seunggabi opened a new pull request, #45272:
URL: https://github.com/apache/superset/pull/45272
### SUMMARY
The "Create API Key" modal offers the full `superset:<resource>:<action>`
scope catalog (32 entries), but `SecurityManager.create_api_key` rejects any
scope that exceeds the issuing user's own permissions. For a non-admin that
means most of the list cannot be selected successfully, and when they do pick
one the request fails with a **500** (the `ValueError` raised by
`_validate_requested_api_key_scopes` is unhandled under FAB's `@safe`) and the
UI only shows a generic "Failed to create API key" toast.
This PR makes the modal offer only what the user can actually obtain, and
turns the rejection into a proper 400 with a reason:
- `SecurityManager.get_allowed_api_key_scopes(user)` walks the scope catalog
and keeps every scope that `_validate_requested_api_key_scopes` accepts, so the
result is by construction exactly the set `create_api_key` will honour (admins
get the full catalog, users with no matching permission get `[]`).
- `create_api_key` now translates the `ValueError` into
`werkzeug.exceptions.BadRequest`, which FAB's `ApiKeyApi` `@safe` decorator
maps to a **400** carrying the message. The docstring previously documented the
500 as a known follow-up; this closes it.
- New endpoint `GET /api/v1/me/api_key_scopes/` → `{"result": [...]}` for
the current user (same 401 handling as the other `/me/` endpoints).
- `ApiKeyCreateModal` fetches that list when shown and filters the scope
`<Select>` options; if the lookup fails it falls back to the full catalog as
before. The failure toast now appends the server message (via
`getClientErrorObject`), e.g. `Failed to create API key: 400 Bad Request:
Requested scope 'superset:dashboard:write' exceeds the issuing user's own
permissions`.
No RBAC rules change: who may create keys and which scopes they may carry is
decided exactly as before, the UI just stops offering options that are
guaranteed to be rejected.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
Before: a Gamma-like user sees all 32 scopes; selecting e.g.
`superset:dashboard:write` → HTTP 500, toast "Failed to create API key".
After: the Select only lists scopes the user may self-issue; a rejected
request (e.g. crafted via API) → HTTP 400 with the reason, and the toast shows
it.
### TESTING INSTRUCTIONS
1. Log in as a non-admin user (e.g. Gamma + a few read permissions) and open
Settings → API Keys → Create.
2. The "MCP scopes" dropdown now lists only the scopes matching that user's
permissions; `GET /api/v1/me/api_key_scopes/` returns the same list.
3. `POST /api/v1/security/api_keys/` with a scope outside that list returns
400 with `Requested scope '...' exceeds the issuing user's own permissions`
(was 500).
4. As Admin the dropdown and the endpoint still return the full catalog.
5. Tests:
- `pytest tests/unit_tests/security/test_api_key_scopes.py
tests/unit_tests/views/test_current_user_api.py`
- `cd superset-frontend && npx jest src/features/apiKeys`
### ADDITIONAL INFORMATION
- [ ] Has associated issue:
- [ ] Required feature flags:
- [x] Changes UI
- [ ] Includes DB Migration (follow approval process in
[SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [x] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
