sadpandajoe commented on code in PR #45186:
URL: https://github.com/apache/superset/pull/45186#discussion_r4272821617
##########
tests/unit_tests/db_engine_specs/test_snowflake.py:
##########
@@ -854,3 +854,55 @@ def
test_snowflake_oauth2_exception_catches_refresh_token_error() -> None:
"OAuth2TokenRefreshError must be caught by "
"SnowflakeEngineSpec.oauth2_exception"
)
+
+
+def test_snowflake_parameters_json_schema() -> None:
+ """
+ Verify parameters_json_schema constructs OpenAPI schema via
+ APISpec and MarshmallowPlugin.
+ """
+ from superset.db_engine_specs.snowflake import SnowflakeEngineSpec
+
+ schema = SnowflakeEngineSpec.parameters_json_schema()
+ assert isinstance(schema, dict)
+ assert "properties" in schema
+ assert "account" in schema["properties"]
+
+
+def test_snowflake_update_params_from_encrypted_extra_keypair() -> None:
+ """
+ Verify update_params_from_encrypted_extra parses PEM private key and sets
DER bytes.
+ Protects against missing cryptography.hazmat imports.
+ """
+ from cryptography.hazmat.primitives import serialization
+ from cryptography.hazmat.primitives.asymmetric import rsa
+
+ from superset.db_engine_specs.snowflake import SnowflakeEngineSpec
+
+ private_key = rsa.generate_private_key(
+ public_exponent=65537,
+ key_size=2048,
+ )
+ pem_bytes = private_key.private_bytes(
+ encoding=serialization.Encoding.PEM,
+ format=serialization.PrivateFormat.PKCS8,
+ encryption_algorithm=serialization.NoEncryption(),
+ )
+
+ mock_db = mock.MagicMock()
+ mock_db.encrypted_extra = json.dumps(
+ {
+ "auth_method": "keypair",
+ "auth_params": {
+ "privatekey_body": pem_bytes.decode("utf-8"),
+ },
+ }
+ )
+
+ params: dict[str, Any] = {}
+ SnowflakeEngineSpec.update_params_from_encrypted_extra(mock_db, params)
+
+ assert "connect_args" in params
+ assert "private_key" in params["connect_args"]
+ assert isinstance(params["connect_args"]["private_key"], bytes)
Review Comment:
These assertions only prove that some non-empty bytes landed in
`connect_args["private_key"]`. If `update_params_from_encrypted_extra`
regressed to `Encoding.PEM` (or dropped PKCS8/`NoEncryption`), this test would
still pass, but the Snowflake connector expects DER bytes and keypair auth
would fail. Could you compare against the generated key's
`private_bytes(Encoding.DER, PrivateFormat.PKCS8, NoEncryption())` output
instead?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
