gabotorresruiz opened a new pull request, #43491:
URL: https://github.com/apache/superset/pull/43491
### SUMMARY
`Database.get_oauth2_config` reads `oauth2_client_info` from the
`encrypted_extra` of any database, but the client secret was only masked on
edit for engine specs that inherit the default
`encrypted_extra_sensitive_fields` (`{"$.*"}`) or list it explicitly (GSheets,
Trino). Engine specs that override the sensitive fields for other reasons, such
as Snowflake with its key pair fields, returned the OAuth2 client secret in
plaintext from `GET /api/v1/database/<id>/connection` and in exports.
This PR makes `encrypted_extra_sensitive_field_paths` always include
`$.oauth2_client_info.secret`, so no `encrypted_extra_sensitive_fields`
override (including in third party engine specs) can drop it, and removes the
empty override short circuit in `mask_encrypted_extra` so the invariant holds
unconditionally. It also guards `reveal_sensitive` against a masked value whose
path is absent from the stored payload, which previously raised `IndexError`;
with the secret masked for every engine that submission shape becomes ordinary
(e.g. a masked payload pasted into a connection that never stored the secret),
and the mask is kept as is in that case.
The client id stays visible, matching the existing GSheets and Trino
behavior, since it is an identifier rather than a credential. Note one intended
behavior change: exports of OAuth2 configured databases on previously unmasking
engines will contain the masked secret, so importing them into a fresh instance
requires supplying the secret, the same as service account private keys behave
already.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
N/A (API payload change; the secret in the connection payload is returned as
`XXXXXXXXXX` instead of plaintext)
### TESTING INSTRUCTIONS
1. Create a Snowflake database connection and set its Security extra to
`{"auth_type": "OAuth2Client", "oauth2_client_info": {"id": "...", "secret":
"...", "authorization_request_uri": "...", "token_request_uri": "...", "scope":
"..."}}`.
2. Reopen the connection for editing (or call `GET
/api/v1/database/<id>/connection`): the secret is returned as `XXXXXXXXXX`
instead of plaintext.
3. Save the connection without editing the masked value: the stored secret
is preserved (unmask round trip).
4. Unit coverage: `pytest tests/unit_tests/db_engine_specs/test_snowflake.py
tests/unit_tests/db_engine_specs/test_base.py
tests/unit_tests/utils/json_tests.py`
### ADDITIONAL INFORMATION
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in
[SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
