Propagate async_user via crum.impersonate in DojoAsyncTask base class#14308
Open
valentijnscholten wants to merge 3 commits intoDefectDojo:bugfixfrom
Open
Propagate async_user via crum.impersonate in DojoAsyncTask base class#14308valentijnscholten wants to merge 3 commits intoDefectDojo:bugfixfrom
valentijnscholten wants to merge 3 commits intoDefectDojo:bugfixfrom
Conversation
valentijnscholten
added
the
affects_pro
Previously, async_user was passed through kwargs and each consumer had to manually extract it. This was fragile and caused user context to be lost in nested Celery task dispatches (e.g. sub-tasks spawned from within a worker had no HTTP request context, so get_current_user() returned None and block_execution was silently ignored). DojoAsyncTask.__call__ now pops async_user from kwargs and wraps the task execution in crum.impersonate(user), making get_current_user() return the correct user transparently for all downstream code. When a task is called directly (not via apply_async), async_user is absent from kwargs. In that case the existing crum context is preserved so that callers who set a user via impersonate() are not disrupted. Consumer-side cleanup: - we_want_async() uses get_current_user() directly - add_findings_to_auto_group() drops async_user fallback - do_false_positive_history() drops async_user pop from kwargs - Delete task docstrings updated
valentijnscholten
force-pushed
the
fix/async-user-crum-impersonate
branch
from
a419cfa to
dc6df06
Compare
Add blank lines before class docstrings (D203) and move method docstring summary to second line (D213) to satisfy upstream Ruff config.
dojo_dispatch_task was popping sync from kwargs before running the task, preventing tasks from knowing they should run their own sub-tasks synchronously. Remove the pop so sync flows through to task functions. Add explicit sync parameter to post_process_findings_batch and forward it to calculate_grade so product grading also runs inline when the caller requests sync execution.
Maffooch
approved these changes
Feb 13, 2026
Contributor
Maffooch
left a comment
Maffooch
left a comment
There was a problem hiding this comment.
Manually tested this one, and everything looks good! Not sure what AccesLint is on tho
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
DojoAsyncTask.__call__popsasync_userfrom kwargs and wraps task execution incrum.impersonate(user), soget_current_user()returns the correct user transparently in all Celery workers.block_executionto be silently ignored).apply_async), the existing crum context is preserved.async_userextraction from consumers:we_want_async(),add_findings_to_auto_group(),do_false_positive_history().