fix(oauth2): log database token failures - #42644
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
The logging changes in this pull request are designed to avoid logging sensitive information by using structured logging that captures only metadata, such as superset/commands/database/oauth2.py |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #42644 +/- ##
==========================================
- Coverage 65.79% 65.56% -0.23%
==========================================
Files 2842 2821 -21
Lines 162106 160402 -1704
Branches 37148 36593 -555
==========================================
- Hits 106653 105164 -1489
+ Misses 53388 53172 -216
- Partials 2065 2066 +1
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
dosubot
Bot
added
authentication:sso
![codeant-ai-for-open-source[bot]](https://avatars.githubusercontent.com/u/151810221?s=60&v=4){kind=small}
| return self.response_404() | ||
|
|
||
| @expose("/oauth2/", methods=["GET"]) | ||
| @statsd_metrics |
There was a problem hiding this comment.
Suggestion: The newly added statsd_metrics wrapper emits the failure counter from its exception handler without protecting self.incr_stats(...). If the configured StatsD client fails while recording an OAuth2 error, that secondary exception replaces the original callback failure and can change the response and traceback presented to the client. Make metric emission best-effort so observability failures cannot mask the OAuth2 exception. [error handling]
Severity Level: Minor 🧹
- ❌ OAuth2 failure responses can expose a StatsD error instead.
- ⚠️ Original token-exchange diagnostics can be lost.
- ⚠️ Callback error handling depends on StatsD availability.
(Use Cmd/Ctrl + Click for best experience)
Prompt for AI Agent 🤖
This is a comment left during a code review.
**Path:** superset/databases/api.py
**Line:** 1457:1457
**Comment:**
*Error Handling: The newly added `statsd_metrics` wrapper emits the failure counter from its exception handler without protecting `self.incr_stats(...)`. If the configured StatsD client fails while recording an OAuth2 error, that secondary exception replaces the original callback failure and can change the response and traceback presented to the client. Make metric emission best-effort so observability failures cannot mask the OAuth2 exception.
Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.
Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix
dosubot
Bot
added
change:backend
Code Review Agent Run #8ea754Actionable Suggestions - 0Review Details
Bito Usage GuideCommands Type the following command in the pull request comment and save the comment.
Refer to the documentation for additional commands. Configuration This repository uses Documentation & Help AI Code Review powered by |
✅ Deploy Preview for superset-docs-preview ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Code Review Agent Run #d5dd55Actionable Suggestions - 0Filtered by Review RulesBito filtered these suggestions based on rules created automatically for your feedback. Manage rules.
Review Details
Bito Usage GuideCommands Type the following command in the pull request comment and save the comment.
Refer to the documentation for additional commands. Configuration This repository uses Documentation & Help AI Code Review powered by |
3 participants
SUMMARY
Why
OAuth2 database token exchange and refresh failures lacked queryable context, and the callback emitted an outcome-neutral event metric that did not represent failures. Provider exception details and callback request metadata also needed an end-to-end redaction boundary.
What
database_id, canonical engine, and exception type while excluding OAuth codes, tokens, exception text, and provider payloads.DatabaseRestApi.oauth2.success,.warning, or.erroris emitted after transaction completion.Last hourpremise is otherwise false.Blast radius
Limited to OAuth2 database token exchange/refresh error handling and callback observability. Success-path token persistence remains unchanged. Provider exceptions crossing the OAuth2 boundary are intentionally replaced with sanitized OAuth2 domain exceptions; OAuth-specific refresh failures still trigger token cleanup and re-authentication.
BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
Not applicable; this is backend observability and error-handling work.
TESTING INSTRUCTIONS
Results:
pre-commit run --all-fileswas also attempted. Backend checks passed, but this worktree's frontend custom-rule hook cannot load the uninstalledglobpackage; the repository-wide formatter and Ruff hooks also report unrelated files outside this PR.RISK & ROLLBACK
Low-to-moderate risk: the success path is unchanged, but failure paths now expose only sanitized OAuth2 domain exceptions, and event logging runs after the token transaction. Revert
abe3bcad8fto restore the prior OAuth2 failure-path behavior. Reverta79b4d9c6findependently to remove the inherited time-dependent test stabilization.REVIEW GUIDANCE
Please focus on:
ADDITIONAL INFORMATION
DatabaseRestApi.oauth2counter with outcome-qualified counters documented inUPDATING.md.