You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "betodealmeida (via GitHub)" <gi...@apache.org> on 2025/03/07 18:47:12 UTC
[PR] Oauth2command [superset]
betodealmeida opened a new pull request, #32546:
URL: https://github.com/apache/superset/pull/32546
<!---
Please write the PR title following the conventions at https://www.conventionalcommits.org/en/v1.0.0/
Example:
fix(dashboard): load charts correctly
-->
### SUMMARY
<!--- Describe the change below, including rationale and design decisions -->
Add a command to store OAuth2 tokens, to ensure we have a proper `@transaction` and we're not doing a implicit commit.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
<!--- Skip this if not applicable -->
N/A
### TESTING INSTRUCTIONS
<!--- Required! What steps can be taken to manually verify the changes? -->
Added tests.
### ADDITIONAL INFORMATION
<!--- Check any relevant boxes with "x" -->
<!--- HINT: Include "Fixes #nnn" if you are fixing an existing issue -->
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat: `OAuth2StoreTokenCommand` [superset]
Posted by "Vitor-Avila (via GitHub)" <gi...@apache.org>.
Vitor-Avila commented on code in PR #32546:
URL: https://github.com/apache/superset/pull/32546#discussion_r1987233494
##########
superset/commands/database/oauth2.py:
##########
@@ -0,0 +1,88 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+from datetime import datetime, timedelta
+from functools import partial
+from typing import cast
+
+from superset.commands.base import BaseCommand
+from superset.commands.database.exceptions import DatabaseNotFoundError
+from superset.daos.database import DatabaseUserOAuth2TokensDAO
+from superset.databases.schemas import OAuth2ProviderResponseSchema
+from superset.exceptions import OAuth2Error
+from superset.models.core import Database, DatabaseUserOAuth2Tokens
+from superset.superset_typing import OAuth2State
+from superset.utils.decorators import on_error, transaction
+from superset.utils.oauth2 import decode_oauth2_state
+
+
+class OAuth2StoreTokenCommand(BaseCommand):
+ """
+ Command to store OAuth2 tokens in the database.
+ """
+
+ def __init__(self, parameters: OAuth2ProviderResponseSchema):
+ self._parameters = parameters
+ self._state: OAuth2State | None = None
+ self._database: Database | None = None
+
+ @transaction(on_error=partial(on_error, reraise=OAuth2Error))
+ def run(self) -> DatabaseUserOAuth2Tokens:
+ self.validate()
+ self._database = cast(Database, self._database)
+ self._state = cast(OAuth2State, self._state)
+
+ oauth2_config = self._database.get_oauth2_config()
+ if oauth2_config is None:
+ raise OAuth2Error("No configuration found for OAuth2")
Review Comment:
Should this be part of the 'validate' method too?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat: `OAuth2StoreTokenCommand` [superset]
Posted by "Vitor-Avila (via GitHub)" <gi...@apache.org>.
Vitor-Avila commented on code in PR #32546:
URL: https://github.com/apache/superset/pull/32546#discussion_r1993578661
##########
superset/databases/api.py:
##########
@@ -1433,51 +1433,15 @@ def oauth2(self) -> FlaskResponse:
$ref: '#/components/responses/500'
"""
parameters = OAuth2ProviderResponseSchema().load(request.args)
+ command = OAuth2StoreTokenCommand(parameters)
+ command.run()
- if "error" in parameters:
- raise OAuth2Error(parameters["error"])
-
- # note that when decoding the state we will perform JWT validation, preventing a
- # malicious payload that would insert a bogus database token, or delete an
- # existing one.
state = decode_oauth2_state(parameters["state"])
+ tab_id = state["tab_id"]
Review Comment:
that make sense. thank you!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat: `OAuth2StoreTokenCommand` [superset]
Posted by "Vitor-Avila (via GitHub)" <gi...@apache.org>.
Vitor-Avila commented on code in PR #32546:
URL: https://github.com/apache/superset/pull/32546#discussion_r1987236880
##########
superset/databases/api.py:
##########
@@ -1433,51 +1433,15 @@ def oauth2(self) -> FlaskResponse:
$ref: '#/components/responses/500'
"""
parameters = OAuth2ProviderResponseSchema().load(request.args)
+ command = OAuth2StoreTokenCommand(parameters)
+ command.run()
- if "error" in parameters:
- raise OAuth2Error(parameters["error"])
-
- # note that when decoding the state we will perform JWT validation, preventing a
- # malicious payload that would insert a bogus database token, or delete an
- # existing one.
state = decode_oauth2_state(parameters["state"])
+ tab_id = state["tab_id"]
Review Comment:
I see we're currently calling `decode_oauth2_state` both here at the API layer and also at the command. Should the `tab_id` be returned by the command directly? Not super opinionated here, just wondering your thoughts.
