bito-code-review[bot] commented on PR #40071:
URL: https://github.com/apache/superset/pull/40071#issuecomment-4432318067
<!-- Bito Reply -->
The flagged issue is valid: after re-querying the token under the lock, the
code checks only if the row exists but not if refresh_token is present. If
refresh_token is None, calling get_oauth2_fresh_token can trigger an error that
deletes the token unnecessarily. To resolve, add a guard for missing
refresh_token after the re-query. Here's the concise fix:
**superset/utils/oauth2.py**
```
# Short circuit in case another request already deleted the token
token = (
db.session.query(DatabaseUserOAuth2Tokens)
.filter_by(user_id=user_id, database_id=database_id)
.one_or_none()
)
if token is None:
return None
if token.refresh_token is None:
return None
try:
token_response = db_engine_spec.get_oauth2_fresh_token(
config,
token.refresh_token
)
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
