Skip to content

fix(reports): guard SUCCESS-state report execution against duplicate sends and stuck WORKING state#40657

Merged
sadpandajoe merged 2 commits into
masterfrom
fix/report-success-state-guards
Jun 2, 2026
Merged

fix(reports): guard SUCCESS-state report execution against duplicate sends and stuck WORKING state#40657
sadpandajoe merged 2 commits into
masterfrom
fix/report-success-state-guards

Conversation

@rusackas
Copy link
Copy Markdown
Member

@rusackas rusackas commented Jun 2, 2026

SUMMARY

Two correctness/security defects in ReportSuccessState.next() (superset/commands/report/execute.py), both diverging from the robust pattern already used by the sibling ReportNotTriggeredErrorState.next():

  1. Concurrent execution / duplicate notifications (CWE-362). The WORKING-state guard blocks a concurrent scheduler tick from re-running a report. It's set before send() for ALERT types and on the not-triggered/error path, but not for REPORT types in the SUCCESS/GRACE state — they go straight to send() with no WORKING marker. A second scheduler tick (which sees last_state == SUCCESS and routes back into ReportSuccessState) is therefore not blocked, allowing duplicate sends. Now sets WORKING before send() for REPORT types too.

  2. Stuck WORKING state (CWE-755). In the ALERT error path, if send_error() itself raises, the ERROR-state transition was skipped, leaving the schedule stuck in WORKING until the working timeout. send_error() is now wrapped so the ERROR transition always runs (and a logging failure there is swallowed), mirroring the sibling's finally pattern.

TESTING INSTRUCTIONS

pytest tests/unit_tests/commands/report/execute_test.py

Updated test_success_state_report_sends_and_logs_success to expect WORKINGSUCCESS; added test_success_state_error_logged_when_send_error_raises asserting ERROR is logged even when send_error() raises.

ADDITIONAL INFORMATION

  • Has associated issue:
  • Required feature flags:
  • Changes UI
  • Includes DB Migration
  • Introduces new feature or API
  • Removes existing feature or API

🤖 Generated with Claude Code

@dosubot dosubot Bot added the alert-reports Namespace | Anything related to the Alert & Reports feature label Jun 2, 2026
@bito-code-review
Copy link
Copy Markdown
Contributor

bito-code-review Bot commented Jun 2, 2026

Code Review Agent Run #5e0254

Actionable Suggestions - 0
Review Details
  • Files reviewed - 2 · Commit Range: 5f7ae73..5f7ae73
    • superset/commands/report/execute.py
    • tests/unit_tests/commands/report/execute_test.py
  • Files skipped - 0
  • Tools
    • Whispers (Secret Scanner) - ✔︎ Successful
    • Detect-secrets (Secret Scanner) - ✔︎ Successful
    • MyPy (Static Code Analysis) - ✔︎ Successful
    • Astral Ruff (Static Code Analysis) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

  • /review - Manually triggers a full AI review.

  • /pause - Pauses automatic reviews on this pull request.

  • /resume - Resumes automatic reviews.

  • /resolve - Marks all Bito-posted review comments as resolved.

  • /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by Bito Logo

@netlify
Copy link
Copy Markdown

netlify Bot commented Jun 2, 2026

Deploy Preview for superset-docs-preview ready!

Name Link
🔨 Latest commit a4bb169
🔍 Latest deploy log https://app.netlify.com/projects/superset-docs-preview/deploys/6a1f4ea2f03a43000831c6fe
😎 Deploy Preview https://deploy-preview-40657--superset-docs-preview.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

@codecov
Copy link
Copy Markdown

codecov Bot commented Jun 2, 2026

Codecov Report

❌ Patch coverage is 58.33333% with 5 lines in your changes missing coverage. Please review.
✅ Project coverage is 64.03%. Comparing base (8c62f53) to head (a4bb169).

Files with missing lines Patch % Lines
superset/commands/report/execute.py 58.33% 5 Missing ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master   #40657      +/-   ##
==========================================
- Coverage   64.03%   64.03%   -0.01%     
==========================================
  Files        2662     2662              
  Lines      143243   143252       +9     
  Branches    32940    32941       +1     
==========================================
+ Hits        91724    91728       +4     
- Misses      49932    49937       +5     
  Partials     1587     1587              
Flag Coverage Δ
hive 39.80% <0.00%> (-0.01%) ⬇️
mysql 58.48% <58.33%> (-0.01%) ⬇️
postgres 58.55% <58.33%> (-0.01%) ⬇️
presto 41.40% <0.00%> (-0.01%) ⬇️
python 60.03% <58.33%> (-0.01%) ⬇️
sqlite 58.17% <58.33%> (-0.01%) ⬇️
unit 100.00% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Comment thread superset/commands/report/execute.py
@bito-code-review
Copy link
Copy Markdown
Contributor

The PR comments file contains only the header row and no actual comments. There is no content to analyze for this review suggestion.

