Dmitry-Kucher opened a new pull request, #45702: URL: https://github.com/apache/superset/pull/45702
### SUMMARY `ENABLE_FORCE_PASSWORD_CHANGE` (#40669) redirects users flagged with `password_must_change` to their profile page until they choose a new password. Nothing in the tree ever raises that flag, though: `set_password_must_change()` has no caller, and #40669 left wiring it to administrator flows as a follow-up. Turning the setting on therefore enforces nothing. This PR raises the flag in `SupersetUserApi`, which backs the Users list (and, since #44626, every administrator password reset): - `pre_add` (`POST /api/v1/security/users/`): a user created by an administrator starts on a password the administrator chose. - `pre_update` (`PUT /api/v1/security/users/<pk>`): an administrator setting another user's password hands out a temporary one. An administrator changing their own password has chosen it, so a pending change of theirs is cleared instead, as on `/api/v1/me/`. Design notes: - **Only while `ENABLE_FORCE_PASSWORD_CHANGE` is on.** Otherwise enabling the setting later would retroactively lock out every account an administrator ever set a password for. - **Only under `AUTH_DB`.** With OAuth/LDAP/remote-user auth, the password set in the Users list is not the one users sign in with, so forcing a change would only lock pre-provisioned users out. - **No early commit.** `set_password_must_change()` is `@transaction()`-wrapped, so calling it from `pre_add`/`pre_update` would commit the half-applied user edit before FAB's own commit. The write goes through a new non-committing `write_password_must_change()` helper instead, so it rides FAB's commit, the same way `invalidate_sessions_for_user` and the subject sync already do there. - The self-service paths (`PUT /api/v1/me/`, password recovery) already clear the flag, so the lifecycle closes. `UPDATING.md` and the `ENABLE_FORCE_PASSWORD_CHANGE` comment in `config.py` are updated. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF N/A (backend; the redirect UI already exists). ### TESTING INSTRUCTIONS ``` pytest tests/unit_tests/security/test_admin_password_forces_change.py ``` Covers: admin create and admin password change raise the flag; self-edit doesn't (and clears a pending flag); non-password edit, setting off, and non-DB auth don't; and no commit is issued from `pre_update`. The tests call `pre_add`/`pre_update` directly with a stand-in acting user, as the neighbouring `SupersetUserApi` tests do; there is no unit-level HTTP harness for this API. Manual: set `ENABLE_FORCE_PASSWORD_CHANGE = True`. As admin, set a new password for another user from Settings → List Users → Edit. Log in as that user: you're redirected to the profile page to choose a new password, and after changing it, normal access resumes. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: `ENABLE_FORCE_PASSWORD_CHANGE` (config, off by default) - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
