rusackas opened a new pull request, #44626: URL: https://github.com/apache/superset/pull/44626
### SUMMARY Fixes #37700. Supersedes #37773 by @jayvenn21, whose `add_view_no_menu` registration intercept, launcher hiding and tests this builds on (credited as co-author on the commit). The Flask-AppBuilder server-rendered password reset pages (`/resetpassword/form`, `/resetmypassword/form`) survived the SPA migration and were still reachable in 6.0. #37773 gated them behind a new `ENABLE_LEGACY_FAB_PASSWORD_VIEWS` flag. Looking at what people actually asked for, it was the SPA inputs, not a switch to keep the old pages around, so this drops the flag idea and removes the views outright, and makes sure the SPA covers every job they had: - **Admin resets** live in the Users list edit modal, which gains optional "New password" / "Confirm new password" fields wired to the existing `PUT /api/v1/security/users/<id>`. That endpoint is `can_put on User` (admin) and never required a current password, which is the right rule for an admin resetting someone else's account. The self-service `PUT /api/v1/me/` keeps requiring `current_password`. - **Self-service** stays on the profile page's "Reset my password" modal, which now sends `current_password`. It didn't before, so since #42934 made the field mandatory the SPA modal was actually broken against its own API. - **Forced password change** (`ENABLE_FORCE_PASSWORD_CHANGE`) used to redirect to `ResetMyPasswordView`. It now lands on `/user_info/`, with the profile page, the current-user API and the CSRF endpoint exempt from the hook so the page is usable; a flagged user can still only reach that page and log out. A successful self-service change through `/api/v1/me/` now clears `password_must_change` (previously only the FAB view did), in the same unit of work as the new hash. Backend: the two views are never registered (FAB adds them unconditionally for `AUTH_DB`, and a blueprint can't be removed once added, so `register_views()` intercepts `add_view_no_menu` for the duration of FAB's registration), the "Reset Password" / "Reset my password" launchers on the FAB user pages are hidden and answer 404 instead of `BuildError`, and `sync_role_definitions` stops assigning the stale `ResetPasswordView` / `ResetMyPasswordView` / launcher permissions that upgraded installs still carry in their metadata DB. `ENABLE_LEGACY_FAB_PASSWORD_VIEWS` does not exist. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF Before: `/resetpassword/form?pk=<id>` and `/resetmypassword/form` render the FAB forms; the Users list edit modal has no password fields; the profile "Reset my password" modal fails with "This field is required to change the password." After: both routes 404. The Users list edit modal shows "New password" and "Confirm new password" under Groups (blank keeps the current password, mismatch is rejected client-side). The profile "Reset my password" modal shows "Current password", "New password" and "Confirm Password". ### TESTING INSTRUCTIONS 1. As Admin, open Settings > List Users, edit a user, set a new password in the two new fields and save; log in as that user with the new password. Save the same modal with the fields blank and confirm the password is unchanged. 2. As any user, open the profile page (`/user_info/`), "Reset my password", enter the current and a new password; confirm the new one works and the old one doesn't. 3. Set `ENABLE_FORCE_PASSWORD_CHANGE = True`, flag a user (`set_password_must_change(user_id)`), log in as them: every page redirects to `/user_info/`, the reset modal there works, and after changing the password the redirect stops. Logging out is possible throughout. 4. `/resetpassword/form?pk=1` and `/resetmypassword/form` return 404; `superset init` leaves no role with `ResetPasswordView`, `ResetMyPasswordView`, `resetpasswords` or `resetmypassword` permissions. Locally: security + users unit tests (418 passed), the touched integration tests in `core_tests.py` (2 passed) and the 5 touched jest suites (27 passed). `users/api_tests.py` and `session_invalidation_tests.py` have 8 failures here that reproduce identically on `master` (this machine's test config makes Public role like Gamma and has no Redis), so CI is the arbiter for those. ### ADDITIONAL INFORMATION - [x] Has associated issue: #37700 - [ ] Required feature flags: - [x] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [x] Removes existing feature or API Breaking change: the two legacy routes and their permissions are gone (UPDATING.md entry included). Deployments that deep-link to them should point at `/user_info/` or the Users list. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
