(superset) 11/23: declare the login-token endpoints as intentionally undecorate

[ma...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

madhushreeag pushed a commit to branch madhu-one-time-login-tokens
in repository https://gitbox.apache.org/repos/asf/superset.git

commit d1963381aa9ea80e069cd44e153041e145c2bbbe
Author: madhushree agarwal <ma...@apple.com>
AuthorDate: Thu Sep 17 15:48:44 2026 -0700

    declare the login-token endpoints as intentionally undecorate
---
 docs/static/feature-flags.json                | 6 ++++++
 tests/unit_tests/security/login_token_test.py | 8 +++-----
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/docs/static/feature-flags.json b/docs/static/feature-flags.json
index 97c49320e79..d2316b36228 100644
--- a/docs/static/feature-flags.json
+++ b/docs/static/feature-flags.json
@@ -63,6 +63,12 @@
         "lifecycle": "development",
         "description": "Enable granular export controls (can_export_data, can_export_image, can_copy_clipboard) instead of the single can_csv permission"
       },
+      {
+        "name": "LOGIN_TOKEN",
+        "default": false,
+        "lifecycle": "development",
+        "description": "Allow a trusted parent application to exchange a proof of a user's identity for a real Superset session inside an iframe, via one-time login tokens. Does nothing unless LOGIN_TOKEN_IDENTITY_RESOLVER is also configured."
+      },
       {
         "name": "MATRIXIFY",
         "default": false,
diff --git a/tests/unit_tests/security/login_token_test.py b/tests/unit_tests/security/login_token_test.py
index 109dd967220..42c6a79be78 100644
--- a/tests/unit_tests/security/login_token_test.py
+++ b/tests/unit_tests/security/login_token_test.py
@@ -121,7 +121,7 @@ def test_resolve_identity_rejections(
     original = current_app.config.get("LOGIN_TOKEN_IDENTITY_RESOLVER")
     try:
         _set_resolver(resolver)
-        assert login_token.resolve_identity(object()) is None, reason  # type: ignore[arg-type]
+        assert login_token.resolve_identity(object()) is None, reason
     finally:
         _set_resolver(original)
 
@@ -141,7 +141,7 @@ def test_resolve_identity_treats_a_raising_resolver_as_rejection(
 
     try:
         _set_resolver(boom)
-        assert login_token.resolve_identity(object()) is None  # type: ignore[arg-type]
+        assert login_token.resolve_identity(object()) is None
     finally:
         _set_resolver(original)
 
@@ -151,9 +151,7 @@ def test_resolve_identity_accepts_email_only(app_context: None) -> None:
     original = current_app.config.get("LOGIN_TOKEN_IDENTITY_RESOLVER")
     try:
         _set_resolver(lambda request, **kwargs: {"email": "jdoe@example.com"})
-        assert login_token.resolve_identity(object()) == {  # type: ignore[arg-type]
-            "email": "jdoe@example.com"
-        }
+        assert login_token.resolve_identity(object()) == {"email": "jdoe@example.com"}
     finally:
         _set_resolver(original)