aminghadersohi opened a new pull request, #43623:
URL: https://github.com/apache/superset/pull/43623
### SUMMARY
Snowflake can reject an otherwise unexpired OAuth2 access token after a
Snowflake-side role or grant change. Superset previously treated this as an
interactive reauthorization condition, leaving the cached access token in place
rather than attempting the stored refresh token.
This change recognizes Snowflake's documented `390303` OAuth access-token
error, forces a refresh-token exchange even when the cached access token has
not expired, and retries synchronous and asynchronous SQL execution once. A
retry context prevents the existing interactive OAuth handler from intercepting
the first failure. If silent refresh is unavailable or rejected, the existing
interactive authorization flow remains the fallback.
Retries are restricted to engine-classified OAuth errors and are skipped
after a multi-statement query has made progress. Attempt, success, and failure
counters plus a structured log record provide visibility into forced refreshes.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
Not applicable; this is a backend-only change.
### TESTING INSTRUCTIONS
Run:
```bash
PYTHONPATH="$PWD/superset-core/src" pytest -q \
tests/unit_tests/utils/oauth2_tests.py \
tests/unit_tests/db_engine_specs/test_snowflake.py
```
The tests verify that:
- Snowflake error code `390303` and the existing exact error message are
classified as OAuth failures.
- Unrelated Snowflake, network, and timeout errors do not trigger refresh.
- A valid-but-rejected access token is forcibly refreshed using the stored
refresh token.
- Execution is retried exactly once.
Pre-commit was also run against every changed file.
### ADDITIONAL INFORMATION
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in
[SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
## Blast radius
This affects database OAuth2 query execution paths only. Forced refresh is
reached only when an engine's `needs_oauth2()` classifier matches; Snowflake's
matcher is limited to its DBAPI exception type plus error code `390303` or the
existing exact invalid-token message. There are no schema, permissions, RLS, or
UI changes.
## Risk & rollback
The primary risk is retrying a query after a misclassified error. The
Snowflake match is deliberately narrow, and multi-statement executions are not
retried after progress is recorded. Rollback is a normal revert of this commit;
there are no migrations or persisted-format changes.
## Review guidance
Please review `superset/utils/oauth2.py` first, especially the retry context
and forced-refresh fallback behavior, followed by the two SQL execution call
sites. The Snowflake matcher change is intentionally limited to the provider's
documented access-token-invalid code.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
