rebenitez1802 opened a new pull request, #43800: URL: https://github.com/apache/superset/pull/43800
### SUMMARY Some cache serializers round-trip Python `set` values as `list` (e.g. any msgpack/JSON-style codec, whose `set → list` conversion is applied when the metadata cache is warmed). `Database.get_all_schema_names` / `get_all_catalog_names` are `@memoized_func`-cached and return `set[str]`, but `memoized_func` returns cache hits **raw**, so a warm read can yield a `list[str]`. `security_manager.get_schemas_accessible_by_user` / `get_catalogs_accessible_by_user` then reach `return schemas & accessible_schemas` (and the catalog equivalent). For users with **only** schema/catalog-level access — i.e. no database/catalog-wide grant that would hit the earlier `return` — this raises: ``` TypeError: unsupported operand type(s) for &: 'list' and 'set' ``` The database REST endpoints (`superset/databases/api.py`) only catch `OperationalError` / `OAuth2RedirectError` / `SupersetException` and carry no `@handle_api_exception`, so the `TypeError` escapes and surfaces as a generic 500 on `GET /api/v1/database/<pk>/schemas/` and `/catalogs/` — the user sees an "Unexpected error" box. Force-refresh masks it because `force=True` skips the cache read. **Fix:** normalize the candidate names to a `set` at the top of both methods (before the hierarchical early return, so every return path is covered), and widen the parameter annotation to `Collection[str]`. This is the same consumer-side normalization pattern as #31948. Only one production file changes; no cache-key/content/decorator change, so there is nothing to invalidate and it is safe to cherry-pick. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF N/A (backend-only bug fix, no UI change). ### TESTING INSTRUCTIONS Automated (added in `tests/unit_tests/security/manager_test.py`): ``` pytest tests/unit_tests/security/manager_test.py -k accessible_by_user ``` Four new tests cover both methods across both return paths (non-hierarchical `&` filter and the hierarchical early return), each passing a **list** as the candidate collection. They raise `TypeError` (or return a `list` instead of a `set`) before this change and pass after. Manually: as a user with only schema-level access on a database whose schema-list cache has been warmed by another principal, open the "Create dataset" flow (or call `GET /api/v1/database/<pk>/schemas/`) and confirm schemas list instead of returning a 500. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
