fix: oauth2 trino

[aurokk]

fix(trino): compare only error code for oauth2 auth

SUMMARY

I guess this message "invalid credentials" is specific for google oauth2 server (or the one that was used to develop the feature), there is a (link) I found that makes me think so. With the change applied it started to work good with identity server 4, and I guess this comparison makes it impossible for people to use oauth2 right now, for example here.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

This is how it looks with the change applied.

TESTING INSTRUCTIONS

There is an example of how I configured oauth2 for trino.
P.S.: I didn't copy other configuration except for the part need to make oauth work.

configOverrides:
  enable_oauth: |
    DATABASE_OAUTH2_REDIRECT_URI = "https://{hostname}/api/v1/database/oauth2/"
    DATABASE_OAUTH2_CLIENTS = {
      "Trino": {
        "id": "trino",
        "secret": os.getenv("SUPERSET_OAUTH_CLIENT_SECRET"),
        "scope": "openid email profile offline_access trino",
        "redirect_uri": "https://{hostname}/api/v1/database/oauth2/",
        "authorization_request_uri": "https://{hostname}/connect/authorize",
        "token_request_uri": "https://{hostname}/connect/token"
      }
    }

ADDITIONAL INFORMATION

• Has associated issue:
• Required feature flags:
• Changes UI
• Includes DB Migration (follow approval process in [SIP-59] Proposal for Database migration standards #13351)
  • Migration is atomic, supports rollback & is backwards-compatible
  • Confirm DB migration upgrade and downgrade tested
  • Runtime estimates and downtime expectations provided
• Introduces new feature or API
• Removes existing feature or API
• Fixes feat(oauth2): add support for trino #30081

[korbit-ai]

Review by Korbit AI

Korbit automatically attempts to detect when you fix issues in new commits.

Category	Issue	Fix Detected
	Weak Authentication Error Detection ▹ view

Files scanned

​

File Path	Reviewed
superset/db_engine_specs/trino.py	✅

Explore our documentation to understand the languages and file types we support and the files we ignore.

Need a new review? Comment /korbit-review on this PR and I'll review your latest changes.

Korbit Guide: Usage and Customization

Interacting with Korbit

• You can manually ask Korbit to review your PR using the /korbit-review command in a comment at the root of your PR.
• You can ask Korbit to generate a new PR description using the /korbit-generate-pr-description command in any comment on your PR.
• Too many Korbit comments? I can resolve all my comment threads if you use the /korbit-resolve command in any comment on your PR.
• Chat with Korbit on issues we post by tagging @korbit-ai in your reply.
• Help train Korbit to improve your reviews by giving a 👍 or 👎 on the comments Korbit posts.

Customizing Korbit

• Check out our docs on how you can make Korbit work best for you and your team.
• Customize Korbit for your organization through the Korbit Console.

Current Korbit Configuration

General Settings

​

Setting	Value
Review Schedule	Automatic excluding drafts
Max Issue Count	10
Automatic PR Descriptions	❌

Issue Categories

​

Category	Enabled
Naming	✅
Database Operations	✅
Documentation	✅
Logging	✅
Error Handling	✅
Systems and Environment	✅
Objects and Data Structures	✅
Readability and Maintainability	✅
Asynchronous Processing	✅
Design Patterns	✅
Third-Party Libraries	✅
Performance	✅
Security	✅
Functionality	✅

Feedback and Support

• Tell us what you think of Korbit
• Schedule a call with our team
• Email us @ support@korbit.ai

Note

Korbit Pro is free for open source projects 🎉

Looking to add Korbit to your team? Get started with a free 2 week trial here

[korbit-ai]

Weak Authentication Error Detection

Tell me more

What is the issue?

The authentication error check is overly permissive by only checking for 'error 401' in the error message.

Why this matters

This loose string matching could lead to false positives in authentication error detection, potentially causing security misclassifications that affect the authentication flow.

Suggested change ∙ Feature Preview

return isinstance(instance, HttpError) and "error 401: b'Invalid credentials'" in str(instance)

_{💡 Does this comment miss the mark? Tell us why and Korbit will adapt to your team’s feedback.
💬 Chat with Korbit by mentioning @korbit-ai.}

[aurokk]

It is overly specific & restrictive. Check for 401 is enough i guess.

[github-actions]

Congrats on making your first PR and thank you for contributing to Superset! 🎉 ❤️

We hope to see you in our Slack community too! Not signed up? Use our Slack App to self-register.

[codecov]

Codecov Report

❌ Patch coverage is 0% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 83.35%. Comparing base (76d897e) to head (62d9414).
⚠️ Report is 2203 commits behind head on master.

Files with missing lines	Patch %	Lines
superset/db_engine_specs/trino.py	0.00%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff             @@
##           master   #31993       +/-   ##
===========================================
+ Coverage   60.48%   83.35%   +22.86%     
===========================================
  Files        1931      544     -1387     
  Lines       76236    38983    -37253     
  Branches     8568        0     -8568     
===========================================
- Hits        46114    32494    -13620     
+ Misses      28017     6489    -21528     
+ Partials     2105        0     -2105     

Flag	Coverage Δ
hive	48.26% <0.00%> (-0.89%)	⬇️
javascript	?
mysql	74.71% <0.00%> (?)
postgres	74.73% <0.00%> (?)
presto	51.87% <0.00%> (-1.94%)	⬇️
python	83.25% <0.00%> (+19.74%)	⬆️
sqlite	74.16% <0.00%> (?)
unit	60.76% <0.00%> (+3.13%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[aurokk]

@betodealmeida @nytai, hello! what do you think about the change? i don't really think we need to check anything except for the status code to make it work correctly. i can do some changes if needed, lets discuss it.

[betodealmeida]

This looks good, and it makes sense to be more lenient. Thanks for the PR!