bito-code-review[bot] commented on code in PR #44546:
URL: https://github.com/apache/superset/pull/44546#discussion_r4080868591
##########
tests/unit_tests/common/test_query_context_processor.py:
##########
@@ -115,25 +115,168 @@ def processor(mock_query_context):
return processor
-def test_query_cache_key_binds_annotation_data_to_requesting_user(processor):
- """The cache key for annotated queries must differ per requesting user."""
+def test_annotation_cache_key_binds_native_annotation_read_scope(processor):
Review Comment:
<!-- Bito Reply -->
The addition of return type annotations to the test functions is appropriate
and aligns with the project's typing standards. This change improves code
clarity and ensures consistency with the required typing rules.
**tests/unit_tests/common/test_query_context_processor.py**
```
def test_annotation_cache_key_binds_native_annotation_read_scope(processor)
-> None:
```
##########
tests/unit_tests/common/test_query_context_processor.py:
##########
@@ -115,25 +115,168 @@ def processor(mock_query_context):
return processor
-def test_query_cache_key_binds_annotation_data_to_requesting_user(processor):
- """The cache key for annotated queries must differ per requesting user."""
+def test_annotation_cache_key_binds_native_annotation_read_scope(processor):
+ """The annotation cache key for NATIVE layers must differ when the
+ requester's ``can_read`` (Annotation) access differs -- not who they
are."""
query_obj = MagicMock()
query_obj.annotation_layers = [{"sourceType": "NATIVE", "name": "a",
"value": 1}]
- with (
- patch(
- "superset.common.query_context_processor.get_user_id",
- side_effect=[1, 2],
- ),
- patch("superset.common.query_context_processor.security_manager"),
- ):
- processor.query_cache_key(query_obj)
- processor.query_cache_key(query_obj)
+ # ``security_manager`` autodetects as an async spec under a bare
+ # ``patch()`` (its real object trips ``unittest.mock``'s coroutine
+ # inference), which would silently turn every attribute access into an
+ # ``AsyncMock`` returning a fresh unawaited coroutine per call -- always
+ # unequal to itself and never equal to a configured return value. Forcing
+ # ``new_callable=MagicMock`` keeps these synchronous, as the real object
+ # is.
+ with patch(
+ "superset.common.query_context_processor.security_manager",
+ new_callable=MagicMock,
+ ) as security_manager:
+ security_manager.can_access.side_effect = [True, False]
+ processor.annotation_cache_key(query_obj)
+ processor.annotation_cache_key(query_obj)
contexts = [
call.kwargs["annotation_context"] for call in
query_obj.cache_key.call_args_list
]
assert contexts[0] != contexts[1]
+def test_annotation_cache_key_shares_across_same_access_scope():
+ """Two distinct requesters (separate processor/query-object instances,
+ standing in for two different requests) with identical access scope must
+ produce identical annotation-context material. Reusing a single
+ processor/query_obj across both calls (as this test previously did)
+ would pass trivially regardless of whether the key is scope-based or
+ identity-based, since nothing about "who's asking" would ever vary."""
+ layer = {"sourceType": "NATIVE", "name": "a", "value": 1}
+ processor_a = QueryContextProcessor(MagicMock())
+ processor_b = QueryContextProcessor(MagicMock())
+ query_obj_a = MagicMock(annotation_layers=[layer])
+ query_obj_b = MagicMock(annotation_layers=[layer])
+
+ with patch(
+ "superset.common.query_context_processor.security_manager",
+ new_callable=MagicMock,
+ ) as security_manager:
+ security_manager.can_access.return_value = True
+ context_a = processor_a._annotation_cache_context(query_obj_a)
+ context_b = processor_b._annotation_cache_context(query_obj_b)
+
+ assert context_a == context_b
+
+
+def test_query_cache_key_does_not_bind_annotation_scope(processor):
+ """The dataframe cache key must stay shared across viewers of the same
+ chart, even when the query has annotation layers — only the separate
+ annotation cache key (see above) carries access-scope material."""
+ query_obj = MagicMock()
+ query_obj.annotation_layers = [{"sourceType": "NATIVE", "name": "a",
"value": 1}]
+ with patch(
+ "superset.common.query_context_processor.security_manager",
+ new_callable=MagicMock,
+ ):
+ processor.query_cache_key(query_obj)
+ processor.query_cache_key(query_obj)
+ for call in query_obj.cache_key.call_args_list:
+ assert "annotation_context" not in call.kwargs
+
+
[email protected]
+def mock_annotation_chart():
+ """A found chart, wired as the referenced chart for
+ ``_annotation_source_scope`` tests -- factors out the repeated
+ ``ChartDAO.find_by_id`` patch those tests all need."""
+ chart = MagicMock()
+ with patch(
+ "superset.common.query_context_processor.ChartDAO.find_by_id",
+ return_value=chart,
+ ):
+ yield chart
+
+
+def test_annotation_source_scope_binds_datasource_access(
+ processor, mock_annotation_chart
+):
+ """A chart-backed annotation layer's scope must differ when the
+ requester's access to the referenced datasource differs."""
