eschutho opened a new pull request, #44533:
URL: https://github.com/apache/superset/pull/44533
### SUMMARY
**Root cause**: `handle_api_exception` (in
`superset/views/error_handling.py`) is a decorator used alongside `api` on
several legacy-MVC endpoints (e.g. `Api.time_range`). The `api` decorator
(outer) has a dedicated `except NoAuthorizationError` handler that correctly
returns HTTP 401 with a WARNING-level log. However, `handle_api_exception` runs
*inside* `api` (closer to the view function), and its own `except Exception`
broad clause catches `NoAuthorizationError` first — before `api`'s correct
handler gets a chance. Result: every unauthenticated hit produces an
ERROR-level Sentry event (full traceback via `logger.exception`) and a
misleading HTTP 500 instead of a clean 401.
**Fix**: Add a dedicated `except NoAuthorizationError` arm to
`handle_api_exception`, placed before the generic `except Exception` clause,
mirroring `api`'s own established WARNING+401 semantics (in place since
2022-06-03, commit f270e49c4b0).
**Files changed** (2):
- `superset/views/error_handling.py` — import `NoAuthorizationError`, add
except arm
- `tests/unit_tests/views/test_error_handling.py` — add
`TestHandleApiExceptionNoAuthorizationError` following the existing
`TestHandleApiExceptionSSHTunnelError` pattern
### Tradeoffs
This changes failure-mode semantics for unauthenticated requests hitting
`@handle_api_exception`-wrapped endpoints:
- **HTTP status**: 500 → 401 (a *correction* toward the already-established
`api` decorator precedent, not a novel behavior)
- **Log level**: ERROR → WARNING (matching `api`'s own handler, by design —
these are expected auth failures, not server errors)
- **Sentry noise**: eliminates ~6500 accumulated ERROR-level events for
SUPERSET-PYTHON-FVJ
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
N/A — backend-only change, no UI impact.
### TESTING INSTRUCTIONS
1. **Unit test (fail-before / pass-after verified)**:
```
pytest
tests/unit_tests/views/test_error_handling.py::TestHandleApiExceptionNoAuthorizationError
-v
```
- Without fix: returns 500, logs at ERROR — test FAILS
- With fix: returns 401, logs at WARNING — test PASSES
2. **Full test file**: 18/18 tests pass (no regressions)
3. **Lint**: `ruff check` and `ruff format --check` clean on both files
4. **Pre-commit**: all hooks pass (mypy, ruff, pylint, etc.)
### ADDITIONAL INFORMATION
- [x] Has associated issue: Fixes SUPERSET-PYTHON-FVJ (sc-121647)
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in
[SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
