Copilot commented on code in PR #39604:
URL: https://github.com/apache/superset/pull/39604#discussion_r3244996744
##########
superset/security/manager.py:
##########
@@ -3164,6 +3169,60 @@ def get_user_by_username(self, username: str) ->
Optional[User]:
.one_or_none()
)
+ def find_user_with_relationships(
+ self,
+ username: Optional[str] = None,
+ email: Optional[str] = None,
+ ) -> Optional[User]:
+ """Find a user with roles and group roles eagerly loaded.
+
+ Mirrors FAB's ``SecurityManager.find_user``
+ (including ``auth_username_ci`` case-insensitive handling and
+ ``MultipleResultsFound`` guard) and additionally eager-loads
+ ``User.roles`` and ``User.groups.roles`` to prevent detached-instance
+ errors when the SQLAlchemy session is closed or rolled back after the
+ lookup — as happens in MCP tool-execution contexts.
+ """
+ eager = [
+ joinedload(self.user_model.roles),
+ joinedload(self.user_model.groups).joinedload("roles"),
Review Comment:
In find_user_with_relationships(), the eager-load option uses a string-based
loader path: joinedload(self.user_model.groups).joinedload("roles"). Elsewhere
in Superset, joinedload() is consistently called with class-bound relationship
attributes (not strings), which avoids typos and keeps the code
forward-compatible with SQLAlchemy’s deprecations around string-based
relationship names. Consider switching this to use the Group model’s roles
attribute (e.g., via self.group_model.roles) instead of the string literal.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
