bob))
+
+
+def test_user_metadata_cache_keys_match_for_identical_users(mocker:
MockerFixture):
+ """
+ The same user always contributes the same values, so identical renders
+ correctly share a cache entry (no needless fragmentation).
+ """
+ first = _user_metadata_cache_keys(
+ mocker, user_id=1, username="alice", email="[email protected]",
roles=["Admin"]
+ )
+ second = _user_metadata_cache_keys(
+ mocker, user_id=1, username="alice", email="[email protected]",
roles=["Admin"]
+ )
+ assert first == second
+
+
+def test_anonymous_user_never_collides_with_a_logged_in_user(mocker:
MockerFixture):
+ """
+ Refutes the "skip cache key when the value is absent" collision concern: an
+ anonymous render contributes nothing to the cache key, so its key can never
+ equal a logged-in user's, and no logged-in user's cached data is served to
an
+ anonymous request. Every absent user also renders identically (the macros
+ return ``None``), so absent users correctly share one cache entry rather
than
+ colliding.
+ """
+ logged_in = _user_metadata_cache_keys(
+ mocker, user_id=1, username="alice", email="[email protected]",
roles=["Admin"]
+ )
+ anonymous = _user_metadata_cache_keys(
+ mocker, user_id=None, username=None, email=None, roles=[]
+ )
+ assert anonymous == []
Review Comment:
I don't think this applies. `security_manager.get_user_roles` is fully
mocked in this helper, so the test isn't exercising the real
anonymous/public-role resolution at all, it's checking `ExtraCache`'s cache-key
aggregation given whatever roles come back. `roles=[]` here is deliberately the
"no roles at all" case per the docstring. The `AUTH_ROLE_PUBLIC` behavior for
anonymous users already has coverage in
`tests/integration_tests/security_tests.py`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
