codeant-ai-for-open-source[bot] commented on code in PR #45890:
URL: https://github.com/apache/superset/pull/45890#discussion_r4444718516
##########
superset/db_engine_specs/base.py:
##########
@@ -2544,6 +2570,67 @@ def impersonate_user(
return url, engine_kwargs
+ @classmethod
+ def validate_embedded_credentials(cls, credentials: Any) -> dict[str, str]
| None:
+ """
+ Return a complete embedded fallback credential, or ``None``.
+
+ Called by ``Database.get_embedded_fallback_credentials`` once its gate
has
+ decided the request is one the fallback governs. The canonical shape is
+ ``{username, password}`` or ``{username, auth_method: "keypair",
+ privatekey_body, privatekey_pass}``; an engine whose driver needs a
+ different shape overrides this. The database API and
parameter-validation
+ command use the same hook when checking credentials before saving.
+ """
+ return validated_embedded_credentials(credentials)
+
+ @classmethod
+ def apply_embedded_credentials(
+ cls,
+ database: Database, # pylint: disable=unused-argument
+ credentials: dict[str, str],
+ url: URL,
+ engine_kwargs: dict[str, Any],
+ ) -> tuple[URL, dict[str, Any]]:
+ """
+ Apply an embedded fallback credential to the connection.
+
+ Called *instead of* :meth:`impersonate_user`, not alongside it -- see
the
+ comment in ``Database._get_sqla_engine`` for why skipping
impersonation is
+ load-bearing twice over.
+
+ The identity is replaced on the URL rather than added to
``connect_args``
+ because the per-process engine cache is keyed on the rendered URL and
the
+ engine kwargs: putting it on the URL is what keeps a guest engine and a
+ logged-in user's engine on separate entries. ``URL.create`` rather than
+ ``URL.set`` so that the base credential is *replaced* -- ``set``
ignores
+ ``password=None``, which would leave a key-pair credential carrying the
+ connection's own password.
+ """
+ url = URL.create(
+ drivername=url.drivername,
+ username=credentials["username"],
+ password=credentials.get("password"),
+ host=url.host,
+ port=url.port,
+ database=url.database,
+ query=url.query,
+ )
+ return url, engine_kwargs
+
+ @classmethod
+ def get_embedded_credential_cache_key(cls, credentials: dict[str, str]) ->
str:
+ """
+ Cache-key material for results produced under an embedded fallback
credential.
+
+ Keyed on the configured identity rather than on the requesting
principal: a
+ ``GuestUser`` carries whatever username the guest token claims, and
whoever
+ mints the token must not get to choose which cache entry they read. All
+ guests on one connection legitimately share an entry -- they do run as
one
+ database user -- and guest-token RLS already separates them.
+ """
+ return f"embedded:{credentials['username']}"
Review Comment:
✅ **Customized review instruction saved!**
**Instruction:**
> Do not flag cache keys based on the configured username alone when
embedded credentials resolve to the same database identity; replacing the
secret for that username does not change the effective database user.
**Applied to:**
- `superset/db_engine_specs/base.py`
---
💡 *To manage or update this instruction, visit: [CodeAnt AI
Settings](https://app.codeant.ai/org/settings/learnings)*
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
