bito-code-review[bot] commented on PR #42888:
URL: https://github.com/apache/superset/pull/42888#issuecomment-5218799836
<!-- Bito Reply -->
The flagged issue is correct. Capturing the permission name before the row
is locked creates a race condition where the permission identifier could become
stale if the dataset's `table_name` or `database_id` is updated concurrently.
To resolve this, the permission name should be captured after the row has been
successfully locked using `with_for_update()`.
To implement this, move the permission name capture inside the
`session.begin_nested()` block, after the lock is acquired. Would you like me
to implement this fix and check the remaining comments on this PR?
**superset/commands/deletion_retention/purge_cascade.py**
```
if session.execute(claim.with_for_update()).scalar_one_or_none() is None:
raise PurgeRaceLostError
# Capture permission name here, after the lock is acquired
permission_name = policy.capture_permission_name(entity, policy)
policy.validate(session, policy, entity_id)
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
