aminghadersohi commented on code in PR #39604:
URL: https://github.com/apache/superset/pull/39604#discussion_r3232014743
##########
tests/unit_tests/mcp_service/test_auth_api_key.py:
##########
@@ -158,89 +195,154 @@ def test_g_user_fallback_when_no_jwt_or_api_key(app,
mock_user) -> None:
assert result.username == "api_key_user"
-# -- FAB version without extract_api_key_from_request --
+# -- FAB version without validate_api_key --
@pytest.mark.usefixtures("_enable_api_keys")
-def test_fab_without_extract_method_skips_gracefully(app) -> None:
- """If FAB SecurityManager lacks extract_api_key_from_request,
- API key auth should be skipped with a debug log, not crash."""
+def test_fab_without_validate_method_raises(app: SupersetApp) -> None:
+ """If FAB SecurityManager lacks validate_api_key, should raise
+ PermissionError about unavailable validation."""
mock_sm = MagicMock(spec=[]) # empty spec = no attributes
- with app.test_request_context():
+ with app.app_context():
g.user = None
app.appbuilder = MagicMock()
app.appbuilder.sm = mock_sm
- with pytest.raises(ValueError, match="No authenticated user found"):
- get_user_from_request()
+ with _patch_access_token(_passthrough_access_token("sst_abc123")):
+ with pytest.raises(
+ PermissionError, match="API key validation is not available"
+ ):
+ get_user_from_request()
-# -- FAB version without validate_api_key --
+# -- Relationship reload fallback --
@pytest.mark.usefixtures("_enable_api_keys")
-def test_fab_without_validate_method_raises(app) -> None:
- """If FAB has extract_api_key_from_request but not validate_api_key,
- should raise PermissionError about unavailable validation."""
- mock_sm = MagicMock(spec=["extract_api_key_from_request"])
- mock_sm.extract_api_key_from_request.return_value = "sst_abc123"
+def test_relationship_reload_failure_returns_original_user(
+ app: SupersetApp, mock_user: MagicMock
+) -> None:
+ """If load_user_with_relationships fails, the original user from
+ validate_api_key should be returned as fallback."""
+ mock_sm = MagicMock()
+ mock_sm.validate_api_key.return_value = mock_user
- with app.test_request_context(headers={"Authorization": "Bearer
sst_abc123"}):
+ with app.app_context():
g.user = None
app.appbuilder = MagicMock()
app.appbuilder.sm = mock_sm
- with pytest.raises(
- PermissionError, match="API key validation is not available"
+ with (
+ _patch_access_token(_passthrough_access_token("sst_abc123")),
+ patch(
+ "superset.mcp_service.auth.load_user_with_relationships",
+ return_value=None,
+ ),
):
- get_user_from_request()
+ result = get_user_from_request()
+
+ assert result is mock_user
-# -- Relationship reload fallback --
+# -- AccessToken without passthrough claim (plain JWT) -> skip API key auth --
@pytest.mark.usefixtures("_enable_api_keys")
-def test_relationship_reload_failure_returns_original_user(app, mock_user) ->
None:
- """If load_user_with_relationships fails, the original user from
- validate_api_key should be returned as fallback."""
+def test_jwt_access_token_skips_api_key_auth(app: SupersetApp) -> None:
+ """When the AccessToken is a plain JWT (no ``_api_key_passthrough`` claim),
+ API key auth is skipped — the JWT was already validated by the JWT
+ verifier and resolved in _resolve_user_from_jwt_context."""
Review Comment:
Addressed. — agor claude on Amin's behalf
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
