Repository navigation
feat(DB OAuth2): Allow admins to manage DB OAuth2 tokens - #45676
Merged
Merged
Conversation
github-actions
Bot
added
risk:db-migration
github-actions
Bot
added
i18n
✅ Deploy Preview for superset-docs-preview ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
There was a problem hiding this comment.
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Copilot review overview
4 open issues
DatabaseUserOAuth2TokensDAO.delete(self._tokens)is likely calling a DAO method intended for a… · New
What changed in this PR
Adds an admin-facing workflow for viewing and deleting stored DB OAuth2 tokens (single, bulk on page, and delete-all), plus the backend support needed to expose OAuth2 state on connections.
Changes:
- Add new REST API endpoints and command/DAO support for listing and deleting DB OAuth2 tokens (including a DB index for faster lookup).
- Expose
engine_information.oauth2_enabledso the UI can conditionally show “Manage OAuth2 tokens”. - Add frontend modal + tests, and update i18n/OpenAPI artifacts accordingly.
| File | Description |
|---|---|
| tests/unit_tests/semantic_layers/connections_access_test.py | Adds coverage for serialized connection payload exposing OAuth2-enabled state without leaking credentials. |
| tests/unit_tests/databases/api_test.py | Updates expectations to include engine_information.oauth2_enabled. |
| superset/semantic_layers/api.py | Includes encrypted_extra in query and adds engine_information to serialized database payload. |
| superset/security/manager.py | Marks can_manage_oauth2_tokens as admin-only permission. |
| superset/models/core.py | Adds oauth2_enabled to engine_information; adds DB index definition for token table. |
| superset/migrations/versions/2026-10-22_12-00_f72b6e9c104a_add_oauth2_token_management_indexes.py | Adds an index on database_id for OAuth2 tokens table. |
| superset/initialization/__init__.py | Registers the new DatabaseOAuth2TokensRestApi. |
| superset/databases/schemas.py | Extends engine info schema with oauth2_enabled; adds delete payload schema for token IDs. |
| superset/databases/filters.py | Adds a custom filter to search OAuth2 token owners (username/name/email). |
| superset/databases/api.py | Implements list + delete endpoints under /api/v1/database/<pk>/oauth2_tokens/*. |
| superset/daos/database.py | Adds DAO helpers for fetching tokens by IDs and bulk delete by database. |
| superset/commands/database/oauth2.py | Introduces OAuth2DeleteTokensCommand with validation and transactional deletion. |
| superset/commands/database/exceptions.py | Adds OAuth2 token-not-found and delete-failed exceptions/messages. |
| superset-frontend/src/pages/DatabaseList/index.tsx | Adds “Manage OAuth2 tokens” action and modal wiring based on permission + oauth2_enabled. |
| superset-frontend/src/pages/DatabaseList/DatabaseList.oauth2Tokens.test.tsx | Adds visibility/behavior tests for the new action in the DB list. |
| superset-frontend/src/features/databases/types.ts | Adds engine_information.oauth2_enabled typing. |
| superset-frontend/src/features/databases/OAuth2TokensModal.test.tsx | Adds modal behavior tests (select/delete, delete-all, retry/error states). |
| superset/translations/messages.pot | Adds new message IDs for token management UI and legend toggles. |
| superset/translations/en/LC_MESSAGES/messages.po | Updates English catalog for new OAuth2 token management strings. |
| superset/translations/ar/LC_MESSAGES/messages.po | Updates Arabic catalog for new OAuth2 token management strings. |
| superset/translations/ca/LC_MESSAGES/messages.po | Updates Catalan catalog for new OAuth2 token management strings. |
| superset/translations/cs/LC_MESSAGES/messages.po | Updates Czech catalog for new OAuth2 token management strings. |
| superset/translations/de/LC_MESSAGES/messages.po | Updates German catalog for new OAuth2 token management strings. |
| superset/translations/es/LC_MESSAGES/messages.po | Updates Spanish catalog for new OAuth2 token management strings. |
| superset/translations/fa/LC_MESSAGES/messages.po | Updates Persian catalog for new OAuth2 token management strings. |
| superset/translations/fi/LC_MESSAGES/messages.po | Updates Finnish catalog for new OAuth2 token management strings. |
| superset/translations/fr/LC_MESSAGES/messages.po | Updates French catalog for new OAuth2 token management strings. |
| superset/translations/it/LC_MESSAGES/messages.po | Updates Italian catalog for new OAuth2 token management strings. |
| superset/translations/ja/LC_MESSAGES/messages.po | Updates Japanese catalog for new OAuth2 token management strings. |
| superset/translations/ko/LC_MESSAGES/messages.po | Updates Korean catalog for new OAuth2 token management strings. |
| superset/translations/lv/LC_MESSAGES/messages.po | Updates Latvian catalog for new OAuth2 token management strings. |
| superset/translations/mi/LC_MESSAGES/messages.po | Updates Māori catalog for new OAuth2 token management strings. |
