feat(semantic-layer): support per-user OAuth2 authentication by betodealmeida · Pull Request #45894 · apache/superset

betodealmeida · 2026-10-30T17:17:36Z

SUMMARY

Adds support for per-user OAuth2 authentication in Semantic Layer extensions.

With this PR, extensions can now store access and refresh tokens in encrypted, user-scoped storage that is unavailable through browser-facing extension storage APIs. Tokens remain scoped to the user who authorized access.

Semantic Layer extensions reuse Superset’s existing OAuth2 error handling and authorization UI. Authorization can be triggered from configuration dialogs, Explore, and dashboard queries. Completing authorization retries the interrupted operation. Semantic view metadata loading can require authentication before Explore renders, so that path displays the authorization prompt before loading the editor.

The change also preserves user identity in asynchronous query execution and partitions authenticated semantic-view caches by user.

A database migration adds the storage access classification. Downgrading permanently deletes backend-only secrets to prevent them from becoming browser-accessible; this behavior is documented in UPDATING.md.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

Before: opening a semantic-view chart without credentials could show a permission error and “Missing datasource,” with no way to authorize access.

After: Superset displays an OAuth2 authorization link and reloads the chart after authorization completes.

Note that the behavior in Explore is slightly different with semantic views compared to datasets: with a dataset that needs OAuth2, Explore will render with metrics/columns/controls, but the dataset component will ask for auth. For semantic views, Explore doesn't know what metrics and columns exist until the user authenticates, since that information lives in the semantic layer, not in Superset. Because of this, the whole Explore UI is replaced by the authentication prompt.

TESTING INSTRUCTIONS

I wrote the specification for a generic RESTful semantic layer API at https://github.com/betodealmeida/sl-rest-api. The API is a 1:1 mapping of the Superset semantic layer Python API to JSON requests. In addition to the spec itself, the repo has:

A simple server implementing the API and exposing Pandas dataframes as semantic views.
A Superset DB engine spec.
A Superset semantic layer extension.

I'm also in the process of implementing the API in DataJunction, so that Superset can be used with it: DataJunction/dj#2661

A simple way of testing this PR:

Run the server from the repo above:

% SEMANTIC_LAYER_REQUIRE_AUTH=1 semantic-api

Build the extension from the repo above and install it in Superset.
Add a new semantic layer connection. First fill in the values:

API URL: http://host.docker.internal:8002
Authentication: OAuth2
Client ID: demo-client
Client secret: demo-secret
Authorization URL: http://localhost:8002/authorize
Token URL: http://host.docker.internal:8002/token

Then click the "Connect account" in the dialog to trigger OAuth2.
Add a semantic view and create a chart.
Login as a different user and try to view the chart.

ADDITIONAL INFORMATION

Has associated issue:
Required feature flags:
Changes UI
Includes DB Migration (follow approval process in SIP-59)
- Migration is atomic, supports rollback & is backwards-compatible
- Confirm DB migration upgrade and downgrade tested
- Runtime estimates and downtime expectations provided
Introduces new feature or API
Removes existing feature or API

netlify · 2026-10-30T18:14:01Z

✅ Deploy Preview for superset-docs-preview ready!

Name	Link
🔨 Latest commit	`5d41d7f`
🔍 Latest deploy log	https://app.netlify.com/projects/superset-docs-preview/deploys/6ae4fae71abc09edba1b6e5e
😎 Deploy Preview	https://deploy-preview-45894--superset-docs-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

codecov · 2026-10-30T20:42:14Z

Codecov Report

❌ Patch coverage is 52.64798% with 304 lines in your changes missing coverage. Please review.
✅ Project coverage is 65.61%. Comparing base (e33b7d9) to head (0d0d7a3).
⚠️ Report is 9 commits behind head on master.