##########
superset/commands/database/oauth2.py:
##########
@@ -0,0 +1,88 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+from datetime import datetime, timedelta
+from functools import partial
+from typing import cast
+
+from superset.commands.base import BaseCommand
+from superset.commands.database.exceptions import DatabaseNotFoundError
+from superset.daos.database import DatabaseUserOAuth2TokensDAO
+from superset.databases.schemas import OAuth2ProviderResponseSchema
+from superset.exceptions import OAuth2Error
+from superset.models.core import Database, DatabaseUserOAuth2Tokens
+from superset.superset_typing import OAuth2State
+from superset.utils.decorators import on_error, transaction
+from superset.utils.oauth2 import decode_oauth2_state
+
+
+class OAuth2StoreTokenCommand(BaseCommand):
+ """
+ Command to store OAuth2 tokens in the database.
+ """
+
+ def __init__(self, parameters: OAuth2ProviderResponseSchema):
+ self._parameters = parameters
+ self._state: OAuth2State | None = None
+ self._database: Database | None = None
+
+ @transaction(on_error=partial(on_error, reraise=OAuth2Error))
+ def run(self) -> DatabaseUserOAuth2Tokens:
+ self.validate()
+ self._database = cast(Database, self._database)
+ self._state = cast(OAuth2State, self._state)
+
+ oauth2_config = self._database.get_oauth2_config()
+ if oauth2_config is None:
+ raise OAuth2Error("No configuration found for OAuth2")
Review Comment:
Should this be part of the `validate` method too?
##########
superset/databases/api.py:
##########
@@ -1433,51 +1433,15 @@ def oauth2(self) -> FlaskResponse:
$ref: '#/components/responses/500'
"""
parameters = OAuth2ProviderResponseSchema().load(request.args)
+ command = OAuth2StoreTokenCommand(parameters)
+ command.run()
- if "error" in parameters:
- raise OAuth2Error(parameters["error"])
-
- # note that when decoding the state we will perform JWT validation, preventing a
- # malicious payload that would insert a bogus database token, or delete an
- # existing one.
state = decode_oauth2_state(parameters["state"])
+ tab_id = state["tab_id"]
Review Comment:
I see we're currently calling `decode_oauth2_state` both here at the API layer and also at the command. Should the `tab_id` be returned by the command directly? Not super opinionated here, just wondering your thoughts.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat: `OAuth2StoreTokenCommand` [superset]
Posted by "betodealmeida (via GitHub)" <gi...@apache.org>.
betodealmeida merged PR #32546:
URL: https://github.com/apache/superset/pull/32546
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] feat: `OAuth2StoreTokenCommand` [superset]
Posted by "betodealmeida (via GitHub)" <gi...@apache.org>.
betodealmeida commented on code in PR #32546:
URL: https://github.com/apache/superset/pull/32546#discussion_r1993559661
##########
superset/databases/api.py:
##########
@@ -1433,51 +1433,15 @@ def oauth2(self) -> FlaskResponse:
$ref: '#/components/responses/500'
"""
parameters = OAuth2ProviderResponseSchema().load(request.args)
+ command = OAuth2StoreTokenCommand(parameters)
+ command.run()
- if "error" in parameters:
- raise OAuth2Error(parameters["error"])
-
- # note that when decoding the state we will perform JWT validation, preventing a
- # malicious payload that would insert a bogus database token, or delete an
- # existing one.
state = decode_oauth2_state(parameters["state"])
+ tab_id = state["tab_id"]
Review Comment:
Yeah, I agree this is not ideal. But I made the command return the created model instance, and unfortunately it doesn't have `tab_id` associated with it. I thought it was better to keep the interface simple, and have a bit of duplicity here.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] Oauth2command [superset]
Posted by "korbit-ai[bot] (via GitHub)" <gi...@apache.org>.
korbit-ai[bot] commented on PR #32546:
URL: https://github.com/apache/superset/pull/32546#issuecomment-2707173575
Based on your review schedule, I'll hold off on reviewing this PR until it's marked as ready for review. If you'd like me to take a look now, comment `/korbit-review`.
> Your admin can change your review schedule in the [Korbit Console](https://app.korbit.ai/settings)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org