bito-code-review[bot] commented on code in PR #43532: URL: https://github.com/apache/superset/pull/43532#discussion_r3859572635
########## tests/unit_tests/tasks/test_guest.py: ########## @@ -0,0 +1,110 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +"""Unit tests for guest subscriber key derivation.""" + +from typing import Any +from unittest import mock + +from pytest_mock import MockerFixture + + +def _guest_token(**overrides: Any) -> dict[str, Any]: + """A representative guest token with all authorization-relevant claims set.""" + token: dict[str, Any] = { + "user": {"username": "guest"}, + "resources": [{"type": "dashboard", "id": "abc"}], + "iat": 1000, + "exp": 2000, + "aud": "superset", + "datasets": [1, 2], + "rev": 1, + "rls_rules": [{"clause": "tenant_id = 1"}], + } + token.update(overrides) + return token + + +def _patch_guest(mocker: MockerFixture, token: dict[str, Any] | None) -> None: + guest = mock.MagicMock() if token is not None else None + if guest is not None: + guest.guest_token = token + sm = mocker.patch("superset.tasks.guest.security_manager") + sm.get_current_guest_user_if_guest = mock.MagicMock(return_value=guest) + + +def test_returns_none_when_not_a_guest(mocker: MockerFixture) -> None: + from superset.tasks.guest import get_current_guest_subscriber_key + + _patch_guest(mocker, None) + + assert get_current_guest_subscriber_key() is None + + +def test_derives_prefixed_key_for_guest(mocker: MockerFixture) -> None: + from superset.tasks.guest import get_current_guest_subscriber_key + + _patch_guest(mocker, _guest_token()) + + key = get_current_guest_subscriber_key() + + assert key is not None + assert key.startswith("guest:") + # HMAC-SHA256 hex digest is 64 chars after the "guest:" prefix. + assert len(key) == len("guest:") + 64 + + +def test_same_token_derives_same_key(mocker: MockerFixture) -> None: + from superset.tasks.guest import get_current_guest_subscriber_key + + _patch_guest(mocker, _guest_token()) + first = get_current_guest_subscriber_key() + + _patch_guest(mocker, _guest_token()) + second = get_current_guest_subscriber_key() + + assert first == second + + +def test_scope_affecting_claims_change_the_key(mocker: MockerFixture) -> None: + """Two guests with different effective access must not share a key.""" + from superset.tasks.guest import get_current_guest_subscriber_key + + _patch_guest(mocker, _guest_token()) + baseline = get_current_guest_subscriber_key() + + for claim, value in ( + ("rls_rules", [{"clause": "tenant_id = 2"}]), + ("resources", [{"type": "dashboard", "id": "xyz"}]), + ("datasets", [3]), + ("rev", 2), + ("exp", 3000), + ): Review Comment: <div> <div id="suggestion"> <div id="issue"><b>Incomplete scope-affecting claim coverage</b></div> <div id="fix"> The `test_scope_affecting_claims_change_the_key` test covers only 5 of the 8 claims used in key derivation (lines 89-95). Three claims are omitted: `aud`, `iat`, and `user`. These claims are included in the message dict in `superset/tasks/guest.py` (lines 56-64) and could cause key collisions if they differ between tokens but aren't tested. Complete the coverage loop to include these claims. </div> </div> <small><i>Code Review Run #8e41b5</i></small> </div> --- Should Bito avoid suggestions like this for future reviews? (<a href=https://alpha.bito.ai/home/ai-agents/review-rules>Manage Rules</a>) - [ ] Yes, avoid them -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
