lhpaoletti opened a new issue, #45023:
URL: https://github.com/apache/superset/issues/45023
### Bug description
When the MCP `generate_chart` tool creates a chart in a Superset deployment
using a custom security manager and custom user model, the chart insert fails
at transaction commit with an SQLAlchemy `FlushError`.
I think that the failure occurs because MCP user authentication loads the
base Flask-AppBuilder `User` model, while the chart model's `last_saved_by`
relationship is configured against the active security manager's `user_model`
(the custom user class). Chart creation then assigns `g.user` to
`Slice.last_saved_by`, and SQLAlchemy rejects the base `User` instance as a
result.
This appears to me to be a model-selection bug in MCP authentication: the
MCP loader should query the configured `security_manager.user_model`, as other
Superset code paths do, rather than importing and querying FAB's base `User`
directly.
### Relevant code paths
- `superset/mcp_service/auth.py` imports FAB's `User` and
`load_user_with_relationships()` queries that class directly.
- MCP authentication assigns the resolved user to `g.user`.
- `superset/commands/chart/create.py` sets
`self._properties["last_saved_by"] = g.user`.
- `superset/models/slice.py` maps `last_saved_by` to
`security_manager.user_model`.
### Reproducing the bug
1. Configure Superset to use a custom security manager with a custom
`user_model` subclassing FAB's `User`.
2. Start Superset and its MCP service with that configuration.
3. Authenticate as a user and call MCP `generate_chart` for an accessible
dataset, setting `save_chart=True`. For example, use an XY chart with a
categorical X-axis and a valid metric.
4. Observe chart generation fail at commit.
Chart creation fails with an error equivalent to:
```
sqlalchemy.orm.exc.FlushError: Attempting to flush an item of type
<class 'flask_appbuilder.security.sqla.models.User'> as a member of
collection
"Slice.last_saved_by". Expected an object of type
<class 'custom_user_model.CustomUser'> or a polymorphic subclass of this
type.
```
#### My custom user model
```python
from flask_appbuilder.security.sqla.models import User
from sqlalchemy import Column, JSON
from sqlalchemy.dialects.postgresql import JSONB
class CustomUser(User):
__tablename__ = "ab_user"
__table_args__ = {"extend_existing": True}
claims = Column(JSON().with_variant(JSONB, "postgresql"), nullable=True)
```
### Screenshots/recordings
_No response_
### Superset version
6.1.0
### Python version
3.11
### Node version
18 or greater
### Browser
Not applicable
### Additional context
```
Traceback (most recent call last):
File "/app/superset/utils/decorators.py", line 261, in wrapped
db.session.commit() # pylint: disable=consider-using-transaction
^^^^^^^^^^^^^^^^^^^
File "<string>", line 2, in commit
File "/app/.venv/lib/python3.11/site-packages/sqlalchemy/orm/session.py",
line 1454, in commit
self._transaction.commit(_to_root=self.future)
File "/app/.venv/lib/python3.11/site-packages/sqlalchemy/orm/session.py",
line 832, in commit
self._prepare_impl()
File "/app/.venv/lib/python3.11/site-packages/sqlalchemy/orm/session.py",
line 811, in _prepare_impl
self.session.flush()
File "/app/.venv/lib/python3.11/site-packages/sqlalchemy/orm/session.py",
line 3449, in flush
self._flush(objects)
File "/app/.venv/lib/python3.11/site-packages/sqlalchemy/orm/session.py",
line 3588, in _flush
with util.safe_reraise():
File
"/app/.venv/lib/python3.11/site-packages/sqlalchemy/util/langhelpers.py", line
70, in __exit__
compat.raise_(
File "/app/.venv/lib/python3.11/site-packages/sqlalchemy/util/compat.py",
line 211, in raise_
raise exception
File "/app/.venv/lib/python3.11/site-packages/sqlalchemy/orm/session.py",
line 3549, in _flush
flush_context.execute()
File
"/app/.venv/lib/python3.11/site-packages/sqlalchemy/orm/unitofwork.py", line
456, in execute
rec.execute(self)
File
"/app/.venv/lib/python3.11/site-packages/sqlalchemy/orm/unitofwork.py", line
579, in execute
self.dependency_processor.process_saves(uow, states)
File
"/app/.venv/lib/python3.11/site-packages/sqlalchemy/orm/dependency.py", line
806, in process_saves
self._synchronize(
File
"/app/.venv/lib/python3.11/site-packages/sqlalchemy/orm/dependency.py", line
845, in _synchronize
self._verify_canload(child)
File
"/app/.venv/lib/python3.11/site-packages/sqlalchemy/orm/dependency.py", line
283, in _verify_canload
raise exc.FlushError(
sqlalchemy.orm.exc.FlushError: Attempting to flush an item of type <class
'flask_appbuilder.security.sqla.models.User'> as a member of collection
"Slice.last_saved_by". Expected an object of type <class
'custom_user_model.CustomUser'> or a polymorphic subclass of this type.
The above exception was the direct cause of the following exception:
Traceback (most recent call last):
File "/app/superset/mcp_service/chart/tool/generate_chart.py", line 397,
in generate_chart
chart = command.run()
^^^^^^^^^^^^^
File "/app/superset/utils/decorators.py", line 267, in wrapped
return on_error(ex)
^^^^^^^^^^^^
File "/app/superset/utils/decorators.py", line 230, in on_error
raise reraise() from ex
superset.commands.chart.exceptions.ChartCreateFailedError: Chart could not
be created.
```
### Checklist
- [x] I have searched Superset docs and Slack and didn't find a solution to
my problem.
- [x] I have searched the GitHub issue tracker and didn't find a similar bug
report.
- [x] I have checked Superset's logs for errors and if I found a relevant
Python stacktrace, I included it here as text in the "additional context"
section.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
