sadpandajoe commented on code in PR #43474:
URL: https://github.com/apache/superset/pull/43474#discussion_r3868592009
##########
superset/commands/semantic_layer/update.py:
##########
@@ -43,6 +44,57 @@
logger = logging.getLogger(__name__)
+def _unmask_configuration(
+ sl_type: str,
+ existing_raw_configuration: str | None,
+ new_configuration: dict[str, Any],
+) -> dict[str, Any]:
+ """
+ Replace ``PASSWORD_MASK`` sentinels in write-only fields of an incoming
+ update payload with the value already stored.
+
+ The GET/list endpoints mask write-only configuration values (see
+ ``superset.semantic_layers.api._mask_configuration``); a client that
+ round-trips that response back on an update (e.g. a name-only edit)
+ would otherwise overwrite the real stored credential with the literal
+ mask string.
+ """
+ cls = registry.get(sl_type)
+ if not cls:
+ return new_configuration
+
+ try:
+ schema = cls.get_configuration_schema()
+ except Exception: # pylint: disable=broad-except
+ return new_configuration
+
+ secret_keys = {
+ key
+ for key, prop in schema.get("properties", {}).items()
+ if isinstance(prop, dict) and prop.get("writeOnly")
+ }
+ if not secret_keys:
+ return new_configuration
+
+ try:
+ existing_configuration = (
+ json.loads(existing_raw_configuration) if
existing_raw_configuration else {}
+ )
+ except (TypeError, ValueError):
+ existing_configuration = {}
+
+ return {
+ key: (
+ existing_configuration[key]
+ if key in secret_keys
Review Comment:
If the schema was unavailable when the client read this layer,
`_mask_configuration` replaces every truthy value, including non-secret
settings. Once the schema is available here, this restores only write-only
keys, so a name-only save can persist `XXXXXXXXXX` as values such as `account`
or `database` and break the connection. Can the update path preserve all values
that were masked by the fallback, or avoid returning a round-trippable masked
configuration in that state?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
