mikebridge commented on code in PR #45550:
URL: https://github.com/apache/superset/pull/45550#discussion_r4362402898
##########
superset/extensions/api.py:
##########
@@ -30,6 +30,9 @@
class ExtensionsRestApi(BaseApi):
allow_browser_login = True
+ # FAB's BaseApi exempts its blueprint from CSRF; keep the protection that
+ # other cookie-authenticated Superset APIs have.
+ csrf_exempt = False
Review Comment:
Agreed. Both extension APIs now inherit `BaseSupersetApi`, and the duplicate
`csrf_exempt` lines and comments are gone. I checked the FAB mappings: this
base doesn't apply the model API's read/write remapping, so the existing class
and method permission names are unchanged. A regression test pins those names,
browser login and CSRF protection. The focused tests and hooks pass, and
regenerating OpenAPI produces no diff.
##########
superset/extensions/storage/api.py:
##########
@@ -86,9 +86,18 @@ def _wire_value_for_request(value: Any, is_binary: bool) ->
Any:
class ExtensionStorageRestApi(BaseApi):
- """REST API for extension ephemeral (Tier 2) and persistent (Tier 3)
storage."""
+ """REST API for extension ephemeral (Tier 2) and persistent (Tier 3)
storage.
+
+ Docstring descriptions below use backticks rather than double quotes: FAB
+ re-parses each operation's parsed YAML through ``str(dict)``, and a value
+ that mixes ``'`` and ``"`` comes back with escapes YAML rejects, which
+ breaks ``/api/v1/_openapi`` and ``superset update-api-docs``.
+ """
allow_browser_login = True
+ # FAB's BaseApi exempts its blueprint from CSRF; the write routes are
+ # cookie-authenticated, so keep the protection.
+ csrf_exempt = False
Review Comment:
Same change here: `BaseSupersetApi`, with the manual CSRF setting removed.
The seven storage permissions and the response helpers are unchanged, including
the no-store behaviour. The session, JWT and API-key PUT/DELETE tests pass,
both for rejection without a token and for acceptance with a token and session.
The OpenAPI docstring fixes are kept.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
