eschutho commented on PR #41248: URL: https://github.com/apache/superset/pull/41248#issuecomment-4812016189
Good question! Claude and I did some research on this — it looks like it'd be medium effort, but might not get us all the way there without an upstream fix. The easy part would be swapping our `authlib.jose.errors` imports — `joserfc.errors` has equivalent exception types. The trickier part is that `DetailedJWTVerifier` inherits `self.jwt.decode()` and `self._get_verification_key()` from fastmcp's `JWTVerifier`, which is itself built on `authlib.jose`. Replacing those would likely mean detaching from fastmcp's base class and reimplementing static key loading + JWKS fetch/cache ourselves using `joserfc.jwk`. The bigger blocker is that even after all that, fastmcp still pulls in `authlib.jose` internally — which is why we have the `warnings.filterwarnings` suppression in `__init__.py`. So we'd probably still need that suppression regardless. The root fix would really need to happen in fastmcp first. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