+ mock_annotation_chart.get_query_context.return_value = None
+ with patch(
+ "superset.common.query_context_processor.security_manager",
+ new_callable=MagicMock,
+ ) as security_manager:
+ security_manager.can_access_datasource.side_effect = [True, False]
+ security_manager.get_rls_cache_key.return_value = []
+ scope_a = processor._annotation_source_scope(1)
+ scope_b = processor._annotation_source_scope(1)
+ assert scope_a != scope_b
+ assert scope_a["access"] is True
+ assert scope_b["access"] is False
+
+
+def test_annotation_source_scope_reuses_referenced_chart_cache_key(
+ processor, mock_annotation_chart
+):
+ """When the referenced chart has a saved query context, its own cache
+ key(s) -- covering RLS and per-user Jinja/virtual-dataset material -- are
+ reused rather than re-derived."""
+ mock_query_object = MagicMock()
+ mock_query_context = MagicMock()
+ mock_query_context.queries = [mock_query_object]
+ mock_query_context.query_cache_key.return_value = "referenced-chart-key"
+ mock_annotation_chart.get_query_context.return_value = mock_query_context
+ with patch(
+ "superset.common.query_context_processor.security_manager",
+ new_callable=MagicMock,
+ ) as security_manager:
+ security_manager.can_access_datasource.return_value = True
+ scope = processor._annotation_source_scope(1)
+ assert scope == {"access": True, "data_key": ["referenced-chart-key"]}
+
mock_query_context.query_cache_key.assert_called_once_with(mock_query_object)
+
+
+def test_annotation_source_scope_fails_closed_on_any_derivation_error(
+ processor, mock_annotation_chart
+):
+ """A lookup failure must fail closed rather than silently deduping onto a
+ successfully-derived scope -- and not just for SupersetException: the RLS
+ lookup is a real DB query and get_extra_cache_keys() renders Jinja for
+ virtual datasets, so a driver or template error is just as likely as a
+ SupersetException here, and must not 500 the whole chart-data request."""
+ mock_annotation_chart.get_query_context.side_effect = RuntimeError("db
boom")
+ with patch(
+ "superset.common.query_context_processor.security_manager",
+ new_callable=MagicMock,
+ ) as security_manager:
+ security_manager.can_access_datasource.return_value = True
+ security_manager.get_rls_cache_key.return_value = []
+ scope = processor._annotation_source_scope(1)
+ assert scope == {"access": False, "data_key": []}
Review Comment:
<!-- Bito Reply -->
The suggestion to assert the warning is appropriate. It ensures that the
fail-closed behavior is not just functionally correct, but also observable,
preventing future regressions from silently swallowing errors. You can apply
this by using `caplog` to verify the warning is emitted when the derivation
fails.
**tests/unit_tests/common/test_query_context_processor.py**
```
def test_annotation_source_scope_fails_closed_on_any_derivation_error(
processor, mock_annotation_chart, caplog
):
mock_annotation_chart.get_query_context.side_effect = RuntimeError("db
boom")
with patch(
"superset.common.query_context_processor.security_manager",
new_callable=MagicMock,
) as security_manager:
security_manager.can_access_datasource.return_value = True
security_manager.get_rls_cache_key.return_value = []
with caplog.at_level("WARNING"):
scope = processor._annotation_source_scope(1)
assert "Failed to derive annotation source scope" in caplog.text
assert scope == {"access": False, "data_key": []}
```
##########
tests/unit_tests/common/test_query_context_processor.py:
##########
@@ -2186,6 +2329,91 @@ def
test_get_df_payload_no_warning_when_not_memory_limited() -> None:
assert result["warning"] is None
+def
test_get_df_payload_result_decouples_annotation_cache_from_dataframe_cache():
+ """
+ The dataframe cache entry must stay shareable across viewers, and
+ annotation-layer data must be resolved through its own (per-user) cache
+ path -- not stored on the dataframe's cache entry -- so that two viewers
+ of the same annotated chart share one dataframe cache hit while each
+ still gets their own annotation-security-scoped payload.
+ """
+ from superset.common.query_object import QueryObject
Review Comment:
<!-- Bito Reply -->
Maintaining consistency with the existing codebase is a valid approach.
Since inline imports are the established convention in this test file, you may
proceed with the current implementation.
##########
tests/testcontainers/db_engine_specs/test_bigquery.py:
##########
@@ -0,0 +1,148 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+"""
+Tests Superset's BigQuery string-literal escaping (superset/db_engine_specs/
+bigquery.py's ``_monkeypatch_bigquery_string_literal``) against a real
+GoogleSQL query engine, spun up on demand via testcontainers. Run via
+.github/workflows/testcontainers.yml.
+
+sc-120493-adjacent investigation: an apostrophe in a filter value used to
+break BigQuery queries (apache/superset#35857 / #38835, doubled single
+quotes -- BigQuery rejects ``'Armando''s'`` as two adjacent string literals
+needing whitespace between them). The current fix backslash-escapes instead.
