aminghadersohi opened a new pull request, #44709: URL: https://github.com/apache/superset/pull/44709
### SUMMARY Google Sheets OAuth2 connections never use the signed-in user's access token when a catalog is configured. The connection form always configures one. - `GSheetsEngineSpec.impersonate_user` adds the token to the engine URL (`?access_token=`). - `update_params_from_encrypted_extra` stores the catalog, and any service account, in `connect_args["adapter_kwargs"]["gsheetsapi"]`. - `create_engine` merges `connect_args` over the dialect's own connect arguments shallowly. That dict therefore **replaces** the adapter kwargs that shillelagh built from the URL, and the token is lost. Every query then runs without credentials. A private sheet fails with `UnauthenticatedError`, `needs_oauth2()` matches it, and the user is sent back to the Google consent screen on every query. This happens even right after a successful token refresh. The token is now placed in the same `connect_args` adapter kwargs, so it survives the merge. It is also no longer part of the engine URL. ### BEFORE/AFTER - Before: OAuth2 database with a catalog. The stored token is refreshed, but the request reaches Google with no `Authorization` header (HTTP 401), and the user is prompted to authorize again. - After: the query runs with the user's token. ### TESTING INSTRUCTIONS - `pytest tests/unit_tests/db_engine_specs/test_gsheets.py`. The new `test_impersonate_user_access_token_with_catalog` builds the engine exactly as `Database._get_sqla_engine` does (`impersonate_user`, then `update_params_from_encrypted_extra`, then `create_engine`) and checks the kwargs that reach the DB-API `connect()`. It fails without the change. - Live: a Google Sheets database with an OAuth2 client and a catalog pointing at a private sheet. Authorize once, then run a query in SQL Lab. Before the change it prompts for authorization again. After the change it returns rows. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [ ] Changes UI - [ ] Includes DB Migration - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
