kokhlo commented on issue #44385:
URL: https://github.com/apache/superset/issues/44385#issuecomment-5712816482
## Root cause confirmed on current `master`
The DELETE endpoints pass only the `key` to their commands:
**Dashboard filter state**
(`superset/dashboards/filter_state/api.py:576-586`):
```python
def delete(self, pk: int, key: str) -> Response:
try:
args = CommandParameters(resource_id=pk, key=key)
result = self.get_delete_command()(args).run()
```
**Explore form data** (`superset/explore/form_data/api.py:349-371`):
```python
def delete(self, key: str) -> Response:
try:
args = CommandParameters(key=key)
result = DeleteFormDataCommand(args).run()
```
Both commands attempt to delete the contextual mapping using
`cmd_params.tab_id`:
**Dashboard** (`superset/commands/dashboard/filter_state/delete.py:89-91`):
```python
tab_id = cmd_params.tab_id
contextual_key = cache_key(session.get("_id"), tab_id, resource_id)
cache_manager.filter_state_cache.delete(contextual_key)
```
**Explore** (`superset/commands/explore/form_data/delete.py:536-540`):
```python
tab_id = self._cmd_params.tab_id
contextual_key = cache_key(
session.get("_id"), tab_id, datasource_id, chart_id, datasource_type
)
cache_manager.explore_form_data_cache.delete(contextual_key)
```
Because `tab_id` is `None`, the commands construct a key for
`<session>;None;<resource>` instead of the actual `<session>;1;<resource>` (or
other tab ID) that was used during creation.
The primary entry is deleted successfully, but the contextual mapping
remains and causes the deleted key to be reused on the next POST from the same
context.
---
## Minimal fix
The DELETE endpoints should accept `tab_id` as a query parameter and pass it
to `CommandParameters`, matching the contract already established by POST and
PUT:
1. **`superset/temporary_cache/api.py:576`** (base
`TemporaryCacheRestApi.delete`):
```python
def delete(self, pk: int, key: str) -> Response:
try:
tab_id = request.args.get("tab_id")
args = CommandParameters(resource_id=pk, key=key, tab_id=tab_id)
```
2. **`superset/explore/form_data/api.py:349`**
(`ExploreFormDataRestApi.delete`):
```python
def delete(self, key: str) -> Response:
try:
tab_id = request.args.get("tab_id")
args = CommandParameters(key=key, tab_id=tab_id)
```
No change to the delete commands themselves or the state schemas — the fix
is purely in the API layer to honor the contract the commands already expect.
---
## Test coverage
A regression test should verify that after deleting a key created with
`tab_id=1`, creating state again with the same context generates a fresh key
rather than reusing the deleted one.
The existing
`tests/integration_tests/explore/form_data/commands_tests.py::TestDeleteFormDataCommand`
is close: it creates with `tab_id=1`, deletes, and asserts `result is True`,
but does not verify that the contextual mapping is cleared.
---
I'll open a PR within the hour with the two-line fix, updated OpenAPI docs,
and a behavioral test for both surfaces.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
