fix(config): make Swagger UI opt-in (off by default) by rusackas · Pull Request #41300 · apache/superset

rusackas · 2026-06-23T00:36:32Z

SUMMARY

FAB_API_SWAGGER_UI was hardcoded to True in the base configuration, so Flask-AppBuilder registered the interactive Swagger UI and OpenAPI spec endpoints (e.g. /swagger/v1) by default in every deployment that inherits the base config.

This makes the documentation surface opt-in: FAB_API_SWAGGER_UI is now driven by the SUPERSET_ENABLE_SWAGGER_UI environment variable and defaults to off. The bundled Docker development environment sets SUPERSET_ENABLE_SWAGGER_UI=true, so local development behavior is unchanged; production deployments are documentation-off by default and can opt in via the env var or by overriding FAB_API_SWAGGER_UI in superset_config.py.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

N/A — configuration default change.

TESTING INSTRUCTIONS

Unit test added in tests/unit_tests/config_swagger_ui_test.py asserting the env-driven default (off when unset, on when SUPERSET_ENABLE_SWAGGER_UI=true).

Run: pytest tests/unit_tests/config_swagger_ui_test.py

Manual: with the env var unset, /swagger/v1 is not registered; with SUPERSET_ENABLE_SWAGGER_UI=true it is.

ADDITIONAL INFORMATION

Has associated issue:
Required feature flags:
Changes UI
Includes DB Migration (follow approval process in SIP-59)
- Migration is atomic, supports rollback & is backwards-compatible
- Confirm DB migration upgrade and downgrade tested
- Runtime estimates and downtime expectations provided
Introduces new feature or API
Removes existing feature or API

Note: this changes a default (Swagger UI off by default); documented in UPDATING.md.

bito-code-review · 2026-06-23T00:36:41Z

Code Review Agent Run #8bb57a

Actionable Suggestions - 0

Filtered by Review Rules

Bito filtered these suggestions based on rules created automatically for your feedback. Manage rules.

tests/unit_tests/config_swagger_ui_test.py - 1
- Incomplete truthy test cases · Line 26-32

Review Details

Files reviewed - 3 · Commit Range: ceceb0e..ceceb0e
- docker/.env
- superset/config.py
- tests/unit_tests/config_swagger_ui_test.py
Files skipped - 1
- UPDATING.md - Reason: Filter setting
Tools
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers a full AI review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

bito-code-review · 2026-06-23T00:38:18Z

The suggestion to add type annotations to the new test function is correct, as it improves code maintainability and adheres to the project's typing standards. You can resolve this by updating the function signature in tests/unit_tests/config_swagger_ui_test.py as follows:

from typing import Any

@pytest.mark.parametrize(
    "env_value, expected",
    [
        (None, False),
        ("true", True),
        ("True", True),
        ("false", False),
        ("", False),
    ],
)
def test_fab_api_swagger_ui_is_env_driven_and_off_by_default(
    monkeypatch: pytest.MonkeyPatch, env_value: str | None, expected: bool
) -> None:

There are no other comments on this pull request to address. Would you like me to assist with anything else?

tests/unit_tests/config_swagger_ui_test.py

from typing import Any

@pytest.mark.parametrize(
    "env_value, expected",
    [
        (None, False),
        ("true", True),
        ("True", True),
        ("false", False),
        ("", False),
    ],
)
def test_fab_api_swagger_ui_is_env_driven_and_off_by_default(
    monkeypatch: pytest.MonkeyPatch, env_value: str | None, expected: bool
) -> None:

codecov · 2026-06-23T00:41:30Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 64.35%. Comparing base (5916ec4) to head (622a53d).

Additional details and impacted files

@@           Coverage Diff           @@
##           master   #41300   +/-   ##
=======================================
  Coverage   64.35%   64.35%           
=======================================
  Files        2653     2653           
  Lines      144952   144952           
  Branches    33433    33433           
=======================================
  Hits        93288    93288           
  Misses      49978    49978           
  Partials     1686     1686

Flag	Coverage Δ
hive	`39.27% <100.00%> (ø)`
mysql	`58.00% <100.00%> (ø)`
postgres	`58.06% <100.00%> (ø)`
presto	`40.86% <100.00%> (ø)`
python	`59.50% <100.00%> (ø)`
sqlite	`57.72% <100.00%> (ø)`
unit	`100.00% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

