[betodealmeida]

SUMMARY

Adds support for per-user OAuth2 authentication in Semantic Layer extensions.

With this PR, extensions can now store access and refresh tokens in encrypted, user-scoped storage that is unavailable through browser-facing extension storage APIs. Tokens remain scoped to the user who authorized access.

Semantic Layer extensions reuse Superset’s existing OAuth2 error handling and authorization UI. Authorization can be triggered from configuration dialogs, Explore, and dashboard queries. Completing authorization retries the interrupted operation. Semantic view metadata loading can require authentication before Explore renders, so that path displays the authorization prompt before loading the editor.

The change also preserves user identity in asynchronous query execution and partitions authenticated semantic-view caches by user.

A database migration adds the storage access classification. Downgrading permanently deletes backend-only secrets to prevent them from becoming browser-accessible; this behavior is documented in UPDATING.md.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

Before: opening a semantic-view chart without credentials could show a permission error and “Missing datasource,” with no way to authorize access.

After: Superset displays an OAuth2 authorization link and reloads the chart after authorization completes.

Note that the behavior in Explore is slightly different with semantic views compared to datasets: with a dataset that needs OAuth2, Explore will render with metrics/columns/controls, but the dataset component will ask for auth. For semantic views, Explore doesn't know what metrics and columns exist until the user authenticates, since that information lives in the semantic layer, not in Superset. Because of this, the whole Explore UI is replaced by the authentication prompt.

TESTING INSTRUCTIONS

I wrote the specification for a generic RESTful semantic layer API at https://github.com/betodealmeida/sl-rest-api. The API is a 1:1 mapping of the Superset semantic layer Python API to JSON requests. In addition to the spec itself, the repo has:

1. A simple server implementing the API and exposing Pandas dataframes as semantic views.
2. A Superset DB engine spec.
3. A Superset semantic layer extension.

I'm also in the process of implementing the API in DataJunction, so that Superset can be used with it: DataJunction/dj#2661

A simple way of testing this PR:

1. Run the server from the repo above:

% SEMANTIC_LAYER_REQUIRE_AUTH=1 semantic-api

2. Build the extension from the repo above and install it in Superset.
3. Add a new semantic layer connection. First fill in the values:

• API URL: http://host.docker.internal:8002
• Authentication: OAuth2
• Client ID: demo-client
• Client secret: demo-secret
• Authorization URL: http://localhost:8002/authorize
• Token URL: http://host.docker.internal:8002/token

4. Then click the "Connect account" in the dialog to trigger OAuth2.
5. Add a semantic view and create a chart.
6. Login as a different user and try to view the chart.

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

[netlify]

✅ Deploy Preview for superset-docs-preview ready!

Name	Link
🔨 Latest commit	5d41d7f
🔍 Latest deploy log	https://app.netlify.com/projects/superset-docs-preview/deploys/6ae4fae71abc09edba1b6e5e
😎 Deploy Preview	https://deploy-preview-45894--superset-docs-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[codecov]

Codecov Report

❌ Patch coverage is 52.64798% with 304 lines in your changes missing coverage. Please review.
✅ Project coverage is 65.61%. Comparing base (e33b7d9) to head (0d0d7a3).
⚠️ Report is 9 commits behind head on master.

Files with missing lines	Patch %	Lines
superset/semantic_layers/api.py	24.41%	130 Missing ⚠️
superset/semantic_layers/registry.py	33.67%	65 Missing ⚠️
superset/extensions/storage/persistent_dao.py	28.57%	15 Missing ⚠️
...src/features/semanticLayers/SemanticLayerModal.tsx	78.46%	14 Missing ⚠️
superset/utils/encrypt.py	12.50%	14 Missing ⚠️
superset/core/api/core_api_injection.py	42.85%	12 Missing ⚠️
superset/semantic_layers/oauth2.py	45.45%	12 Missing ⚠️
superset/extensions/storage/secrets.py	65.38%	9 Missing ⚠️
superset/extensions/context.py	58.33%	5 Missing ⚠️
...rc/features/semanticViews/AddSemanticViewModal.tsx	89.47%	4 Missing ⚠️
... and 11 more

❗ There is a different number of reports uploaded between BASE (e33b7d9) and HEAD (0d0d7a3). Click for more details.

HEAD has 3 uploads less than BASE

Flag	BASE (e33b7d9)	HEAD (0d0d7a3)
python	7	5
postgres	2	1

Additional details and impacted files

@@             Coverage Diff             @@
##           master   #45894       +/-   ##
===========================================
- Coverage   84.73%   65.61%   -19.12%     
===========================================
  Files        3069     3072        +3     
  Lines      205767   206332      +565     
  Branches    48388    48508      +120     
===========================================
- Hits       174350   135381    -38969     
- Misses      28123    67872    +39749     
+ Partials     3294     3079      -215     

Flag	Coverage Δ
hive	34.49% <33.01%> (-0.01%)	⬇️
javascript	81.01% <90.82%> (+0.02%)	⬆️
mysql	52.53% <33.01%> (-0.08%)	⬇️
postgres	52.53% <33.01%> (-0.08%)	⬇️
presto	36.22% <33.01%> (-0.02%)	⬇️
python	52.81% <33.01%> (-34.96%)	⬇️
sqlite	52.30% <33.01%> (-0.07%)	⬇️
unit	?

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.