This is an automated email from the ASF dual-hosted git repository.
justinpark pushed a commit to branch 6.2
in repository https://gitbox.apache.org/repos/asf/superset.git
The following commit(s) were added to refs/heads/6.2 by this push:
new dacbdaa7098 fix(mcp): reset _mcp_user_id_var between tests to prevent
state leak
dacbdaa7098 is described below
commit dacbdaa70981db971b6d6a7da1103e8a4a169d14
Author: justinpark <[email protected]>
AuthorDate: Tue Sep 22 18:20:05 2026 -0700
fix(mcp): reset _mcp_user_id_var between tests to prevent state leak
_mcp_user_id_var intentionally survives past the per-call Flask app
context so middleware can read the resolved user id after it pops.
Some auth tests set it (directly, or via mcp_auth_hook/
_setup_user_context() with a mock user lacking a numeric .id) without
resetting it, leaking a stale value into whichever test ran next on
the same thread and causing test_middleware_logging.py assertions to
fail intermittently depending on test order.
Co-Authored-By: Claude Sonnet 5 <[email protected]>
---
tests/unit_tests/mcp_service/conftest.py | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/tests/unit_tests/mcp_service/conftest.py
b/tests/unit_tests/mcp_service/conftest.py
index fbb14f270df..38f6b8ca1e3 100644
--- a/tests/unit_tests/mcp_service/conftest.py
+++ b/tests/unit_tests/mcp_service/conftest.py
@@ -36,3 +36,23 @@ def disable_mcp_rbac(app):
app.config["MCP_RBAC_ENABLED"] = False
yield
app.config.pop("MCP_RBAC_ENABLED", None)
+
+
[email protected](autouse=True)
+def reset_mcp_user_id_var():
+ """Reset _mcp_user_id_var around every test in this directory.
+
+ _mcp_user_id_var is a module-level ContextVar that intentionally
+ survives past the per-call Flask app context (see auth.py) so it can
+ carry a resolved user id to middleware after the context pops. That
+ means a test which sets it (directly, or indirectly via
+ _setup_user_context()/mcp_auth_hook) but doesn't reset it leaks the
+ value into whichever test runs next on the same thread -- e.g. a mock
+ user without a numeric `.id` leaks a MagicMock into a later test that
+ asserts a real integer user_id.
+ """
+ from superset.mcp_service.auth import _mcp_user_id_var
+
+ token = _mcp_user_id_var.set(None)
+ yield
+ _mcp_user_id_var.reset(token)
