gabotorresruiz opened a new pull request, #45997:
URL: https://github.com/apache/superset/pull/45997
### SUMMARY
## TL;DR
- In the database modal, the Secure extra editor shows masked secrets with
no way to tell which value is stored.
- For a saved database, when the server enables hints, one field per stored
secret now sits under the editor, labelled with the engine's name for it ("JWT
Token") and built like the modal's other password fields: a masked input with
the eye toggle.
- Clicking the eye fetches the hints endpoint once and appends each secret's
last characters to its bullets. Nothing else on screen changes; nothing is
requested before the click; the second click hides it again.
- Review focus: the gating condition in `ExtraOptions`, the single-request
guard, and the helper wording that keeps unsaved edits from being misread.
## Why
Stacked on the backend PR https://github.com/apache/superset/pull/45996,
which adds `GET /api/v1/database/<pk>/encrypted_extra_hints/` and the engine
information this UI reads; the first four commits here are that PR and this
diff shrinks to the last commit once it merges. Editors who rotate a credential
need to confirm which value is live; the endpoint gives a safe tail, and this
PR surfaces it where the masked value is edited, using the same field pattern
as every other field in the Security section.
## What
`ExtraOptions` resolves the engine's declared sensitive paths (from
`engine_information.encrypted_extra_sensitive_fields`, added by the backend PR)
against the masked JSON in the editor and renders one `SecureExtraHints` field
per path that holds the mask, when `db.id` is set and
`common.conf.ENCRYPTED_EXTRA_HINT_CHARS` is above 0. Each field is built from
the modal's own `StyledInputContainer`: label from the engine ("JWT Token"), a
read-only text input of bullets with the same eye toggle as the modal's
password fields, helper "Stored at connect_args.jwt. Edits to Secure extra
above are not reflected until saved." The first eye click fetches the hints
once; every field then shows the bullets followed by its suffix. When the
server withholds the ending because the secret is shorter than four times the
configured length, the field says "Too short to show safely" with a tooltip
stating the threshold; a field the server returned no hint for says "Not
available". The label, helper and
input are the same nodes before and after; the input stays a text input and
disables the font's contextual alternates so the bullets do not redraw when the
suffix follows them. A failed request shows an inline warning under the first
field and keeps the eye usable. Components come from `@superset-ui/core`;
strings go through `t()`.
## Compatibility
- No API or config change; reads the config key the backend PR exposes. With
the server default (0) the field never renders.
- No change to the editor or the save flow.
## How to test
- Jest: `SecureExtraHints.test.tsx` (fields rendered hidden with their final
label and helper and no request, exact URL once, reveal changes only the value
of the same input, suffix matched by path not position, too short, no matching
hint, failure then retry, double click sends one request, no count is rendered,
too-short tooltip states the threshold, hide drops the suffix, fresh fetch
after hide, remount, text input in both states, bullets keep their glyphs
before the suffix, no inner border, works when effects run twice as in strict
mode, keyboard reveal keeps focus, console stays clean) plus the path resolver
cases (dotted, wildcard, nested wildcard, non-mask values, invalid JSON,
declared order); `ExtraOptions.test.tsx` (fields per masked declared path;
absent for config 0, create mode, no mask, no declared match, invalid JSON).
`npm run type`: 0 errors.
- Verified in a local stack against a single-node Druid: reveal, hide,
reopen, save without touching the secret (stored value unchanged), replace the
secret, short secret, two secrets at once, read-only user, backend unavailable,
slow network double click, token rotated while the modal is open, unsaved
edits, create mode, engine without a matching declared field, keyboard,
console; the bullet region of the field is pixel-identical before and after the
click.
- Manual: with the backend PR and `ENCRYPTED_EXTRA_HINT_CHARS = 5`, edit a
Druid connection whose Secure extra holds a JWT, open Advanced > Security,
click the eye in the "JWT Token" field.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
Screenshots: captured, being attached (before with hints disabled; the field
hidden; revealed; too short; two secrets; backend unavailable).
### TESTING INSTRUCTIONS
See "How to test" above.
### ADDITIONAL INFORMATION
- [ ] Has associated issue:
- [ ] Required feature flags:
- [x] Changes UI
- [ ] Includes DB Migration (follow approval process in
[SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [x] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