Files with missing lines	Patch %	Lines
superset/semantic_layers/api.py	24.41%	130 Missing ⚠️
superset/semantic_layers/registry.py	33.67%	65 Missing ⚠️
superset/extensions/storage/persistent_dao.py	28.57%	15 Missing ⚠️
...src/features/semanticLayers/SemanticLayerModal.tsx	78.46%	14 Missing ⚠️
superset/utils/encrypt.py	12.50%	14 Missing ⚠️
superset/core/api/core_api_injection.py	42.85%	12 Missing ⚠️
superset/semantic_layers/oauth2.py	45.45%	12 Missing ⚠️
superset/extensions/storage/secrets.py	65.38%	9 Missing ⚠️
superset/extensions/context.py	58.33%	5 Missing ⚠️
...rc/features/semanticViews/AddSemanticViewModal.tsx	89.47%	4 Missing ⚠️
... and 11 more

❗ There is a different number of reports uploaded between BASE (e33b7d9) and HEAD (0d0d7a3). Click for more details.

HEAD has 3 uploads less than BASE

Flag BASE (e33b7d9) HEAD (0d0d7a3)

python 7 5

postgres 2 1

Additional details and impacted files

@@             Coverage Diff             @@
##           master   #45894       +/-   ##
===========================================
- Coverage   84.73%   65.61%   -19.12%     
===========================================
  Files        3069     3072        +3     
  Lines      205767   206332      +565     
  Branches    48388    48508      +120     
===========================================
- Hits       174350   135381    -38969     
- Misses      28123    67872    +39749     
+ Partials     3294     3079      -215

Flag	Coverage Δ
hive	`34.49% <33.01%> (-0.01%)`	⬇️
javascript	`81.01% <90.82%> (+0.02%)`	⬆️
mysql	`52.53% <33.01%> (-0.08%)`	⬇️
postgres	`52.53% <33.01%> (-0.08%)`	⬇️
presto	`36.22% <33.01%> (-0.02%)`	⬇️
python	`52.81% <33.01%> (-34.96%)`	⬇️
sqlite	`52.30% <33.01%> (-0.07%)`	⬇️
unit	`?`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

codeant-ai-for-open-source · 2026-10-31T14:10:36Z


        if isinstance(self._properties.get("configuration"), dict):
-            self._properties["configuration"] = _unmask_configuration(
+            self._properties["configuration"] = unmask_stored_configuration(


Suggestion: When a masked credential is nested, the helper misses it; this update can then save a changed destination with the real stored secret.

Assessment: 🔴 Critical · 🔁 Occurrence: Sometimes · 🏷️ Security

Prompt for AI Agent 🤖

This is a comment left during a code review. **Path:** superset/commands/semantic_layer/update.py **Line:** 233:233 **Comment:** *Security: When a masked credential is nested, the helper misses it; this update can then save a changed destination with the real stored secret. Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise. Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix

👍 | 👎

codeant-ai-for-open-source · 2026-10-31T14:11:39Z

    if (signal?.aborted || generation !== pollingGeneration) {
      throw new DOMException('Aborted', 'AbortError');
    }
+    if (queryError.errors?.length) throw { errors: queryError.errors };


Suggestion: waitForAsyncData is also used by self-contained charts, whose error handler drops this object’s errors; OAuth failures there become generic errors without an authorization prompt.

Assessment: 🟠 Major · 🔁 Occurrence: Sometimes · 🏷️ Api mismatch

Prompt for AI Agent 🤖

This is a comment left during a code review. **Path:** superset-frontend/src/middleware/asyncEvent.ts **Line:** 656:656 **Comment:** *Api Mismatch: `waitForAsyncData` is also used by self-contained charts, whose error handler drops this object’s `errors`; OAuth failures there become generic errors without an authorization prompt. Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise. Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix

👍 | 👎

codeant-ai-for-open-source · 2026-10-31T14:11:42Z

+          : saving ||
+            clearing ||
+            !name.trim() ||
+            hasErrors ||
+            requiredActionPending


Suggestion: refreshingSchema is omitted here, so Save remains enabled during dependent-schema discovery and can persist configuration before its dynamic fields are reconciled.

