aminghadersohi commented on code in PR #44709:
URL: https://github.com/apache/superset/pull/44709#discussion_r4113404014
##########
superset/db_engine_specs/gsheets.py:
##########
@@ -255,7 +255,15 @@ def impersonate_user(
url = url.update_query_dict({"subject": user.email})
if user_token:
- url = url.update_query_dict({"access_token": user_token})
+ # Pass the token through ``connect_args`` rather than the URL.
+ # ``update_params_from_encrypted_extra`` stores the catalog (and
any
+ # service account) in ``connect_args["adapter_kwargs"]``, and
SQLAlchemy
+ # merges ``connect_args`` over the dialect's own arguments
shallowly,
+ # so a token in the URL would be dropped and the query would run
+ # without credentials.
+ connect_args = engine_kwargs.setdefault("connect_args", {})
+ adapter_kwargs = connect_args.setdefault("adapter_kwargs", {})
+ adapter_kwargs.setdefault("gsheetsapi", {})["access_token"] =
user_token
Review Comment:
Fixed in 263c191705: when the token goes into `connect_args`, a `subject`
set on the URL is copied into the same `gsheetsapi` kwargs. Added a test
covering username + token through `update_params_from_encrypted_extra` and
`create_engine` that checks both reach the adapter.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
