gabotorresruiz opened a new pull request, #46035: URL: https://github.com/apache/superset/pull/46035
### SUMMARY Revealing the ending of a stored secret tells an editor which token is stored, not whether it still works. For JWT-shaped values this PR also shows when the token expires, read from the token's own `exp` claim, so the reveal answers both questions with no extra characters of the secret. Stacked on https://github.com/apache/superset/pull/45997 (which is stacked on https://github.com/apache/superset/pull/45996); the first five commits are those PRs and this diff shrinks to the last commit once they merge. What changes: - A `jwt_expiry` helper decodes the payload segment of a value shaped like a JWT (three base64url segments, JSON object payload) and reads only an integer `exp`. It returns a UTC datetime and whether it is in the past, computed server-side. It never raises, verifies no signature (the server has no key, and the claim is informational), and reads or returns nothing else from the payload. Values that are not JWTs, including PEM keys and plain passwords, yield nulls. - Each hint from `GET /api/v1/database/<pk>/encrypted_extra_hints/` gains `expires_at` and `expired`, both nullable; the response schema and the OpenAPI spec bound them. - In the modal, a revealed field whose value is a JWT shows `Expires Jan 4, 2027` in secondary text, or `Expired Nov 4, 2026` in the danger colour, in the slot next to the eye, with a tooltip saying it is read from the token's `exp` claim. The too-short and not-available texts keep precedence. Dates use the app's locale-aware short format. Compatibility: no config change; the two new keys are null for anything that is not a JWT, and an older frontend ignores them. The expiry is shown only after the same explicit reveal click as the ending. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF Screenshots: captured, being attached (revealed field with an expiry 60 days out; expired token in the danger colour; tooltip). ### TESTING INSTRUCTIONS Automated: - `tests/unit_tests/utils/json_tests.py`: 43 helper cases (future, past, exact second, missing `exp`, PEM, missing padding, year 9999, large inputs are fast, nine non-JWT shapes, bad padding, non-object payloads, non-integer and out-of-range `exp`, non-string values), plus the hint fields for a JWT and an expired JWT with whitespace. - `tests/unit_tests/databases/api_test.py`: the endpoint returns the two keys for future and expired tokens; existing hint tests updated for the two null keys. - `SecureExtraHints.test.tsx`: expiry in secondary text, expired in the danger colour, tooltip, hidden field drops it, no expiry leaves the slot empty, too-short keeps precedence. Manual, with `ENCRYPTED_EXTRA_HINT_CHARS = 5`: 1. Store a JWT whose `exp` is 60 days ahead in a Druid connection's Secure extra, open Advanced > Security, click the eye: the ending plus `Expires <date>`. 2. Store one whose `exp` is yesterday: `Expired <date>` in the danger colour. 3. Store a non-JWT secret: no expiry text. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [x] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [x] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
