codeant-ai-for-open-source[bot] commented on code in PR #44857:
URL: https://github.com/apache/superset/pull/44857#discussion_r4151894497
##########
superset/security/password_change.py:
##########
@@ -170,6 +170,36 @@ def _is_exempt_endpoint(endpoint: Optional[str]) -> bool:
return view_class in _EXEMPT_VIEW_CLASSES
+def _profile_page_reachable(security_manager: Any) -> bool:
+ """Return whether the current user can reach ``UserInfoView.list``.
+
+ It requires ``can_read`` on ``user``, which ``sync_role_definitions`` only
+ grants to the built-in Admin/Alpha/Gamma roles -- a custom role is never
+ guaranteed to hold it. A user without it who gets redirected there hits
+ FAB's own access-denied redirect (to login), which, since they're already
+ authenticated, bounces straight back to the index -- which re-runs this
+ hook and redirects to the profile page again, looping forever.
+ """
+ return security_manager is not None and bool(
+ security_manager.has_access("can_read", "user")
+ )
+
+
+def _logout_fallback_candidates(security_manager: Any) -> list[str]:
+ """Build the ordered list of logout endpoints to try as a last resort."""
+ candidates = []
+ auth_view = getattr(security_manager, "auth_view", None)
+ # Only redirect to the registered auth view's logout if that view is
+ # itself exempt from this hook; otherwise the redirect would loop.
+ if (
+ auth_view is not None
+ and getattr(auth_view, "endpoint", None) in _EXEMPT_VIEW_CLASSES
+ ):
+ candidates.append(f"{auth_view.endpoint}.logout")
+ candidates.append("AuthDBView.logout")
Review Comment:
**Suggestion:** The registered Superset auth view is `SupersetAuthView`, but
it is not in `_EXEMPT_VIEW_CLASSES`; OAuth or LDAP users may fall back only to
nonexistent `AuthDBView.logout`.
**Assessment:** ๐ `Major` ยท ๐ `Occurrence: Sometimes` ยท ๐ท๏ธ `Api mismatch`
[](https://docs.codeant.ai/cli/resolve-pr-comments-skill)
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=3f757f803e494cd282958425a677b60a&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=3f757f803e494cd282958425a677b60a&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
<details>
<summary><b>Prompt for AI Agent ๐ค </b></summary>
```mdx
This is a comment left during a code review.
**Path:** superset/security/password_change.py
**Line:** 194:199
**Comment:**
*Api Mismatch: The registered Superset auth view is `SupersetAuthView`,
but it is not in `_EXEMPT_VIEW_CLASSES`; OAuth or LDAP users may fall back only
to nonexistent `AuthDBView.logout`.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F44857&comment_hash=dd890d3db514d3ca861dd416a1d5158e7c135f58c15cac3896723d56f1d50552&reaction=like'>๐</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F44857&comment_hash=dd890d3db514d3ca861dd416a1d5158e7c135f58c15cac3896723d56f1d50552&reaction=dislike'>๐</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