| superset/translations/nl/LC_MESSAGES/messages.po | Updates Dutch catalog for new OAuth2 token management strings. |
| superset/translations/pl/LC_MESSAGES/messages.po | Updates Polish catalog for new OAuth2 token management strings. |
| superset/translations/pt/LC_MESSAGES/messages.po | Updates Portuguese catalog for new OAuth2 token management strings. |
| superset/translations/pt_BR/LC_MESSAGES/messages.po | Updates Brazilian Portuguese catalog for new OAuth2 token management strings. |
| superset/translations/ro/LC_MESSAGES/messages.po | Updates Romanian catalog for new OAuth2 token management strings. |
| superset/translations/ru/LC_MESSAGES/messages.po | Updates Russian catalog for new OAuth2 token management strings. |
| superset/translations/sk/LC_MESSAGES/messages.po | Updates Slovak catalog for new OAuth2 token management strings. |
| superset/translations/sl/LC_MESSAGES/messages.po | Updates Slovenian catalog for new OAuth2 token management strings. |
| superset/translations/sr/LC_MESSAGES/messages.po | Updates Serbian catalog for new OAuth2 token management strings. |
| superset/translations/sr_Latn/LC_MESSAGES/messages.po | Updates Serbian (Latin) catalog for new OAuth2 token management strings. |
| superset/translations/ta/LC_MESSAGES/messages.po | Updates Tamil catalog for new OAuth2 token management strings. |
| superset/translations/th/LC_MESSAGES/messages.po | Updates Thai catalog for new OAuth2 token management strings. |
| superset/translations/tr/LC_MESSAGES/messages.po | Updates Turkish catalog for new OAuth2 token management strings. |
| superset/translations/uk/LC_MESSAGES/messages.po | Updates Ukrainian catalog for new OAuth2 token management strings. |
| superset/translations/zh/LC_MESSAGES/messages.po | Updates Chinese catalog for new OAuth2 token management strings. |
| superset/translations/zh_TW/LC_MESSAGES/messages.po | Updates Traditional Chinese catalog for new OAuth2 token management strings. |
| docs/static/resources/openapi.json | Updates generated OpenAPI spec with new endpoints/schemas and oauth2_enabled field. |
Review effort: Lite
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #45676 +/- ##
===========================================
+ Coverage 65.26% 84.57% +19.30%
===========================================
Files 3068 3069 +1
Lines 204990 205227 +237
Branches 48174 48222 +48
===========================================
+ Hits 133788 173570 +39782
+ Misses 68154 28354 -39800
- Partials 3048 3303 +255
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
Vitor-Avila
marked this pull request as draft
October 23, 2026 22:09
Copilot stopped reviewing on behalf of
Vitor-Avila due to an error
October 23, 2026 22:10
Vitor-Avila
marked this pull request as ready for review
October 23, 2026 22:12
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Database-list query overhead and blocking PostgreSQL index operations remain unresolved.
2 open issues
4 resolved since last review
DatabaseUserOAuth2TokensDAO.delete(self._tokens)is likely calling a DAO method intended for a…
Review effort: Balanced
aminghadersohi
self-requested a review
October 26, 2026 21:25
aminghadersohi
approved these changes
Oct 26, 2026
aminghadersohi
left a comment
aminghadersohi
left a comment
Contributor
There was a problem hiding this comment.
Reviewed the full diff. Looks good.
- Admin-only permission (
can_manage_oauth2_tokens) gates list and both delete endpoints. - Token secrets are never serialized: list columns are metadata only and bulk delete skips loading tokens.
- Selected delete is scoped to the database and returns 404 if any ID doesn't belong to it. Delete-all is a single bulk delete.
- Migration
f72b6e9c104achains from the current headd623a0cb6bb0, uses CONCURRENTLY on Postgres, and skips MySQL where the FK already indexes the column. - Frontend handles pagination, search, selection reset and error states, and has tests.
One nit, non-blocking: oauth2_enabled is set inside the same try as get_public_information(), so if is_oauth2_enabled() ever raises, the rest of the engine information is dropped too.
Contributor
|
github-actions
Bot
added
the
requires:rebase
github-actions
Bot
removed
the
requires:rebase
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SUMMARY
This PR provides admins with a way to delete existing OAuth2 tokens for specific users/DB connections. This is useful when the token was generated using an old incorrect role/config.
A new Manage OAuth2 tokens option is displayed for DB connections authenticated via OAuth2. The modal allows the deletion of a single token, multiple, and also all tokens. I decided to implement same behavior as CRUD views: can't select across pages for a bulk delete.
BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
Screen.Recording.2026-10-23.at.4.52.49.PM.mov
TESTING INSTRUCTIONS
ADDITIONAL INFORMATION