You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "seunggabi (via GitHub)" <gi...@apache.org> on 2026/10/14 10:02:52 UTC
[PR] feat(api-keys): only offer MCP scopes the user can self-issue [superset]
seunggabi opened a new pull request, #45272:
URL: https://github.com/apache/superset/pull/45272
### SUMMARY
The "Create API Key" modal offers the full `superset:<resource>:<action>` scope catalog (32 entries), but `SecurityManager.create_api_key` rejects any scope that exceeds the issuing user's own permissions. For a non-admin that means most of the list cannot be selected successfully, and when they do pick one the request fails with a **500** (the `ValueError` raised by `_validate_requested_api_key_scopes` is unhandled under FAB's `@safe`) and the UI only shows a generic "Failed to create API key" toast.
This PR makes the modal offer only what the user can actually obtain, and turns the rejection into a proper 400 with a reason:
- `SecurityManager.get_allowed_api_key_scopes(user)` walks the scope catalog and keeps every scope that `_validate_requested_api_key_scopes` accepts, so the result is by construction exactly the set `create_api_key` will honour (admins get the full catalog, users with no matching permission get `[]`).
- `create_api_key` now translates the `ValueError` into `werkzeug.exceptions.BadRequest`, which FAB's `ApiKeyApi` `@safe` decorator maps to a **400** carrying the message. The docstring previously documented the 500 as a known follow-up; this closes it.
- New endpoint `GET /api/v1/me/api_key_scopes/` → `{"result": [...]}` for the current user (same 401 handling as the other `/me/` endpoints).
- `ApiKeyCreateModal` fetches that list when shown and filters the scope `<Select>` options; if the lookup fails it falls back to the full catalog as before. The failure toast now appends the server message (via `getClientErrorObject`), e.g. `Failed to create API key: 400 Bad Request: Requested scope 'superset:dashboard:write' exceeds the issuing user's own permissions`.
No RBAC rules change: who may create keys and which scopes they may carry is decided exactly as before, the UI just stops offering options that are guaranteed to be rejected.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
Before: a Gamma-like user sees all 32 scopes; selecting e.g. `superset:dashboard:write` → HTTP 500, toast "Failed to create API key".
After: the Select only lists scopes the user may self-issue; a rejected request (e.g. crafted via API) → HTTP 400 with the reason, and the toast shows it.
### TESTING INSTRUCTIONS
1. Log in as a non-admin user (e.g. Gamma + a few read permissions) and open Settings → API Keys → Create.
2. The "MCP scopes" dropdown now lists only the scopes matching that user's permissions; `GET /api/v1/me/api_key_scopes/` returns the same list.
3. `POST /api/v1/security/api_keys/` with a scope outside that list returns 400 with `Requested scope '...' exceeds the issuing user's own permissions` (was 500).
4. As Admin the dropdown and the endpoint still return the full catalog.
5. Tests:
- `pytest tests/unit_tests/security/test_api_key_scopes.py tests/unit_tests/views/test_current_user_api.py`
- `cd superset-frontend && npx jest src/features/apiKeys`
### ADDITIONAL INFORMATION
- [ ] Has associated issue:
- [ ] Required feature flags:
- [x] Changes UI
- [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [x] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(api-keys): only offer MCP scopes the user can self-issue [superset]
Posted by "codeant-ai-for-open-source[bot] (via GitHub)" <gi...@apache.org>.
codeant-ai-for-open-source[bot] commented on PR #45272:
URL: https://github.com/apache/superset/pull/45272#issuecomment-6166015901
## CodeAnt PR Risk: Low Risk
- The PR appears safe to merge; server-side validation still rejects API key scopes beyond the issuer's permissions.
- The new scope list uses the same validation logic as key creation, and the tests cover allowed scopes and rejected requests.
**Assessed commit:** `5288b8271e5d`
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(api-keys): only offer MCP scopes the user can self-issue [superset]
Posted by "seunggabi (via GitHub)" <gi...@apache.org>.
seunggabi commented on PR #45272:
URL: https://github.com/apache/superset/pull/45272#issuecomment-6509384971
Merged the latest master into this branch (clean, no conflicts; still mergeable). Checks are re-running.
@aminghadersohi — any chance you can take a look when you have a moment? If someone else is better placed to review the API-key / MCP scope code, please point me to them and I'll ask directly. Thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(api-keys): only offer MCP scopes the user can self-issue [superset]
Posted by "seunggabi (via GitHub)" <gi...@apache.org>.
seunggabi commented on PR #45272:
URL: https://github.com/apache/superset/pull/45272#issuecomment-6169745218
CI status note: the two remaining red checks look unrelated to this change.
- `sharded-jest-tests (3)`: `src/features/semanticViews/AddSemanticViewModal.test.tsx` fails the same way on other PRs today (e.g. runs 38562782271, 38560212488, 38557386813) and passes locally (31/31); this PR does not touch semantic views.
