[GitHub] [superset] suddjian commented on a change in pull request #17517: feat: Guest token (for embedded dashboard auth)

[GitBox <gi...@apache.org>]

suddjian commented on a change in pull request #17517:
URL: https://github.com/apache/superset/pull/17517#discussion_r765290400



##########
File path: superset/security/manager.py
##########
@@ -1213,3 +1233,72 @@ def can_access_based_on_dashboard(datasource: "BaseDatasource") -> bool:
 
         exists = db.session.query(query.exists()).scalar()
         return exists
+
+    @staticmethod
+    def _get_current_epoch_time() -> float:
+        """ This is used so the tests can mock time """
+        return time.time()
+
+    def create_guest_access_token(
+        self, user: GuestTokenUser, resources: List[GuestTokenResource]
+    ) -> bytes:
+        secret = current_app.config["GUEST_TOKEN_JWT_SECRET"]
+        # calculate expiration time
+        now = self._get_current_epoch_time()
+        exp = now + (current_app.config["GUEST_TOKEN_JWT_EXP_SECONDS"] * 1000)
+        claims = {
+            "user": user,
+            "resources": resources,
+            # standard jwt claims:
+            "iat": now,  # issued at
+            "exp": exp,  # expiration time
+        }
+        token = jwt.encode(claims, secret, algorithm="HS256")
+        return token
+
+    def get_guest_user(self, req: Request) -> Optional[GuestUser]:
+        """
+        If there is a guest token in the request (used for embedded),
+        parses the token and returns the guest user.
+        This is meant to be used as a request loader for the LoginManager.
+        The LoginManager will only call this if an active session cannot be found.
+
+        :return: A guest user object
+        """
+        raw_token = req.cookies.get(current_app.config["GUEST_TOKEN_COOKIE_NAME"])
+        if raw_token is None:
+            return None
+
+        try:
+            token = self.parse_jwt_guest_token(raw_token)
+        except Exception as ex:  # pylint: disable=broad-except
+            # The login manager will handle sending 401s.
+            # We don't need to send a special error message.
+            logger.warning("Invalid guest token")
+            logger.warning(ex)
+            return None
+        else:
+            user = token["user"]

Review comment:
       I'm not sure how exactly you're saying folks might want to override things. They could add extra claims or whatever already by overriding `parse_jwt_guest_token` and calling `super()`.
   
   We could also delegate the [creation of claims](https://github.com/apache/superset/pull/17517/files/f67c8a86efb41f522e0710e45b3fcf439d5b0335#diff-bcb3868b9e29aea5f6e87ec641120dae35a86d732501f488a7a6dbdeb450f5c1R1249-R1255) to allow putting extra stuff into the token.




-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org