FrancescoCastaldi commented on issue #45877: URL: https://github.com/apache/superset/issues/45877#issuecomment-6525352449
Good catch @Abhi2939 — totally agree. Falling back to \user.username\ in \QueryObject.cache_key\ was overly broad: 1. \QueryContextProcessor.query_cache_key()\ already forwards \datasource.get_extra_cache_keys()\ directly into \query_obj.cache_key(extra_cache_keys=...)\, so isolating the partition exclusively inside \SemanticView.get_extra_cache_keys()\ is completely sufficient. 2. Relying on \current_host_execution_context().identity_digest\ ensures the partition correctly incorporates principal ID, effective role IDs, and namespace HMAC without leaking raw usernames across datasource abstractions. 3. Keeping \exec_context.is_guest\ excluded from the partition allows guest users to share result cache entries safely, as intended. I have updated the branch to completely revert the \QueryObject\ change and keep the isolation 100% self-contained in \SemanticView.get_extra_cache_keys()\, along with unit tests validating authenticated user isolation, guest cache sharing, and flag-disabled behavior: https://github.com/FrancescoCastaldi/superset/commit/00ca5328cd6 @surawut-jirasaktavee please go ahead with your PR! Looking forward to reviewing and testing it. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
