(superset) branch master updated: refactor(passwords): accept passwords via YAML file (#38059)

[as...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

asoare pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/superset.git


The following commit(s) were added to refs/heads/master by this push:
     new 5c782397bb5 refactor(passwords): accept passwords via YAML file (#38059)
5c782397bb5 is described below

commit 5c782397bb5243ade741149e8bb4f167b8411b0c
Author: Alexandru Soare <37...@users.noreply.github.com>
AuthorDate: Fri Mar 27 14:37:34 2026 +0200

    refactor(passwords): accept passwords via YAML file (#38059)
    
    Co-authored-by: Mehmet Salih Yavuz <sa...@proton.me>
---
 superset/commands/importers/v1/utils.py            |  6 +++-
 .../databases/importers/v1/command_test.py         | 40 ++++++++++++++++++++++
 2 files changed, 45 insertions(+), 1 deletion(-)

diff --git a/superset/commands/importers/v1/utils.py b/superset/commands/importers/v1/utils.py
index 6e5bd93b440..26442342fd4 100644
--- a/superset/commands/importers/v1/utils.py
+++ b/superset/commands/importers/v1/utils.py
@@ -151,9 +151,13 @@ def load_configs(
             try:
                 config = load_yaml(file_name, content)
 
-                # populate passwords from the request or from existing DBs
+                # populate passwords from the request, from YAML config,
+                # or from existing DBs
                 if file_name in passwords:
                     config["password"] = passwords[file_name]
+                elif prefix == "databases" and config.get("password"):
+                    # password already in YAML config, keep it
+                    pass
                 elif prefix == "databases" and config["uuid"] in db_passwords:
                     config["password"] = db_passwords[config["uuid"]]
 
diff --git a/tests/unit_tests/commands/databases/importers/v1/command_test.py b/tests/unit_tests/commands/databases/importers/v1/command_test.py
index 529b43d7343..bb4228af86f 100644
--- a/tests/unit_tests/commands/databases/importers/v1/command_test.py
+++ b/tests/unit_tests/commands/databases/importers/v1/command_test.py
@@ -93,3 +93,43 @@ def test_import_mask_password(
         == "postgresql://user:XXXXXXXXXX@localhost:5432/superset"
     )
     assert database.password == "password"  # noqa: S105
+
+
+def test_import_database_with_password_in_config(
+    mocker: MockerFixture,
+    session: Session,
+) -> None:
+    """
+    Test that passwords in the YAML config are used when importing databases.
+    """
+    from superset import db, security_manager
+    from superset.commands.database.importers.v1 import ImportDatabasesCommand
+    from superset.models.core import Database
+
+    mocker.patch("superset.commands.database.importers.v1.utils.add_permissions")
+    mocker.patch.object(security_manager, "can_access", return_value=True)
+
+    configs: dict[str, dict[str, Any]] = {
+        "databases/examples.yaml": {
+            "database_name": "examples_with_password",
+            "sqlalchemy_uri": "postgresql://user:XXXXXXXXXX@localhost:5432/superset",
+            "cache_timeout": None,
+            "expose_in_sqllab": True,
+            "allow_run_async": False,
+            "allow_ctas": False,
+            "allow_cvas": False,
+            "extra": {},
+            "uuid": "b3dc77af-e654-49bb-b321-40f6b559a1ee",
+            "version": "1.0.0",
+            "password": "yaml_password",  # Password provided in YAML config
+            "allow_csv_upload": False,
+        },
+    }
+
+    engine = db.session.get_bind()
+    Database.metadata.create_all(engine)  # pylint: disable=no-member
+
+    ImportDatabasesCommand._import(configs)
+    uuid = configs["databases/examples.yaml"]["uuid"]
+    database = db.session.query(Database).filter_by(uuid=uuid).one()
+    assert database.password == "yaml_password"  # noqa: S105