Skip to content

fix(security_manager): custom auth_view issue #39098

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
villebro merged 2 commits into from
Apr 6, 2026
+10 −4
Merged

fix(security_manager): custom auth_view issue #39098

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
83c2ad9
fix custom auth_view issue
villebro Apr 3, 2026
11134d7
make registeruser_view conditional also
villebro Apr 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 10 additions & 4 deletions superset/security/manager.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -259,6 +259,10 @@ class SupersetSecurityManager( # pylint: disable=too-many-public-methods
SecurityManager
):
userstatschartview = None
register_superset_auth_view = True
"""Set to False in subclasses that provide their own auth view."""
register_superset_registeruser_view = True
"""Set to False in subclasses that provide their own register user view."""
READ_ONLY_MODEL_VIEWS = {"Database", "DynamicPlugin"}

role_api = SupersetRoleApi
Expand Down Expand Up @@ -3167,10 +3171,12 @@ def is_admin(self) -> bool:
def register_views(self) -> None:
from superset.views.auth import SupersetAuthView, SupersetRegisterUserView

self.auth_view = self.appbuilder.add_view_no_menu(SupersetAuthView)
self.registeruser_view = self.appbuilder.add_view_no_menu(
SupersetRegisterUserView
)
if self.register_superset_auth_view:
self.auth_view = self.appbuilder.add_view_no_menu(SupersetAuthView)
Comment on lines +3174 to +3175
Copy link
Copy Markdown
Contributor

@bito-code-review bito-code-review Bot Apr 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Runtime AttributeError Risk

The conditional registration of SupersetAuthView is good, but the rate limiting code later assumes self.auth_view always exists. If a subclass sets register_superset_auth_view = False, this will cause an AttributeError at runtime. The fix checks for auth_view's existence safely.

Code suggestion
Check the AI-generated fix before applying
 -        if (
 -            self.is_auth_limited
 -            and getattr(self.auth_view, "blueprint", None) is not None
 -        ):
 -            self.limiter.limit(self.auth_rate_limit, methods=["POST"])(
 -                self.auth_view.blueprint
 -            )
 +        if (
 +            self.is_auth_limited
 +            and getattr(self, 'auth_view', None) is not None and getattr(self.auth_view, "blueprint", None) is not None
 -        ):
 +            self.limiter.limit(self.auth_rate_limit, methods=["POST"])(
 +                self.auth_view.blueprint
 +            )

Code Review Run #ec7c4a

Should Bito avoid suggestions like this for future reviews? (Manage Rules)

  • Yes, avoid them

Copy link
Copy Markdown
Member

@nytai nytai Apr 3, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i'm actually a bit confused why this is being added here instead of just setting this as the authview in superset's security manager. That would avoid needing extra properties on the security manager and would just follow the established FAB pattern.

Copy link
Copy Markdown
Member Author

@villebro villebro Apr 3, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not 100 % convinced this auth_view should be set in the base security manager, as it feels like it interferes with how fab deals with auth provider views. But I don't have the full context on the changes in the theming PR to understand the changes around this.

if self.register_superset_registeruser_view:
self.registeruser_view = self.appbuilder.add_view_no_menu(
SupersetRegisterUserView
)

# Apply rate limiting to auth view if enabled
# This needs to be done after the view is added, otherwise the blueprint
Expand Down
Loading