- `unit-tests (current)`: the job was cancelled by the runner at 99% ("The operation was canceled", 30 min in). The same job passed on the previous push of this branch, and the latest `master` run (ffee0a843) was cancelled the same way.
Happy to rebase/re-push once the flaky test is fixed on master, or a maintainer re-run would be appreciated.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(api-keys): only offer MCP scopes the user can self-issue [superset]
Posted by "EnxDev (via GitHub)" <gi...@apache.org>.
EnxDev commented on code in PR #45272:
URL: https://github.com/apache/superset/pull/45272#discussion_r4276227630
##########
superset-frontend/src/features/apiKeys/ApiKeyCreateModal.tsx:
##########
@@ -58,6 +58,18 @@ export function ApiKeyCreateModal({
const [createdKey, setCreatedKey] = useState<string | null>(null);
const [copied, setCopied] = useState(false);
const copyTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+ // Scopes the current user may self-issue; null until loaded (or when the
+ // lookup fails), in which case the full catalog is offered as before.
+ const [allowedScopes, setAllowedScopes] = useState<string[] | null>(null);
Review Comment:
`null` means both "still loading" and "lookup failed", so for the first moment after opening the Select offers all 32 scopes. A user who picks one before the fetch lands keeps it in the form even after the options shrink, and gets the 400 on save.
Could we start from a separate loading state (`undefined`, or a flag passed to the Select's `loading`) and only fall back to the full catalog on the actual error?
##########
superset-frontend/src/features/apiKeys/ApiKeyCreateModal.tsx:
##########
@@ -85,7 +97,12 @@ export function ApiKeyCreateModal({
setCreatedKey(key);
addSuccessToast(t('API key created successfully'));
} catch (error) {
- addDangerToast(t('Failed to create API key'));
+ const { message } = await getClientErrorObject(error);
+ addDangerToast(
+ message
+ ? `${t('Failed to create API key')}: ${message}`
+ : t('Failed to create API key'),
+ );
Review Comment:
Gluing the server message onto `t(...)` with a template literal fixes the word order for translators. The rest of the app uses a `%s` msgid for this, e.g. `ThemeList` does `t('Failed to set system default theme: %s', err.message)`.
```suggestion
addDangerToast(
message
? t('Failed to create API key: %s', message)
: t('Failed to create API key'),
);
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(api-keys): only offer MCP scopes the user can self-issue [superset]
Posted by "netlify[bot] (via GitHub)" <gi...@apache.org>.
netlify[bot] commented on PR #45272:
URL: https://github.com/apache/superset/pull/45272#issuecomment-6167933993
### <span aria-hidden="true">✅</span> Deploy Preview for *superset-docs-preview* ready!
| Name | Link |
|:-:|------------------------|
|<span aria-hidden="true">🔨</span> Latest commit | b3d7ef7fc58a96c9e8f513fae4a5671a347e0c08 |
|<span aria-hidden="true">🔍</span> Latest deploy log | https://app.netlify.com/projects/superset-docs-preview/deploys/6acf6fa8a12f63d3e7827e7b |
|<span aria-hidden="true">😎</span> Deploy Preview | [https://deploy-preview-45272--superset-docs-preview.netlify.app](https://deploy-preview-45272--superset-docs-preview.netlify.app) |
|<span aria-hidden="true">📱</span> Preview on mobile | <details><summary> Toggle QR Code... </summary><br /><br /><br /><br />_Use your smartphone camera to open QR code link._</details> |
|<span aria-hidden="true">🤖</span> Make changes | [Run an agent on this branch](https://app.netlify.com/projects/superset-docs-preview/agent-runs#DcpLCoAgEADQu8w6iQxUukHHGHWGoo-D2kKiu-fuLd4LktMlFRaAAXzGO2zdTFhHlF0d1FQJSago39RTKPcWSc7U1tijwcCG0eGk2cxxJuu0Jevh-wE) |
---
<!-- [superset-docs-preview Preview](https://deploy-preview-45272--superset-docs-preview.netlify.app) -->
_To edit notification comments on pull requests, go to your [Netlify project configuration](https://app.netlify.com/projects/superset-docs-preview/configuration/notifications#deploy-notifications)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(api-keys): only offer MCP scopes the user can self-issue [superset]
Posted by "seunggabi (via GitHub)" <gi...@apache.org>.
seunggabi commented on PR #45272:
URL: https://github.com/apache/superset/pull/45272#issuecomment-6297179071
Friendly ping for a committer review. @aminghadersohi @rusackas — since you've worked on the API-key / MCP scope code, could one of you take a look?
Status: CI is green (49 passing, none failing), both of EnxDev's inline notes are addressed and EnxDev gave an LGTM on Oct 15. It's only waiting on a committer approval now.
The change keeps the key-creation dialog from offering MCP scopes the user can't self-issue, which today ends in a 500 on save; the endpoint derives the allowed list from the same `_validate_requested_api_key_scopes` path that `create_api_key` uses, so the two can't drift. Happy to adjust anything. Thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(api-keys): only offer MCP scopes the user can self-issue [superset]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #45272:
URL: https://github.com/apache/superset/pull/45272#issuecomment-6166240581
## [Codecov](https://app.codecov.io/gh/apache/superset/pull/45272?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:x: Patch coverage is `27.58621%` with `21 lines` in your changes missing coverage. Please review.
