Merge branch 'master' into cs/SC-3473-user-roles-from-hq

README.md

@@ -152,6 +152,15 @@ The test runner can only run tests that do not import from Superset. The
 code you want to test will need to be in a module whose dependencies
 don't include Superset.
 
+### Testing on staging
+In order to test your feature branch on staging you need to
+1. Check out to `master` branch (make sure it's up to date)
+2. Add your feature branch to the `branches` section in `scripts/staging.yml` file
+3. Push the file back to remote `master`
+4. Run `scripts/rebuildstaging` (this will rebuild the staging branch on your machine)
+5. Push the new `staging` branch to remote
+6. Deploy `staging` as usual
+
 
 ### Creating a migration
 

apache-superset.md

@@ -1,7 +1,7 @@
 Dimagi Superset Fork
 --------------------
 
-[Dimagi Superset](https://github.com/dimagi/hq_superset) is a fork of
+[Dimagi Superset](https://github.com/dimagi/superset) is a fork of
 [Apache Superset](https://github.com/apache/superset). Dimagi Superset
 is maintained to build a slightly customized version of the
 [Apache Superset PyPI package](https://pypi.org/project/apache-superset/).
@@ -17,7 +17,7 @@ very complicated or impossible to do inside HQ Superset.
 
 In this spirit, 
 - if the change is specific to CommCare HQ, try to implement the
-  customization in [HQ Superset](https://github.com/dimagi/hq_superset).
+  customization in [Commcare Analytics](https://github.com/dimagi/hq_superset).
 - If the change is not specific to CommCare HQ and is useful to outside
   users, try to create a pull request against the upstream
   [Apache Superset](https://github.com/apache/superset) repo.
@@ -289,6 +289,10 @@ the build instructions have remained the same before proceeding.
   cd superset-frontend/
   npm ci && npm run build
   ```
+
+> Note: If you see a warning/error for npm and node versions, you can use a tool like
+[nvm](https://github.com/nvm-sh/nvm) to install and use the correct version.
+
 - Build translations
   ```
   cd ../
@@ -306,7 +310,23 @@ the build instructions have remained the same before proceeding.
   ```
   twine upload dist/apache-superset-${latest-dimagi-version}.tar.gz
   ```
-  You can refer to 1Password for the PyPI credentials.
+  You can refer to 1Password for the PyPI API token for dimagi-superset.
 
 You should now be able to use this package inside
 https://github.com/dimagi/hq_superset by referring to the release tag.
+
+> Note:
+> 
+> * PyPI package follows the versioning scheme as described
+>   [here](https://packaging.python.org/en/latest/discussions/versioning/).
+>   We make any initial customizations on top of Apache upstream version
+>   and then make a release to PyPI with the same version number. e.g.
+>   customizations were made on the upstream version `3.1.0` and this
+>   was released to dimagi-superset PyPI as `3.1.0`.
+>
+> * If any additional customizations are needed on top of initial
+>   versions, we are using the post release for numbering i.e.
+>   `.post<>` as the suffix with N as an incrementing integer. It is
+>   acknowledged that using the post release is not the best way,
+>   however it was chosen to keep the version in sync with the upstream
+>   apache-superset version.

hq_superset/oauth2_server.py

@@ -24,7 +24,7 @@ def save_token(token: dict, request: FlaskOAuth2Request) -> None:
         token_type=token['token_type'],
         access_token=token['access_token'],
         scope=client.domain,
-        expires_in=10, # 10 Seconds
+        expires_in=token['expires_in']
     )
     db.session.add(token)
     db.session.commit()

scripts/rebuildstaging

@@ -0,0 +1,8 @@
+#!/bin/bash
+
+function rebuildstaging() {
+    echo "Rebuilding staging branch..."
+    git-build-branch scripts/staging.yml
+}
+
+rebuildstaging

scripts/staging.yml

@@ -0,0 +1,10 @@
+# This file is used to keep track of which feature branches
+# should be in the `staging` branch.
+# How it works:
+# 1. Add your feature branch to the end of the list
+# 2. Run ./scripts/rebuildstaging to rebuild the `staging` branch
+# 3. Push the `staging` branch and deploy the code (this is a manual process at the moment)
+trunk: master
+name: staging
+branches:
+  - cs/SC-3473-user-roles-from-hq

setup.py

@@ -2,7 +2,7 @@
 
 setup(
     name='hq_superset',
-    version='0.3.5',
+    version='0.3.7',
     description='CommCare HQ Superset Integration',
     license='Apache2',
     author='Dimagi Inc.',
@@ -11,7 +11,7 @@
     packages=find_packages(exclude=['docs', 'tests']),
     include_package_data=True,
     install_requires=[
-        'dimagi-superset==3.1.0',
+        'dimagi-superset==3.1.0.post1',
         # Dependencies based on Superset 3.1.0 where applicable
         'Authlib==1.3.0',
         'celery==5.2.7',
@@ -23,6 +23,11 @@
         'Werkzeug==2.3.3',
         'WTForms==2.3.3',
     ],
+    extras_require={
+        'dev': [
+            'git-build-branch',
+        ],
+    },
     classifiers=[
         'Programming Language :: Python',
         'Programming Language :: Python :: 3.9'

superset_config.example.py

@@ -63,6 +63,12 @@
     }
 ]
 
+# override expiry time for a specific grant type by
+# setting this config
+OAUTH2_TOKEN_EXPIRES_IN = {
+    # 'client_credentials': 3600  # seconds
+}
+
 # Will allow user self registration, allowing to create Flask users from
 # Authorized User
 AUTH_USER_REGISTRATION = True
@@ -141,3 +147,36 @@ class CeleryConfig:
 # CommCare Analytics extensions
 FLASK_APP_MUTATOR = flask_app_mutator
 CUSTOM_SECURITY_MANAGER = oauth.CommCareSecurityManager
+
+TALISMAN_CONFIG = {
+    "content_security_policy": {
+        "base-uri": ["'self'"],
+        "default-src": ["'self'"],
+        "img-src": [
+            "'self'",
+            "blob:",
+            "data:",
+            "https://apachesuperset.gateway.scarf.sh",
+            "https://static.scarf.sh/",
+            "*",
+        ],
+        "worker-src": ["'self'", "blob:"],
+        "connect-src": [
+            "'self'",
+            "https://api.mapbox.com",
+            "https://events.mapbox.com",
+        ],
+        "object-src": "'none'",
+        "style-src": [
+            "'self'",
+            "'unsafe-inline'",
+            "https://fonts.googleapis.com",
+        ],
+        "font-src": ["'self'", "https://fonts.gstatic.com"],
+        "script-src": ["'self'", "'unsafe-eval'"],
+    },
+    "content_security_policy_nonce_in": ["script-src"],
+    "force_https": False,
+    "session_cookie_secure": False,
+}
+