GitHub user yves-renier added a comment to the discussion: RBAC-only with a
non-empty scope for the MCP server
for context, here is my current fix implementing the first method (limiting the
scopes to valid superset scopes) :
```python
def _get_token_scopes() -> set[str] | None:
"""Return the set of scopes on the current JWT access token, or None.
Returns None when there is no JWT context or the token carries no scopes,
so callers can fall back to RBAC-only behavior (back-compat for API-key and
scope-less JWT deployments). Returns a (possibly populated) set only when
the token explicitly advertises scopes.
"""
try:
from fastmcp.server.dependencies import get_access_token
except ImportError:
return None
try:
access_token = get_access_token()
except Exception: # noqa: BLE001 - fail closed on token-context errors
logger.exception("Unable to resolve MCP access-token scopes")
# ``None`` means that no scoped credential was presented and enables
# legacy RBAC-only behavior. An empty set instead makes every scope
# check fail, so an unexpected context error cannot erase restrictions
# carried by a credential.
return set()
if access_token is None:
return None
#--------------------------------
# MY MODIFICATIONS START HERE
#--------------------------------
scopes = getattr(access_token, "scopes", None)
# keep only scopes used by superset
valid_scopes = set(_METHOD_TO_REQUIRED_SCOPE.values())
valid_scopes_from_token = {str(s) for s in scopes if s in valid_scopes}
if not valid_scopes_from_token:
# Token present but no valid scopes advertised: do NOT enforce scope
checks.
return None
return valid_scopes_from_token
```
GitHub link:
https://github.com/apache/superset/discussions/45673#discussioncomment-19150446
----
This is an automatically sent email for [email protected].
To unsubscribe, please send an email to:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