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR hardens the report/alert execution state machine to better handle concurrency and failure scenarios in ReportSuccessState.next() by ensuring a WORKING-state guard is applied before sending notifications and by preventing schedules from getting stuck in WORKING when error-notification delivery fails.

Changes:

  • Set ReportState.WORKING before send() for non-ALERT (REPORT) schedules to reduce duplicate sends from concurrent scheduler ticks.
  • Wrap send_error() in a try/except/finally so the schedule transitions to ERROR even if sending the error notification raises.
  • Update/add unit tests to assert the new state transitions and the “ERROR is logged even if send_error raises” behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File Description
superset/commands/report/execute.py Adds WORKING-state guard for REPORT success execution and ensures ERROR transition happens even when send_error() fails.
tests/unit_tests/commands/report/execute_test.py Updates success-path expectations to include WORKING→SUCCESS and adds a regression test for send_error() raising.

Comment thread superset/commands/report/execute.py
@bito-code-review
Copy link
Copy Markdown
Contributor

bito-code-review Bot commented Jun 2, 2026

Code Review Agent Run #902385

Actionable Suggestions - 0
Review Details
  • Files reviewed - 1 · Commit Range: 5f7ae73..2b3690b
    • superset/commands/report/execute.py
  • Files skipped - 0
  • Tools
    • Whispers (Secret Scanner) - ✔︎ Successful
    • Detect-secrets (Secret Scanner) - ✔︎ Successful
    • MyPy (Static Code Analysis) - ✔︎ Successful
    • Astral Ruff (Static Code Analysis) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

  • /review - Manually triggers a full AI review.

  • /pause - Pauses automatic reviews on this pull request.

  • /resume - Resumes automatic reviews.

  • /resolve - Marks all Bito-posted review comments as resolved.

  • /abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by Bito Logo

claude and others added 2 commits June 2, 2026 14:43
…ING)

Two defects in ReportSuccessState.next(), both diverging from the robust
pattern already used in ReportNotTriggeredErrorState.next():

- REPORT types never set the WORKING state before send(), so a concurrent
  scheduler tick (which routes to ReportSuccessState again while last_state is
  SUCCESS) is not blocked and can re-send — duplicate notifications. Set WORKING
  before send() for REPORT types (ALERT types already do).
- In the ALERT error path, if send_error() itself raises, the ERROR-state
  transition was skipped, leaving the schedule stuck in WORKING until the
  working timeout. Wrap send_error() so the ERROR transition always runs.

Update the REPORT success test for the new WORKING->SUCCESS sequence and add a
test asserting ERROR is still logged when send_error() raises.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…cceeds

REPORT_SCHEDULE_ERROR_NOTIFICATION_MARKER was logged unconditionally in the
finally block even when send_error() raised. find_last_error_notification()
uses this marker to decide grace-period suppression, so recording it on
notification failure incorrectly prevented subsequent error notifications.

Now mirrors the ReportNotTriggeredErrorState pattern: start with the marker
as the default error_message, capture send_ex if send_error() fails and
override error_message with str(send_ex), so the marker only lands in the DB
when the notification was actually delivered.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
@sadpandajoe sadpandajoe force-pushed the fix/report-success-state-guards branch from 2b3690b to a4bb169 Compare June 2, 2026 21:44
@sha174n sha174n added the merge-if-green If approved and tests are green, please go ahead and merge it for me label Jun 2, 2026
@sadpandajoe sadpandajoe merged commit 6abee02 into master Jun 2, 2026
62 checks passed
@sadpandajoe sadpandajoe deleted the fix/report-success-state-guards branch June 2, 2026 22:09
@github-project-automation github-project-automation Bot moved this from Needs Review to Approved and/or Merged in Superset Review Help Wanted Jun 2, 2026
@bito-code-review
Copy link
Copy Markdown
Contributor

Bito Automatic Review Skipped – PR Already Merged

Bito scheduled an automatic review for this pull request, but the review was skipped because this PR was merged before the review could be run.
No action is needed if you didn't intend to review it. To get a review, you can type /review in a comment and save it

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

alert-reports Namespace | Anything related to the Alert & Reports feature merge-if-green If approved and tests are green, please go ahead and merge it for me size/M

Projects

Status: Approved and/or Merged

Development

Successfully merging this pull request may close these issues.

5 participants