codeant-ai-for-open-source[bot] commented on code in PR #36856:
URL: https://github.com/apache/superset/pull/36856#discussion_r3679390639
##########
superset/db_engine_specs/snowflake.py:
##########
@@ -440,6 +605,18 @@ def update_params_from_encrypted_extra(
database: "Database",
params: dict[str, Any],
) -> None:
+ # To use OAuth authentication, a database connection must first be
created using
+ # another authenticator (typically key-pair authentication)
+ # with “Impersonate logged in user” enabled.
+ # Key-pair authentication is used for connection tests,
+ # while OAuth authentication is used when executing actual queries,
+ # such as in SQL Lab or dashboards.
+ # Therefore, when using OAuth authentication, the key-pair
authentication
+ # settings are not loaded, and the connection is established using
OAuth only.
+ connect_args: dict[str, Any] = params.get("connect_args") or {}
+ if connect_args.get("authenticator") == "oauth":
+ return
Review Comment:
**Suggestion:** The encrypted-extra loader receives only `engine_kwargs`,
not the SQLAlchemy URL, so this guard cannot detect `authenticator=oauth`
configured in the URI query string. A Snowflake URI using OAuth together with
key-pair data in `encrypted_extra` will therefore still load the private key
into `connect_args`, producing conflicting authentication parameters and
potentially preventing the OAuth connection from being created. Inspect the URL
authentication mode before loading encrypted authentication parameters, or
normalize the authenticator into the same parameter set first. [api mismatch]
<details>
<summary><b>Severity Level:</b> Critical 🚨</summary>
```mdx
- ❌ Explicit Snowflake OAuth connections may fail.
- ❌ Key-pair credentials can conflict with OAuth authentication.
- ⚠️ Connection validation becomes configuration-dependent.
```
</details>
[](https://app.codeant.ai/fix-in-ide?tool=cursor&prompt_id=5a708822e8b94299b1bd6707522e8cef&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
[](https://app.codeant.ai/fix-in-ide?tool=vscode-claude&prompt_id=5a708822e8b94299b1bd6707522e8cef&service=github&base_url=https%3A%2F%2Fgithub.com&org=apache&repo=apache%2Fsuperset)
*(Use Cmd/Ctrl + Click for best experience)*
<details>
<summary><b>Prompt for AI Agent 🤖 </b></summary>
```mdx
This is a comment left during a code review.
**Path:** superset/db_engine_specs/snowflake.py
**Line:** 616:618
**Comment:**
*Api Mismatch: The encrypted-extra loader receives only
`engine_kwargs`, not the SQLAlchemy URL, so this guard cannot detect
`authenticator=oauth` configured in the URI query string. A Snowflake URI using
OAuth together with key-pair data in `encrypted_extra` will therefore still
load the private key into `connect_args`, producing conflicting authentication
parameters and potentially preventing the OAuth connection from being created.
Inspect the URL authentication mode before loading encrypted authentication
parameters, or normalize the authenticator into the same parameter set first.
Validate the correctness of the flagged issue. If correct, How can I resolve
this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask
user if the user wants to fix the rest of the comments as well. if said yes,
then fetch all the comments validate the correctness and implement a minimal fix
```
</details>
<a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F36856&comment_hash=df4e7a24fd667f2f07bbc7859ec4cf234baf1f2ad9bc0cafc657b9a2338aa649&reaction=like'>👍</a>
| <a
href='https://app.codeant.ai/feedback?pr_url=https%3A%2F%2Fgithub.com%2Fapache%2Fsuperset%2Fpull%2F36856&comment_hash=df4e7a24fd667f2f07bbc7859ec4cf234baf1f2ad9bc0cafc657b9a2338aa649&reaction=dislike'>👎</a>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
