codeant-ai-for-open-source[bot] commented on code in PR #36856:
URL: https://github.com/apache/superset/pull/36856#discussion_r3679180131
##########
superset/db_engine_specs/snowflake.py:
##########
@@ -44,12 +46,61 @@
from superset.db_engine_specs.postgres import PostgresBaseEngineSpec
from superset.errors import ErrorLevel, SupersetError, SupersetErrorType
from superset.models.sql_lab import Query
+from superset.superset_typing import (
+ OAuth2ClientConfig,
+ OAuth2State,
+)
from superset.utils import json
from superset.utils.core import get_user_agent, QuerySource
+from superset.utils.oauth2 import encode_oauth2_state, generate_code_challenge
if TYPE_CHECKING:
from superset.models.core import Database
+try:
+ from snowflake.connector.errors import DatabaseError
+except ImportError:
+ # Use a distinct sentinel type when snowflake is not installed to avoid
+ # matching unrelated exception types (using `Exception` would be too
broad).
+ class _SnowflakeDatabaseError(Exception):
+ """Sentinel type to stand in for
snowflake.connector.errors.DatabaseError."""
+
+ pass
+
+ DatabaseError = _SnowflakeDatabaseError
+
+
+class CustomSnowflakeAuthErrorMeta(type):
+ """
+ Metaclass whose ``__instancecheck__`` matches Snowflake's invalid/expired
+ OAuth access-token error, so ``CustomSnowflakeAuthError`` can be used as
the
+ ``oauth2_exception`` that triggers the OAuth2 re-auth dance.
+
+ This is only honored via ``isinstance()`` (the path used by
+ ``BaseEngineSpec.needs_oauth2()``); ``except`` clauses do not call
+ ``__instancecheck__``, so it must not be relied on for exception catching.
+ """
+
+ def __instancecheck__(cls, instance: object) -> bool:
+ """
+ Match Snowflake's invalid/expired OAuth token error, whether it arrives
+ wrapped by SQLAlchemy (e.g. ``Engine``-based execution) or as the raw
+ DBAPI exception — ``BaseEngineSpec.execute()`` runs against a bare
+ cursor and never wraps it, so both shapes must be handled here.
+ """
+ orig: object = instance
+ if isinstance(instance, SqlalchemyDatabaseError):
+ orig = cast(SqlalchemyDatabaseError, instance).orig
+
+ return isinstance(orig, DatabaseError) and "Invalid OAuth access
token" in str(
+ orig
+ )
+
+
+class CustomSnowflakeAuthError(DatabaseError,
metaclass=CustomSnowflakeAuthErrorMeta):
+ """Snowflake OAuth error type matched via the metaclass above (see note
there)."""
Review Comment:
**Suggestion:** The custom `oauth2_exception` only matches Snowflake
database errors through `__instancecheck__`, but `refresh_oauth2_token` catches
this value in an `except` clause. Python exception handlers require actual
subclass relationships and do not invoke `__instancecheck__`; consequently, the
`OAuth2TokenRefreshError` raised by the shared refresh-token exchange is not
caught by this handler, so the revoked token remains stored and the
re-authentication flow is not triggered correctly. Include the shared OAuth
refresh exception in the Snowflake exception contract, or override the
refresh/error handling appropriately. [error handling]
<details>
<summary><b>Severity Level:</b> Critical 🚨</summary>
```mdx
- ❌ Revoked Snowflake refresh tokens remain stored.
- ❌ Re-authentication does not start after refresh failure.
- ⚠️ Subsequent interactive queries repeatedly encounter the stale token.
```
</details>
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=b8cdaf082cc242ef84f8e0c1b7a211ce&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=b8cdaf082cc242ef84f8e0c1b7a211ce&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
*(Use Cmd/Ctrl + Click for best experience)*
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** superset/db_engine_specs/snowflake.py
**Line:** 100:101
**Comment:**
*Error Handling: The custom `oauth2_exception` only matches Snowflake
database errors through `__instancecheck__`, but `refresh_oauth2_token` catches
this value in an `except` clause. Python exception handlers require actual
subclass relationships and do not invoke `__instancecheck__`; consequently, the
`OAuth2TokenRefreshError` raised by the shared refresh-token exchange is not
caught by this handler, so the revoked token remains stored and the
re-authentication flow is not triggered correctly. Include the shared OAuth
refresh exception in the Snowflake exception contract, or override the
refresh/error handling appropriately.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F36856&comment_hash=211d1ea0f82a9aa4812e63849b56951e5f29ec2767c313f31be62483990e19ef&reaction=like'>👍</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F36856&comment_hash=211d1ea0f82a9aa4812e63849b56951e5f29ec2767c313f31be62483990e19ef&reaction=dislike'>👎</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