:white_check_mark: Project coverage is 64.89%. Comparing base ([`7f1bfab`](https://app.codecov.io/gh/apache/superset/commit/7f1bfaba4b2968e0818d6e08e79d34ecae0bd3f1?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`5288b82`](https://app.codecov.io/gh/apache/superset/commit/5288b8271e5db291879f901180121921d39b14d9?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
| [Files with missing lines](https://app.codecov.io/gh/apache/superset/pull/45272?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Patch % | Lines |
|---|---|---|
| [superset/security/manager.py](https://app.codecov.io/gh/apache/superset/pull/45272?src=pr&el=tree&filepath=superset%2Fsecurity%2Fmanager.py&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-c3VwZXJzZXQvc2VjdXJpdHkvbWFuYWdlci5weQ==) | 11.76% | [15 Missing :warning: ](https://app.codecov.io/gh/apache/superset/pull/45272?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [superset/views/users/api.py](https://app.codecov.io/gh/apache/superset/pull/45272?src=pr&el=tree&filepath=superset%2Fviews%2Fusers%2Fapi.py&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-c3VwZXJzZXQvdmlld3MvdXNlcnMvYXBpLnB5) | 50.00% | [6 Missing :warning: ](https://app.codecov.io/gh/apache/superset/pull/45272?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
> :exclamation: There is a different number of reports uploaded between BASE (7f1bfab) and HEAD (5288b82). Click for more details.
>
> <details><summary>HEAD has 5 uploads less than BASE</summary>
>
>| Flag | BASE (7f1bfab) | HEAD (5288b82) |
>|------|------|------|
>|python|7|3|
>|postgres|2|1|
></details>
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## master #45272 +/- ##
===========================================
- Coverage 83.29% 64.89% -18.40%
===========================================
Files 3039 3039
Lines 198375 198401 +26
Branches 46213 46215 +2
===========================================
- Hits 165235 128755 -36480
- Misses 29916 66738 +36822
+ Partials 3224 2908 -316
```
| [Flag](https://app.codecov.io/gh/apache/superset/pull/45272/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [hive](https://app.codecov.io/gh/apache/superset/pull/45272/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `34.97% <27.58%> (-0.01%)` | :arrow_down: |
| [mysql](https://app.codecov.io/gh/apache/superset/pull/45272/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [postgres](https://app.codecov.io/gh/apache/superset/pull/45272/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `52.99% <27.58%> (-0.01%)` | :arrow_down: |
| [presto](https://app.codecov.io/gh/apache/superset/pull/45272/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `36.73% <27.58%> (-0.01%)` | :arrow_down: |
| [python](https://app.codecov.io/gh/apache/superset/pull/45272/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `53.07% <27.58%> (-33.84%)` | :arrow_down: |
| [sqlite](https://app.codecov.io/gh/apache/superset/pull/45272/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [unit](https://app.codecov.io/gh/apache/superset/pull/45272/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>
[:umbrella: View full report in Codecov by Harness](https://app.codecov.io/gh/apache/superset/pull/45272?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat(api-keys): only offer MCP scopes the user can self-issue [superset]
Posted by "seunggabi (via GitHub)" <gi...@apache.org>.
seunggabi commented on code in PR #45272:
URL: https://github.com/apache/superset/pull/45272#discussion_r4278034876
##########
superset-frontend/src/features/apiKeys/ApiKeyCreateModal.tsx:
##########
@@ -58,6 +58,18 @@ export function ApiKeyCreateModal({
const [createdKey, setCreatedKey] = useState<string | null>(null);
const [copied, setCopied] = useState(false);
const copyTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
+ // Scopes the current user may self-issue; null until loaded (or when the
+ // lookup fails), in which case the full catalog is offered as before.
+ const [allowedScopes, setAllowedScopes] = useState<string[] | null>(null);
Review Comment:
Good catch, thanks. Done in fdee88de6: the state now starts as `undefined` (lookup in flight → `loading` on the Select, no options offered), `null` only on an actual error (full catalog), otherwise the allowed subset. It is reset to `undefined` each time the modal is shown. Added a test for the in-flight window.
##########
superset-frontend/src/features/apiKeys/ApiKeyCreateModal.tsx:
##########
@@ -85,7 +97,12 @@ export function ApiKeyCreateModal({
setCreatedKey(key);
addSuccessToast(t('API key created successfully'));
} catch (error) {
- addDangerToast(t('Failed to create API key'));
+ const { message } = await getClientErrorObject(error);
+ addDangerToast(
+ message
+ ? `${t('Failed to create API key')}: ${message}`
+ : t('Failed to create API key'),
+ );
Review Comment:
Applied in fdee88de6: `t('Failed to create API key: %s', message)`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org