betodealmeida opened a new pull request, #45894: URL: https://github.com/apache/superset/pull/45894
### SUMMARY Adds support for per-user OAuth2 authentication in Semantic Layer extensions. With this PR, extensions can now store access and refresh tokens in encrypted, user-scoped storage that is unavailable through browser-facing extension storage APIs. Tokens remain scoped to the user who authorized access. Semantic Layer extensions reuse Superset’s existing OAuth2 error handling and authorization UI. Authorization can be triggered from configuration dialogs, Explore, and dashboard queries. Completing authorization retries the interrupted operation. Semantic view metadata loading can require authentication before Explore renders, so that path displays the authorization prompt before loading the editor. The change also preserves user identity in asynchronous query execution and partitions authenticated semantic-view caches by user. A database migration adds the storage access classification. Downgrading permanently deletes backend-only secrets to prevent them from becoming browser-accessible; this behavior is documented in `UPDATING.md`. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF Before: opening a semantic-view chart without credentials could show a permission error and “Missing datasource,” with no way to authorize access. <img width="3440" height="1440" alt="Screenshot 2026-10-30 at 12 57 02 PM" src="https://github.com/user-attachments/assets/d69eac37-4485-433d-a929-f8456f683004"; /> After: Superset displays an OAuth2 authorization link and reloads the chart after authorization completes. <img width="3440" height="1440" alt="Screenshot 2026-10-30 at 12 53 34 PM" src="https://github.com/user-attachments/assets/80d4ea56-b646-4a1d-ad80-6e98137cfef5"; /> <img width="3440" height="1440" alt="Screenshot 2026-10-30 at 12 53 26 PM" src="https://github.com/user-attachments/assets/5fca02cd-bd33-4292-883f-ffea548c8cf9"; /> Note that the behavior in Explore is slightly different with semantic views compared to datasets: with a dataset that needs OAuth2 Explore will render, but the dataset component will ask for auth. For semantic views, Explore doesn't know what metrics and columns exist until the user authenticates, since that information lives in the semantic layer, not in Superset. Because of this, the Explore UI doesn't render and is replaced by the authentication dialog. ### TESTING INSTRUCTIONS I wrote the specification for a **generic RESTful semantic layer API** at https://github.com/betodealmeida/sl-rest-api. The API is a 1:1 mapping of the Superset semantic layer Python API to JSON requests. In addition to the [spec](https://github.com/betodealmeida/sl-rest-api/blob/main/SPEC.md) itself, the repo has: 1. A simple server implementing the API and exposing Pandas dataframes as semantic views. 2. A Superset DB engine spec. 3. A Superset semantic layer extension. I'm also in the process of implementing the API in DataJunction, so that Superset can be used with it: https://github.com/datajunction/dj/pull/2661 A simple way of testing this PR: 1. Run the server from the repo above: ```bash % SEMANTIC_LAYER_REQUIRE_AUTH=1 semantic-api ``` 2. Build the extension from the repo above and install it in Superset. 3. Add a new semantic layer connection. First fill in the values: - API URL: http://host.docker.internal:8002 - Authentication: OAuth2 - Client ID: `demo-client` - Client secret: `demo-secret` - Authorization URL: http://localhost:8002/authorize - Token URL: http://host.docker.internal:8002/token 4. Then click the "Connect account" in the dialog to trigger OAuth2. 5. Add a semantic view and create a chart. 6. Login as a different user and try to view the chart. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [x] Changes UI - [x] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [x] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
