(superset) 06/06: fix(security): satisfy mypy on the decoded login-token payload

[ma...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

madhushreeag pushed a commit to branch madhu-one-time-login-tokens
in repository https://gitbox.apache.org/repos/asf/superset.git

commit 8e8485a87a5a7e50cc0d37f739841bdc2fe87556
Author: madhushree agarwal <ma...@apple.com>
AuthorDate: Wed Sep 16 16:00:56 2026 -0700

    fix(security): satisfy mypy on the decoded login-token payload
    
    JsonKeyValueCodec.decode is typed dict[Any, Any], which mypy will not narrow to
    the LoginTokenUserInfo the function declares. Cast at the return rather than
    weakening the signature: mint is the only writer and writes exactly that shape,
    and the contract is what makes the resolver's interface self-documenting. The
    comment records why the cast holds and what catches a row that does not.
---
 superset/security/login_token.py | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/superset/security/login_token.py b/superset/security/login_token.py
index bb77b7d62b5..641b479eb91 100644
--- a/superset/security/login_token.py
+++ b/superset/security/login_token.py
@@ -36,7 +36,7 @@ from __future__ import annotations
 
 import logging
 from datetime import datetime, timedelta
-from typing import Any, Callable, TypedDict
+from typing import Any, Callable, cast, TypedDict
 from uuid import UUID, uuid4
 
 from flask import current_app, Request
@@ -199,4 +199,8 @@ def consume(token: str) -> LoginTokenUserInfo | None:
     if expired or not userinfo:
         return None
 
-    return userinfo
+    # The codec decodes to a plain dict. The row was written by ``mint`` from a
+    # ``LoginTokenUserInfo``, so the shape holds by construction; a foreign or
+    # malformed row is caught by the falsy check above and, failing that, by
+    # ``auth_user_oauth`` requiring a username or email.
+    return cast(LoginTokenUserInfo, userinfo)