rusackas opened a new pull request, #42934: URL: https://github.com/apache/superset/pull/42934
### SUMMARY A few related fixes to account password-change and session handling, bundled together since they touch overlapping code paths: - `CurrentUserRestApi.update_me` now requires a `current_password` field (verified against the account's existing password) whenever a password change is requested, rather than accepting a new password with no proof of the old one. Skipped only for accounts that have no password set yet. - Fixed a bug in the same handler where the plaintext password value could overwrite the just-computed hash before the record was persisted, since both lived in the same attributes dict passed to the DAO's update call. - Password changes and resets (self-service and admin-initiated) now stamp the existing session-invalidation epoch for the account, so other active sessions stop working after a password change instead of remaining valid indefinitely. - Added an explicit admin action (`DELETE /api/v1/security/users/<pk>/sessions`) to terminate a specific user's sessions without disabling their account — there wasn't previously a direct way to do this short of deactivating the user. - `SupersetUserApi.post`/`put` used to commit the FAB user write, then sync the user's `Subject` row in a second, separate commit — so a failure in that second commit could leave an orphaned user with no matching `Subject` row. The sync now happens in `pre_add`/`pre_update`, which FAB calls before the commit its own `datamodel.add`/`edit` issues, so both writes ride the same transaction and roll back together on failure. ### TESTING INSTRUCTIONS ```bash pytest tests/unit_tests/views/test_current_user_api.py pytest tests/unit_tests/security/test_password_change_session_invalidation.py pytest tests/unit_tests/security/test_superset_user_api_subject_sync.py ``` Manual: as any user, `PUT /api/v1/me/` with a `password` and no `current_password` should now be rejected; with the correct `current_password` it should succeed and any other active session for that account should be invalidated. As an admin, `DELETE /api/v1/security/users/<id>/sessions` should end that user's sessions without changing their `active` status. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [x] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
