rusackas commented on code in PR #42122:
URL: https://github.com/apache/superset/pull/42122#discussion_r3600704377
##########
tests/unit_tests/jinja_context_test.py:
##########
@@ -684,6 +684,104 @@ def test_user_macros_without_user_info(mocker:
MockerFixture):
assert cache.current_user_rls_rules() is None
+def _user_metadata_cache_keys(
+ mocker: MockerFixture,
+ *,
+ user_id: int | None,
+ username: str | None,
+ email: str | None,
+ roles: list[str],
+) -> list[Any]:
+ """
+ Render the user-metadata macros for a given user and return the values they
+ contributed to the query cache key.
+ """
+ mock_g = mocker.patch("superset.utils.core.g")
+ if user_id is None:
+ mock_g.user = None
+ else:
+ mock_g.user.id = user_id
+ mock_g.user.username = username
+ mock_g.user.email = email
+ mocker.patch(
+ "superset.security_manager.get_user_roles",
+ return_value=[Role(name=name) for name in roles],
+ )
+ keys: list[Any] = []
+ cache = ExtraCache(extra_cache_keys=keys, table=mocker.MagicMock())
+ cache.current_user_id()
+ cache.current_username()
+ cache.current_user_email()
+ cache.current_user_roles()
+ return keys
+
+
+def test_user_metadata_cache_keys_isolate_distinct_users(mocker:
MockerFixture):
+ """
+ Two different users contribute disjoint values to the cache key, so neither
+ can be served the other's cached result. This is the property that keeps
the
+ ``current_user_*`` macro family safe for per-user (and multi-tenant)
queries.
+ """
+ alice = _user_metadata_cache_keys(
+ mocker, user_id=1, username="alice", email="[email protected]",
roles=["Admin"]
+ )
+ bob = _user_metadata_cache_keys(
+ mocker, user_id=2, username="bob", email="[email protected]",
roles=["Gamma"]
+ )
+ assert alice
+ assert bob
+ assert set(alice).isdisjoint(set(bob))
+
+
+def test_user_metadata_cache_keys_match_for_identical_users(mocker:
MockerFixture):
+ """
+ The same user always contributes the same values, so identical renders
+ correctly share a cache entry (no needless fragmentation).
+ """
+ first = _user_metadata_cache_keys(
+ mocker, user_id=1, username="alice", email="[email protected]",
roles=["Admin"]
+ )
+ second = _user_metadata_cache_keys(
+ mocker, user_id=1, username="alice", email="[email protected]",
roles=["Admin"]
+ )
+ assert first == second
+
+
+def test_anonymous_user_never_collides_with_a_logged_in_user(mocker:
MockerFixture):
+ """
+ Refutes the "skip cache key when the value is absent" collision concern: an
+ anonymous render contributes nothing to the cache key, so its key can never
+ equal a logged-in user's, and no logged-in user's cached data is served to
an
+ anonymous request. Every absent user also renders identically (the macros
+ return ``None``), so absent users correctly share one cache entry rather
than
+ colliding.
+ """
+ logged_in = _user_metadata_cache_keys(
+ mocker, user_id=1, username="alice", email="[email protected]",
roles=["Admin"]
+ )
+ anonymous = _user_metadata_cache_keys(
+ mocker, user_id=None, username=None, email=None, roles=[]
+ )
+ assert anonymous == []
Review Comment:
Good catch, fixed. The anonymous case now models the real Public role
instead of forcing empty roles, and asserts that the absent id/username/email
add nothing, two anonymous requests share a cache entry, and neither collides
with a logged-in user.
##########
tests/unit_tests/jinja_context_test.py:
##########
@@ -684,6 +684,104 @@ def test_user_macros_without_user_info(mocker:
MockerFixture):
assert cache.current_user_rls_rules() is None
+def _user_metadata_cache_keys(
+ mocker: MockerFixture,
+ *,
+ user_id: int | None,
+ username: str | None,
+ email: str | None,
+ roles: list[str],
+) -> list[Any]:
+ """
+ Render the user-metadata macros for a given user and return the values they
+ contributed to the query cache key.
+ """
+ mock_g = mocker.patch("superset.utils.core.g")
+ if user_id is None:
+ mock_g.user = None
+ else:
+ mock_g.user.id = user_id
+ mock_g.user.username = username
+ mock_g.user.email = email
+ mocker.patch(
+ "superset.security_manager.get_user_roles",
+ return_value=[Role(name=name) for name in roles],
+ )
+ keys: list[Any] = []
+ cache = ExtraCache(extra_cache_keys=keys, table=mocker.MagicMock())
+ cache.current_user_id()
+ cache.current_username()
+ cache.current_user_email()
+ cache.current_user_roles()
+ return keys
+
+
+def test_user_metadata_cache_keys_isolate_distinct_users(mocker:
MockerFixture):
Review Comment:
These match the existing convention in this file, where the `test_`
functions don't carry return annotations and `tests.*` relaxes typing in the
mypy config (`disallow_untyped_defs = false`). Keeping consistent with the
neighbors, so resolving as not applicable.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