+Reasoning about correctness from the ``sqlalchemy-bigquery`` dialect source
+and the BigQuery DBAPI's ``pyformat`` paramstyle handling is necessary but
+not sufficient; this locks in the actual compiled-and-executed behavior
+against a real engine instead.
+"""
+
+from collections.abc import Iterator
+
+import pytest
+import sqlalchemy as sa
+from sqlalchemy.engine import Engine
+
+pytestmark = pytest.mark.testcontainers
+
+from ._driver import require_driver # noqa: E402
+
+require_driver("testcontainers.community.google")
+
+from google.cloud import bigquery # noqa: E402
+from sqlalchemy_bigquery import BigQueryDialect # noqa: E402
+from testcontainers.community.google import BigQueryContainer # noqa: E402
+
+# Importing this triggers _monkeypatch_bigquery_string_literal(), exactly as
+# it runs in a real Superset process.
+import superset.db_engine_specs.bigquery # noqa: E402, F401
+
+DATASET = "ds"
+TABLE = "t"
+
+
[email protected](scope="module")
+def bq_client() -> Iterator[bigquery.Client]:
+ with BigQueryContainer() as container:
+ client = container.get_client()
+ client.create_dataset(f"{client.project}.{DATASET}")
+ client.query(f"CREATE TABLE {DATASET}.{TABLE} (name STRING)").result()
+ yield client
+
+
[email protected](scope="module")
+def engine(bq_client) -> Engine:
+ # user_supplied_client=true is a URL query param, not just a connect_args
+ # key: parse_url() only sets BigQueryDialect.create_connect_args() to
+ # accept the connect_args={"client": ...} override when it's present,
+ # otherwise it tries to build a client from real GCP credentials.
+ return sa.create_engine(
+ "bigquery://?user_supplied_client=true", connect_args={"client":
bq_client}
+ )
+
+
+def _compiled_literal(expr: sa.ColumnElement) -> str:
+ """Render ``expr`` exactly as Superset's actual code path does: compiled
+ with ``literal_binds=True``, then executed as a plain string with no
+ separate bind parameters (superset.db_engine_specs.base.BaseEngineSpec
+ .execute() calls ``cursor.execute(query)``, nothing else)."""
+ return str(
+ expr.compile(dialect=BigQueryDialect(),
compile_kwargs={"literal_binds": True})
+ )
+
+
+def _insert_and_find(engine: Engine, value: str) -> list[str]:
+ t = sa.table(TABLE, sa.column("name"))
+ with engine.connect() as conn:
+ conn.execute(sa.text(f"DELETE FROM {DATASET}.{TABLE} WHERE TRUE")) #
noqa: S608
+ insert_literal = _compiled_literal(sa.literal(value))
+ conn.execute(
+ sa.text(
+ f"INSERT INTO {DATASET}.{TABLE} (name) VALUES
({insert_literal})" # noqa: S608
+ )
+ )
+ where = _compiled_literal(t.c.name == value)
+ rows = conn.execute(
+ sa.text(f"SELECT name FROM {DATASET}.{TABLE} WHERE {where}") #
noqa: S608
+ ).fetchall()
+ return [row[0] for row in rows]
+
+
+def test_apostrophe_value_round_trips(engine: Engine) -> None:
+ """Regression test for apache/superset#35857: an apostrophe in a filter
+ value must not corrupt the compiled query or fail to match."""
+ assert _insert_and_find(engine, "O'Brien") == ["O'Brien"]
+
+
+def test_percent_sign_value_round_trips(engine: Engine) -> None:
+ """
+ A literal percent sign must survive Superset's actual execution path
+ unchanged. Superset's literal_processor does not double it (unlike the
+ upstream sqlalchemy-bigquery function it replaces), which is correct
+ specifically because Superset always executes via cursor.execute(query)
+ with no separate `parameters` -- the BigQuery DBAPI's own pyformat
+ handling only applies `%%` -> `%` de-escaping in that case
+ (google.cloud.bigquery.dbapi.cursor._format_operation), so a lone `%`
+ passes through untouched either way. A doubled `%%` would also survive
+ (de-escaped back to one `%`), so this test would not by itself catch a
+ regression toward doubling -- it exists to pin the actually-shipped
+ behavior, not to distinguish the two.
+ """
+ assert _insert_and_find(engine, "100% sure") == ["100% sure"]
+
+
+def test_combined_percent_and_apostrophe_round_trips(engine: Engine) -> None:
Review Comment:
<!-- Bito Reply -->
The suggestion is appropriate as it adds a descriptive docstring to the test
function, which improves code readability and maintains consistency with the
rest of the test suite. Applying this suggestion is recommended.
**tests/testcontainers/db_engine_specs/test_bigquery.py**
```
def test_combined_percent_and_apostrophe_round_trips(engine: Engine) -> None:
"""Round-trips a value containing both a percent sign and an
apostrophe."""
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
