yves-renier commented on issue #45661:
URL: https://github.com/apache/superset/issues/45661#issuecomment-6361576238
for context, here is the current fix implementing the first method (limiting
the scopes to valid superset scopes) :
```python
def _get_token_scopes() -> set[str] | None:
"""Return the set of scopes on the current JWT access token, or None.
Returns None when there is no JWT context or the token carries no scopes,
so callers can fall back to RBAC-only behavior (back-compat for API-key
and
scope-less JWT deployments). Returns a (possibly populated) set only when
the token explicitly advertises scopes.
"""
try:
from fastmcp.server.dependencies import get_access_token
except ImportError:
return None
try:
access_token = get_access_token()
except Exception: # noqa: BLE001 - fail closed on token-context errors
logger.exception("Unable to resolve MCP access-token scopes")
# ``None`` means that no scoped credential was presented and enables
# legacy RBAC-only behavior. An empty set instead makes every scope
# check fail, so an unexpected context error cannot erase
restrictions
# carried by a credential.
return set()
if access_token is None:
return None
#--------------------------------
# MY MODIFICATIONS START HERE
#--------------------------------
scopes = getattr(access_token, "scopes", None)
# keep only scopes used by superset
valid_scopes = set(_METHOD_TO_REQUIRED_SCOPE.values())
valid_scopes_from_token = {str(s) for s in scopes if s in valid_scopes}
if not valid_scopes_from_token:
# Token present but no valid scopes advertised: do NOT enforce scope
checks.
return None
return valid_scopes_from_token
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
