gabotorresruiz opened a new pull request, #45996:
URL: https://github.com/apache/superset/pull/45996
### SUMMARY
## TL;DR
- Database editors cannot tell which secret is stored in `encrypted_extra`
once it is masked, which matters when a token is rotated and the old one may
still be the stored one.
- New opt-in endpoint returns, for each declared sensitive field, its label,
path, length and last few characters. The value itself never leaves the server.
- Off by default (`ENCRYPTED_EXTRA_HINT_CHARS = 0`); gated on the database
write permission; every call is event-logged with the database id only.
- Engine information (on the database GET and on `available`) now lists the
declared sensitive paths with their labels, so a client can render a field per
stored secret before asking for any hint.
- Review focus: the 25% cap in the helper, the permission mapping, and the
schema that bounds the response to four keys.
## Why
Engine specs already declare which `encrypted_extra` paths are secrets
(`encrypted_extra_sensitive_fields`), and the modal masks them as `XXXXXXXXXX`.
After a credential rotation an editor has no safe way to confirm which value is
live without pasting the secret again. A short tail (for a JWT, part of its
signature) identifies a value without exposing it, so operators who allow this
can give editors that signal.
## What
A pure helper next to the existing masking utilities computes the hints from
the declared JSONPath expressions, trims whitespace, skips non-strings, expands
wildcards per match, and withholds the suffix when the value is shorter than
four times the configured length (never more than 25% revealed).
`BaseEngineSpec.encrypted_extra_hints` adds the engine's human labels. A
command and `GET /api/v1/database/<pk>/encrypted_extra_hints/` expose it; the
response is serialised through a Marshmallow schema so only `path`, `label`,
`suffix` and `length` can be returned. The length is read from config only;
request parameters are ignored.
`BaseEngineSpec.get_public_information()` gains
`encrypted_extra_sensitive_fields`, a map from each declared JSONPath to its
label, built by a new `encrypted_extra_sensitive_field_labels()` that the hints
also use for their labels. The always-included OAuth2 client secret path
defaults to the label "OAuth2 client secret" unless the engine declares its own.
## Compatibility
- New config `ENCRYPTED_EXTRA_HINT_CHARS` (int, default 0 = disabled),
exposed to the frontend through `FRONTEND_CONF_KEYS`.
- New route mapped to the existing `can_write` on `Database` through
`MODEL_API_RW_METHOD_PERMISSION_MAP`; no new permission, no migration.
- Works for every engine that declares `encrypted_extra_sensitive_fields`
(Druid, Presto, Trino, BigQuery, Snowflake and others); engines without
declarations return an empty list.
- `engine_information` carries one additional key on every engine; existing
keys are unchanged. No secret values are included, only declared paths and
labels.
- No behaviour change for existing deployments unless the config is set
above 0.
## How to test
- Unit: `tests/unit_tests/utils/json_tests.py`,
`tests/unit_tests/db_engine_specs/test_{base,druid,presto,trino}.py` (42 new
cases: paths, cap, boundary at 4x, blank and whitespace, unicode, mask literal,
non-strings, malformed JSON, 1 MB payload under a second) and
`tests/unit_tests/databases/api_test.py` (15 cases: hints, exact keys,
disabled, malformed, 404 for unknown and invalid ids, 403 without write, 401
without login, query params ignored).
- Unit, engine information: `test_base.py` (default, set and dict
declarations, OAuth2 label precedence, `get_public_information` includes the
map), `test_druid.py`, `tests/unit_tests/databases/test_schemas.py`, and the
`available` case in `api_test.py`.
- Integration: `tests/integration_tests/databases/api_tests.py` (admin 200,
gamma 403, event log row without secret text; `available` expectations include
the new key).
- Manual: set `ENCRYPTED_EXTRA_HINT_CHARS = 5`, store `{"connect_args":
{"scheme": "https", "jwt": "<token>"}}` in a Druid connection's Secure extra,
call the endpoint as an editor and check the suffix and length; call as a
read-only user and get 403; set the config to 0 and get `[]`.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
Not applicable: backend only. The companion frontend PR adds the UI.
### TESTING INSTRUCTIONS
See "How to test" above.
### ADDITIONAL INFORMATION
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in
[SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [x] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
