codeant-ai-for-open-source[bot] commented on code in PR #37773: URL: https://github.com/apache/superset/pull/37773#discussion_r3700058183
########## superset/config.py: ########## @@ -2076,6 +2076,13 @@ def allowed_schemas_for_csv_upload( # pylint: disable=unused-argument FAB_API_KEY_ENABLED = False FAB_API_KEY_PREFIXES = ["sst_"] +# When False (default), the legacy FAB SSR admin password reset route +# (/superset/resetpassword) is not registered. The self-service password reset +# route (/superset/resetmypassword) is also skipped unless forced password +# changes are enabled, since that flow still needs a reachable reset form. +# Set to True to re-enable direct URL access to those views (e.g. during migration). +ENABLE_LEGACY_FAB_PASSWORD_VIEWS: bool = False Review Comment: **Suggestion:** Disabling registration does not remove or exclude an existing `ResetPasswordView` permission/view-menu row. On upgraded installations, `sync_role_definitions()` reads all persisted permission/view-menu rows and assigns admin-only rows to the Admin role, while `clean_perms()` removes only rows with missing relationships. Consequently, Admin can retain `ResetPasswordView` permission even though its route is disabled, causing the new permission assertions to fail and leaving stale security metadata. Exclude this view from role synchronization when the flag is false or add an explicit cleanup/migration for the persisted rows. [incomplete implementation] <details> <summary><b>Severity Level:</b> Major ⚠️</summary> ```mdx - ⚠️ Upgraded Admin roles retain stale ResetPasswordView permissions. - ⚠️ Security metadata assertions fail after legacy-route disablement. - ⚠️ FAB permission listings expose disabled password-reset capability. ``` </details> [](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=e39b7cd2a18e4a1791db472af01dfa16&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) [](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=e39b7cd2a18e4a1791db472af01dfa16&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset) *(Use Cmd/Ctrl + Click for best experience)* <details> <summary><b>Prompt for AI Agent 🤖 </b></summary> ```mdx This is a comment left during a code review. **Path:** superset/config.py **Line:** 2084:2084 **Comment:** *Incomplete Implementation: Disabling registration does not remove or exclude an existing `ResetPasswordView` permission/view-menu row. On upgraded installations, `sync_role_definitions()` reads all persisted permission/view-menu rows and assigns admin-only rows to the Admin role, while `clean_perms()` removes only rows with missing relationships. Consequently, Admin can retain `ResetPasswordView` permission even though its route is disabled, causing the new permission assertions to fail and leaving stale security metadata. Exclude this view from role synchronization when the flag is false or add an explicit cleanup/migration for the persisted rows. Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise. Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix ``` </details> <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F37773&comment_hash=678d4d181f2e20a177ec27fe52487ad30cb4258f59fc095d5e0d5181775e5c15&reaction=like'>👍</a> | <a href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F37773&comment_hash=678d4d181f2e20a177ec27fe52487ad30cb4258f59fc095d5e0d5181775e5c15&reaction=dislike'>👎</a> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
