rusackas commented on code in PR #42819:
URL: https://github.com/apache/superset/pull/42819#discussion_r3752638926
##########
superset/commands/security/create.py:
##########
@@ -46,6 +47,12 @@ def run(self) -> Any:
return RLSDAO.create(attributes=self._properties)
def validate(self) -> None:
+ name = self._properties.get("name")
+ if name and not RLSDAO.validate_uniqueness(name):
+ raise ValidationError(
+ {"name": [_("A rule with this name already exists.")]}
+ )
Review Comment:
Good catch, this let the duplicate-name check fire before we even confirmed
the caller has access to the datasource. Reordered so datasource access is
validated first, in both create and update.
##########
superset/daos/security.py:
##########
@@ -15,9 +15,27 @@
# specific language governing permissions and limitations
# under the License.
+from typing import Optional
+
from superset.connectors.sqla.models import RowLevelSecurityFilter
from superset.daos.base import BaseDAO
+from superset.extensions import db
class RLSDAO(BaseDAO[RowLevelSecurityFilter]):
- pass
+ @classmethod
+ def validate_uniqueness(cls, name: str, rule_id: Optional[int] = None) ->
bool:
+ """
+ Validate that the RLS rule name is unique.
+
+ :param name: RLS rule name
+ :param rule_id: id of the rule being updated, excluded from the check
so
+ that saving a rule without renaming it is not treated as a
collision
+ :return: True if the name is unique, False otherwise
+ """
+ query = db.session.query(RowLevelSecurityFilter).filter(
+ RowLevelSecurityFilter.name == name
+ )
+ if rule_id is not None:
+ query = query.filter(RowLevelSecurityFilter.id != rule_id)
+ return not db.session.query(query.exists()).scalar()
Review Comment:
Fair point, the preflight check isn't atomic with the insert/update. Now
catching the unique constraint violation at flush time and turning it into the
same field error instead of leaking the raw SQLAlchemy message.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
