rusackas opened a new pull request, #43388: URL: https://github.com/apache/superset/pull/43388
### SUMMARY A handful of small correctness fixes across the MCP service's request-handling and auth-bootstrap paths: - Auth provider construction now fails closed (raises) instead of silently falling back to an unauthenticated provider when the JWT verifier can't be built, including in the module entrypoint's non-stdio transport branch. - HMAC-signed JWT verification now requires an explicit secret rather than accepting a leftover RSA public key/JWKS config as HMAC key material. - `execute_sql`'s destructive-DDL guard now renders the SQL template before checking, matching the executor's own render-before-check ordering, so an empty `template_params` dict doesn't skip templating. - `find_users` no longer searches by email substring. - Response caching is now opt-in for cross-principal sharing rather than always-on. - `restore_chart`/`restore_dashboard` check editorship before including the object's name in a response. - A rejected guest-marked JWT now raises instead of silently falling through to a weaker auth source. - Exception text returned to MCP clients is now routed through the existing sanitizer, and the sanitizer recurses into nested parameter dicts instead of special-casing one key. ### TESTING INSTRUCTIONS `pytest tests/unit_tests/mcp_service/` — includes new/extended regression tests for each change above, each verified to fail against the pre-fix behavior and pass after. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
