codeant-ai-for-open-source[bot] commented on code in PR #43516:
URL: https://github.com/apache/superset/pull/43516#discussion_r3854158361
##########
superset/tasks/async_queries.py:
##########
@@ -164,7 +164,9 @@ def submit_chart_data_query_tasks(
the websocket transport subscribes to GTF, not to any GAQ-specific stream.
Returns the HTTP 202 body ``{"task_ids": [...]}`` โ the query tasks'
UUIDs, in
- query order, for the client to poll and cancel via the GTF task API.
+ query order, for the client to poll through the GTF task API. Client
aborts may
+ unsubscribe from shared work or abort pending work; engine-level query
+ cancellation is outside this chart async path.
Review Comment:
**Suggestion:** The return documentation describes the 202 response as
containing only task IDs, but this function also returns the server-captured
`cursor`, which the frontend uses to avoid missing task completion events
during status polling. Update the documented response shape to include
`cursor`; otherwise callers may incorrectly discard the required polling cursor
and reintroduce the completion race this implementation prevents. [docstring
mismatch]
<details>
<summary><b>Severity Level:</b> Minor ๐งน</summary>
```mdx
- โ ๏ธ Docstring inaccurately describes the HTTP 202 response shape.
- โ ๏ธ Current frontend preserves and uses the returned polling cursor.
- โ ๏ธ No demonstrated production failure from this documentation mismatch.
```
</details>
[](https://docs.codeant.ai/cli/resolve-pr-comments-skill)
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=06d18c8871af4a958c6135ef56dbf7bc&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=06d18c8871af4a958c6135ef56dbf7bc&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
<details>
<summary><b>Prompt for AI Agent ๐ค </b></summary>
```mdx
This is a comment left during a code review.
**Path:** superset/tasks/async_queries.py
**Line:** 167:169
**Comment:**
*Docstring Mismatch: The return documentation describes the 202
response as containing only task IDs, but this function also returns the
server-captured `cursor`, which the frontend uses to avoid missing task
completion events during status polling. Update the documented response shape
to include `cursor`; otherwise callers may incorrectly discard the required
polling cursor and reintroduce the completion race this implementation prevents.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43516&comment_hash=7989d9dc5a6e639cb1d700346900eef5384356b9b4923c5c629350e721e5d061&reaction=like'>๐</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43516&comment_hash=7989d9dc5a6e639cb1d700346900eef5384356b9b4923c5c629350e721e5d061&reaction=dislike'>๐</a>
##########
superset/websocket/channel.py:
##########
@@ -118,12 +119,13 @@ def register_ws_channel_cookie(app: Flask) -> None:
@app.after_request
def set_ws_channel_cookie(response: Response) -> Response:
- channel_id = get_channel_id()
+ channel_id = get_channel_id() if can_access_realtime_notifications()
else None
Review Comment:
**Suggestion:** Checking the permission only while processing a later HTTP
response does not revoke an already-established websocket. The websocket server
verifies this JWT only during the connection handshake, so a user whose
Realtime permission is removed can keep receiving per-principal notifications
over an existing socket until it disconnects or the token expires. Add a
revocation mechanism, such as forcing the client to disconnect on permission
changes or having the websocket server periodically revalidate authorization.
[security]
<details>
<summary><b>Severity Level:</b> Major โ ๏ธ</summary>
```mdx
- โ Revoked users continue receiving realtime task-status notifications.
- โ ๏ธ Cookie clearing does not affect established WebSockets.
- โ ๏ธ REST authorization remains enforced; push delivery is stale.
```
</details>
[](https://docs.codeant.ai/cli/resolve-pr-comments-skill)
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=6d018ccf95344d77810eeaab44158d9e&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=6d018ccf95344d77810eeaab44158d9e&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
<details>
<summary><b>Prompt for AI Agent ๐ค </b></summary>
```mdx
This is a comment left during a code review.
**Path:** superset/websocket/channel.py
**Line:** 122:122
**Comment:**
*Security: Checking the permission only while processing a later HTTP
response does not revoke an already-established websocket. The websocket server
verifies this JWT only during the connection handshake, so a user whose
Realtime permission is removed can keep receiving per-principal notifications
over an existing socket until it disconnects or the token expires. Add a
revocation mechanism, such as forcing the client to disconnect on permission
changes or having the websocket server periodically revalidate authorization.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43516&comment_hash=dc96fc367567e56740cda13ddd4eb5d16767359f189a5d9da4132be9c814d009&reaction=like'>๐</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F43516&comment_hash=dc96fc367567e56740cda13ddd4eb5d16767359f189a5d9da4132be9c814d009&reaction=dislike'>๐</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
