bito-code-review[bot] commented on code in PR #39469:
URL: https://github.com/apache/superset/pull/39469#discussion_r3610464058
##########
superset/security/manager.py:
##########
@@ -4543,6 +4560,39 @@ def is_admin(self) -> bool:
role.name for role in self.get_user_roles()
]
+ def auth_user_db(self, username: str, password: str) -> User | None:
+ """
+ Authenticate a database user, verifying bcrypt/argon2 and legacy
hashes.
+ """
+ if username is None or username == "":
+ return None
+ first_user = self.get_first_user()
+ user = self.find_user(username=username)
+ if user is None:
+ user = self.find_user(email=username)
+ else:
+ # Balance failure and success
+ _ = self.find_user(email=username)
+ if user is None or (not user.is_active):
+ # Balance failure and success
+ check_password_hash(
+ current_app.config.get(
+ "AUTH_DB_FAKE_PASSWORD_HASH_CHECK",
+ DEFAULT_AUTH_DB_FAKE_PASSWORD_HASH_CHECK,
+ ),
+ "password",
+ )
+ logger.info(LOGMSG_WAR_SEC_LOGIN_FAILED, username)
+ if first_user:
+ self.noop_user_update(first_user)
+ return None
+ if verify_auth_db_password(user.password, password):
+ self.update_user_auth_stat(user, True)
+ return user
Review Comment:
<!-- Bito Reply -->
The observation is correct. Since `update_user_auth_stat` internally calls
`on_user_login`, the security event and session stamping are already handled.
The suggestion to add an explicit `on_user_login` call is redundant in this
specific implementation.
**superset/security/manager.py**
```
if verify_auth_db_password(user.password, password):
self.update_user_auth_stat(user, True)
return user
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
