codeant-ai-for-open-source[bot] commented on code in PR #43391:
URL: https://github.com/apache/superset/pull/43391#discussion_r3831848441
##########
superset/async_events/async_query_manager.py:
##########
@@ -238,24 +238,17 @@ def get_guest_user_channel_id(self, guest_user:
GuestUser) -> str:
secret so the value is unguessable to outside callers.
"""
token = guest_user.guest_token
- # ``iat`` uniquely identifies a guest token issuance, so it provides
- # per-token isolation while remaining stable across the lifetime of a
- # single embedded session.
- message = json.dumps(
- {
- "user": token.get("user"),
- "resources": token.get("resources"),
- "iat": token.get("iat"),
- "exp": token.get("exp"),
- "aud": token.get("aud"),
- # ``datasets`` and ``rev`` are optional scope claims, so tokens
- # that differ only in their dataset allowlist or revocation
- # version still derive distinct channels.
- "datasets": token.get("datasets"),
- "rev": token.get("rev"),
- },
- sort_keys=True,
- ).encode("utf-8")
+ # HMAC over the complete claim set so that tokens differing in *any*
+ # claim derive distinct channels. Enumerating claims here is unsafe:
+ # omitting one that scopes the session -- most importantly
+ # ``rls_rules``, the primary tenant-isolation mechanism for embedded
+ # dashboards -- would let two tenants' tokens minted in the same
+ # second with identical user/resources collide on one channel,
+ # exposing job events (including error strings) and cross-tenant
+ # cancellation. ``iat`` uniquely identifies a token issuance, so it
+ # provides per-token isolation while remaining stable across the
+ # lifetime of a single embedded session.
+ message = json.dumps(token, sort_keys=True).encode("utf-8")
Review Comment:
**Suggestion:** Deriving the channel from the complete claims makes `exp`
and `iat` part of the channel identity. The async submit command stores the
channel derived from the token used for submission, but the polling and
cancellation endpoints derive it again from the current guest token. When the
embedding host refreshes an otherwise equivalent token while a job is still
running, the new `iat`/`exp` produces a different channel, so the client stops
receiving the submitted job's events and can no longer poll or cancel it. Use a
stable session/channel claim or persist and authorize the original channel
across token refreshes. [stale reference]
<details>
<summary><b>Severity Level:</b> Major ⚠️</summary>
```mdx
- ❌ Refreshed embedded sessions stop receiving in-flight async query events.
- ❌ Refreshed tokens cannot cancel their own running async jobs.
- ⚠️ Guest tokens expire after five minutes by default, encouraging refresh
during long queries.
```
</details>
[](https://docs.codeant.ai/cli/resolve-pr-comments-skill)
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** superset/async_events/async_query_manager.py
**Line:** 251:251
**Comment:**
*Stale Reference: Deriving the channel from the complete claims makes
`exp` and `iat` part of the channel identity. The async submit command stores
the channel derived from the token used for submission, but the polling and
cancellation endpoints derive it again from the current guest token. When the
embedding host refreshes an otherwise equivalent token while a job is still
running, the new `iat`/`exp` produces a different channel, so the client stops
receiving the submitted job's events and can no longer poll or cancel it. Use a
stable session/channel claim or persist and authorize the original channel
across token refreshes.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43391&comment_hash=6fbbdb5e26134acb758343c9ef17a30839de8e97adcd352aa87a1e5fcfc2e98f&reaction=like'>👍</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43391&comment_hash=6fbbdb5e26134acb758343c9ef17a30839de8e97adcd352aa87a1e5fcfc2e98f&reaction=dislike'>👎</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
