[betodealmeida]

SUMMARY

Adds support for per-user OAuth2 authentication in Semantic Layer extensions.

With this PR, extensions can now store access and refresh tokens in encrypted, user-scoped storage that is unavailable through browser-facing extension storage APIs. Tokens remain scoped to the user who authorized access.

Semantic Layer extensions reuse Superset’s existing OAuth2 error handling and authorization UI. Authorization can be triggered from configuration dialogs, Explore, and dashboard queries. Completing authorization retries the interrupted operation. Semantic view metadata loading can require authentication before Explore renders, so that path displays the authorization prompt before loading the editor.

The change also preserves user identity in asynchronous query execution and partitions authenticated semantic-view caches by user.

A database migration adds the storage access classification. Downgrading permanently deletes backend-only secrets to prevent them from becoming browser-accessible; this behavior is documented in UPDATING.md.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

Before: opening a semantic-view chart without credentials could show a permission error and “Missing datasource,” with no way to authorize access.

After: Superset displays an OAuth2 authorization link and reloads the chart after authorization completes.

Note that the behavior in Explore is slightly different with semantic views compared to datasets: with a dataset that needs OAuth2, Explore will render with metrics/columns/controls, but the dataset component will ask for auth. For semantic views, Explore doesn't know what metrics and columns exist until the user authenticates, since that information lives in the semantic layer, not in Superset. Because of this, the whole Explore UI is replaced by the authentication prompt.

TESTING INSTRUCTIONS

I wrote the specification for a generic RESTful semantic layer API at https://github.com/betodealmeida/sl-rest-api. The API is a 1:1 mapping of the Superset semantic layer Python API to JSON requests. In addition to the spec itself, the repo has:

1. A simple server implementing the API and exposing Pandas dataframes as semantic views.
2. A Superset DB engine spec.
3. A Superset semantic layer extension.

I'm also in the process of implementing the API in DataJunction, so that Superset can be used with it: DataJunction/dj#2661

A simple way of testing this PR:

1. Run the server from the repo above:

% SEMANTIC_LAYER_REQUIRE_AUTH=1 semantic-api

2. Build the extension from the repo above and install it in Superset.
3. Add a new semantic layer connection. First fill in the values:

• API URL: http://host.docker.internal:8002
• Authentication: OAuth2
• Client ID: demo-client
• Client secret: demo-secret
• Authorization URL: http://localhost:8002/authorize
• Token URL: http://host.docker.internal:8002/token

4. Then click the "Connect account" in the dialog to trigger OAuth2.
5. Add a semantic view and create a chart.
6. Login as a different user and try to view the chart.

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in SIP-59)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API

[netlify]

✅ Deploy Preview for superset-docs-preview ready!

Name	Link
🔨 Latest commit	78ac767
🔍 Latest deploy log	https://app.netlify.com/projects/superset-docs-preview/deploys/6aeb544b77faeddcaed390f0
😎 Deploy Preview	https://deploy-preview-45894--superset-docs-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[codecov]

Codecov Report

❌ Patch coverage is 96.79666% with 23 lines in your changes missing coverage. Please review.
✅ Project coverage is 85.03%. Comparing base (59ccad0) to head (78ac767).
⚠️ Report is 1 commits behind head on master.

Files with missing lines	Patch %	Lines
...src/features/semanticLayers/SemanticLayerModal.tsx	79.71%	14 Missing ⚠️
superset/extensions/storage/persistent_dao.py	87.50%	2 Missing and 2 partials ⚠️
.../components/ErrorMessage/OAuth2RedirectMessage.tsx	95.83%	1 Missing ⚠️
superset-frontend/src/pages/Chart/index.tsx	94.73%	1 Missing ⚠️
superset/core/api/core_api_injection.py	95.23%	1 Missing ⚠️
superset/datasource/api.py	87.50%	0 Missing and 1 partial ⚠️
superset/utils/encrypt.py	93.75%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #45894      +/-   ##
==========================================
+ Coverage   84.99%   85.03%   +0.04%     
==========================================
  Files        3079     3082       +3     
  Lines      209006   209578     +572     
  Branches    49234    49348     +114     
==========================================
+ Hits       177635   178214     +579     
+ Misses      27988    27977      -11     
- Partials     3383     3387       +4     

Flag	Coverage Δ
hive	34.19% <31.80%> (-0.02%)	⬇️
javascript	81.31% <93.82%> (+0.02%)	⬆️
mysql	51.97% <32.46%> (-0.07%)	⬇️
postgres	51.98% <32.46%> (-0.07%)	⬇️
presto	35.84% <31.80%> (-0.02%)	⬇️
python	88.00% <98.47%> (+0.05%)	⬆️
sqlite	51.73% <32.46%> (-0.07%)	⬇️
unit	82.95% <98.47%> (+0.08%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[betodealmeida]

@michael-s-molina can you take a look when you have the chance? Thanks!