fix(mcp): correct method name in API key auth (extract_api_key_from_request)#39437
Draft
aminghadersohi wants to merge 1 commit intomasterfrom
Draft
fix(mcp): correct method name in API key auth (extract_api_key_from_request)#39437aminghadersohi wants to merge 1 commit intomasterfrom
aminghadersohi wants to merge 1 commit intomasterfrom
Conversation
…equest) The hasattr check and call in _resolve_user_from_api_key() referenced sm._extract_api_key_from_request (private, with underscore) but FAB defines the method as sm.extract_api_key_from_request (public). The hasattr always returned False, so MCP never authenticated via API key and silently fell through to MCP_DEV_USERNAME / g.user instead. Also update test_auth_api_key.py to use the correct public method name throughout, and add a regression test that asserts both method names referenced in auth.py actually exist on the real SecurityManager object so CI catches future mismatches instead of silently failing at runtime. Fixes SC-99414. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Contributor
Code Review Agent Run #4ddf1bActionable Suggestions - 0Review Details
Bito Usage GuideCommands Type the following command in the pull request comment and save the comment.
Refer to the documentation for additional commands. Configuration This repository uses Documentation & Help AI Code Review powered by |
dosubot
bot
added
authentication
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #39437 +/- ##
=======================================
Coverage 64.49% 64.49%
=======================================
Files 2557 2557
Lines 133097 133097
Branches 30910 30910
=======================================
Hits 85846 85846
Misses 45761 45761
Partials 1490 1490
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SUMMARY
Fixes a method name mismatch in
superset/mcp_service/auth.pythat caused MCP API key authentication to silently fail._resolve_user_from_api_key()referencedsm._extract_api_key_from_request(private, underscore prefix), but FAB defines it assm.extract_api_key_from_request(public, no underscore). Thehasattrcheck always returnedFalse, so the function returnedNoneimmediately and MCP fell through toMCP_DEV_USERNAME/g.userinstead of authenticating via API key.Changes:
superset/mcp_service/auth.py: Rename_extract_api_key_from_request→extract_api_key_from_requestin thehasattrguard and the call site (2 lines)tests/unit_tests/mcp_service/test_auth_api_key.py: Update all existing mock references to the correct method name, and add a regression test (test_security_manager_has_expected_api_key_methods) that asserts both method names referenced inauth.pyactually exist on the realSecurityManagerobject — so CI catches future name mismatches instead of silently failing at runtimeBEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
N/A — auth bug fix with no UI changes.
TESTING INSTRUCTIONS
pytest tests/unit_tests/mcp_service/test_auth_api_key.py— all tests should pass/api/v1/security/api_keys/, then call an MCP tool withAuthorization: Bearer sst_<key>— should authenticate correctly instead of falling through to dev userADDITIONAL INFORMATION
Relates to #37973 (the PR that added API key auth — this fixes the MCP integration that failed QA 0/6).
🤖 Generated with Claude Code