fix: use end-user ID in OBO analytics cache key#268
Merged
MarioCadenas merged 1 commit intomainfrom Apr 13, 2026
Merged
Conversation
getCurrentUserId() was called outside runInUserContext, so the cache key for OBO queries used the service principal's ID instead of the requesting user's. Two different users making the same OBO query with the same parameters would share a single cache entry — a cross-user data leak. Read the user ID directly from the request header via resolveUserId(req), which is the source of truth for "who is asking." Signed-off-by: MarioCadenas <MarioCadenas@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
getCurrentUserId()was called outsiderunInUserContext, so the cache key for.obo.sqlqueries used the service principal's ID instead of the requesting user's. Two different users making the same OBO query with the same parameters shared a single cache entry.resolveUserId(req)instead of relying onAsyncLocalStorage, which hadn't entered user context yet at the point where the cache key was constructed.Test plan
executeStatementis called once per user, not shared via cache