Assessment: 🟠 Major · 🔁 Occurrence: Sometimes · 🏷️ Incorrect condition logic

Prompt for AI Agent 🤖

This is a comment left during a code review. **Path:** superset-frontend/src/features/semanticLayers/SemanticLayerModal.tsx **Line:** 574:578 **Comment:** *Incorrect Condition Logic: `refreshingSchema` is omitted here, so Save remains enabled during dependent-schema discovery and can persist configuration before its dynamic fields are reconciled. Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise. Once fix is implemented, also check other comments on the same PR, and ask user if the user wants to fix the rest of the comments as well. if said yes, then fetch all the comments validate the correctness and implement a minimal fix

👍 | 👎

betodealmeida requested review from geido, michael-s-molina, msyavuz, rusackas, sadpandajoe and villebro as code owners October 30, 2026 17:17

pull-request-size Bot added the size/XXL label Oct 30, 2026

github-actions Bot added risk:db-migration PRs that require a DB migration api Related to the REST API doc Namespace | Anything related to documentation labels Oct 30, 2026

codeant-ai-for-open-source Bot reviewed Oct 30, 2026

View reviewed changes

Comment thread superset/core/api/core_api_injection.py Resolved

codeant-ai-for-open-source Bot reviewed Oct 30, 2026

View reviewed changes

Comment thread superset/extensions/storage/persistent_dao.py Resolved

codeant-ai-for-open-source Bot reviewed Oct 30, 2026

View reviewed changes

Comment thread superset-frontend/src/hooks/useOAuth2Completion.ts Resolved

betodealmeida added 5 commits October 30, 2026 13:32

WIP

ff1362a

Implement OAUTH2_REDIRECT and per-user cache

1cfbc41

Cleanup

c9cc6f2

Fix OAuth2

2585c25

fix(semantic-layer): integrate OAuth with updated provider bindings

76ee7e9

betodealmeida force-pushed the sl-oauth2 branch from 9a5af7e to 76ee7e9 Compare October 30, 2026 17:48

fix(extensions): preserve context and deferred OAuth completion

cae4cef

sadpandajoe reviewed Oct 30, 2026

View reviewed changes

Comment thread superset/semantic_layers/models.py Resolved

Comment thread superset/migrations/versions/2026-09-28_00-00_4c8f2a1d9b73_add_extension_storage_access.py Resolved

betodealmeida added 2 commits October 30, 2026 13:59

fix(semantic-layer): isolate filter values and verify storage migration

c92c399

docs(extensions): fix cross-plugin proxy configuration link

c12e6eb

chore(semantic-layer): refresh API spec and translation template

97a3143

github-actions Bot added the i18n Namespace | Anything related to localization label Oct 30, 2026

betodealmeida added 2 commits October 30, 2026 15:23

fix(semantic-layer): use guarded navigation for OAuth tabs

c0a149f

fix(semantic-layer): document OAuth endpoint response contracts

5d41d7f

test(semantic-layer): update user-scoped values cache expectation

0d0d7a3

github-actions Bot added the requires:rebase Requires rebasing on top of current master label Oct 31, 2026

test(semantic-layer): cover OAuth action endpoints and failure paths

61fde49

codeant-ai-for-open-source Bot reviewed Oct 31, 2026

View reviewed changes

Navigation Menu

Repository navigation

feat(semantic-layer): support per-user OAuth2 authentication - #45894

feat(semantic-layer): support per-user OAuth2 authentication#45894
betodealmeida wants to merge 13 commits into
masterfrom
sl-oauth2

betodealmeida commented Oct 30, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

netlify Bot commented Oct 30, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Oct 30, 2026 •

edited

Loading

Uh oh!

codeant-ai-for-open-source Bot Oct 31, 2026

Uh oh!

codeant-ai-for-open-source Bot Oct 31, 2026

Uh oh!

codeant-ai-for-open-source Bot Oct 31, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

betodealmeida commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

SUMMARY

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

netlify Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for superset-docs-preview ready!

Uh oh!

codecov Bot commented Oct 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

codeant-ai-for-open-source Bot Oct 31, 2026

Choose a reason for hiding this comment

Uh oh!

codeant-ai-for-open-source Bot Oct 31, 2026

Choose a reason for hiding this comment

Uh oh!

codeant-ai-for-open-source Bot Oct 31, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

betodealmeida commented Oct 30, 2026 •

edited

Loading

netlify Bot commented Oct 30, 2026 •

edited

Loading

codecov Bot commented Oct 30, 2026 •

edited

Loading