FAB_API_SWAGGER_UI was hardcoded to True in the base config, so the interactive Swagger UI / OpenAPI spec endpoints were exposed by default in every deployment that inherits it. Make it environment-driven and default it off so the API documentation surface is opt-in. Enable via SUPERSET_ENABLE_SWAGGER_UI=true (set in the Docker development env so local DX is unchanged) or by overriding FAB_API_SWAGGER_UI in superset_config.py. Adds a unit test for the env-driven default and documents the change in UPDATING.md. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

…onfig The previous unit test reloaded superset.config in-process, mutating the shared config module and cascading failures into unrelated unit tests. Evaluate the env-driven default in a fresh subprocess instead, so no global state is mutated. Also enable FAB_API_SWAGGER_UI in the integration test config so the /api/v1/_openapi spec endpoint remains available to the OpenAPI-spec tests now that Swagger is opt-in (off) by default. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

test_csrf_exempt_blueprints expects the OpenApi blueprint in the exempt set, but it is only registered when FAB_API_SWAGGER_UI is enabled — now opt-in (off by default). Enable it in the test's app config so the OpenApi blueprint is registered; the test exercises CSRF exemption, not the Swagger default. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Add docstrings to the helper and test, strip config-path env vars from the subprocess, and read only the final stdout line so banner output from local config loading can't taint the result. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bito-code-review · 2026-06-23T07:24:55Z

Code Review Agent Run #0bfe32

Actionable Suggestions - 0

Review Details

Files reviewed - 5 · Commit Range: f392207..622a53d
- docker/.env
- superset/config.py
- tests/integration_tests/superset_test_config.py
- tests/unit_tests/config_swagger_ui_test.py
- tests/unit_tests/security/api_test.py
Files skipped - 1
- UPDATING.md - Reason: Filter setting
Tools
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers a full AI review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

rusackas added the asvs label Jun 23, 2026

rusackas requested review from dpgaspar, hainenber, sadpandajoe and sha174n June 23, 2026 00:36

pull-request-size Bot added the size/M label Jun 23, 2026

dosubot Bot added the install:config Installation - Configuration settings label Jun 23, 2026

codeant-ai-for-open-source Bot reviewed Jun 23, 2026

View reviewed changes

Comment thread tests/unit_tests/config_swagger_ui_test.py Outdated

codeant-ai-for-open-source Bot reviewed Jun 23, 2026

View reviewed changes

Comment thread tests/unit_tests/config_swagger_ui_test.py Outdated

rusackas force-pushed the fix/swagger-ui-opt-in branch from ceceb0e to f392207 Compare June 23, 2026 04:06

rusackas and others added 2 commits June 22, 2026 21:08

test(config): type-annotate swagger test, restore env on teardown

0bf6921

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

codeant-ai-for-open-source Bot reviewed Jun 23, 2026

View reviewed changes

Comment thread tests/unit_tests/config_swagger_ui_test.py Outdated

Comment thread tests/unit_tests/config_swagger_ui_test.py

codeant-ai-for-open-source Bot reviewed Jun 23, 2026

View reviewed changes

Comment thread tests/unit_tests/config_swagger_ui_test.py

aminghadersohi and others added 2 commits June 22, 2026 22:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(config): make Swagger UI opt-in (off by default)#41300

fix(config): make Swagger UI opt-in (off by default)#41300
rusackas wants to merge 5 commits into
masterfrom
fix/swagger-ui-opt-in

rusackas commented Jun 23, 2026

Uh oh!

bito-code-review Bot commented Jun 23, 2026 •

edited

Loading

Code Review Agent Run #8bb57a

Uh oh!

Uh oh!

bito-code-review Bot commented Jun 23, 2026

Uh oh!

codecov Bot commented Jun 23, 2026 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bito-code-review Bot commented Jun 23, 2026 •

edited

Loading

Code Review Agent Run #0bfe32

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

rusackas commented Jun 23, 2026

SUMMARY

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

Uh oh!

bito-code-review Bot commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #8bb57a

Uh oh!

Uh oh!

bito-code-review Bot commented Jun 23, 2026

Uh oh!

codecov Bot commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bito-code-review Bot commented Jun 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #0bfe32

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

bito-code-review Bot commented Jun 23, 2026 •

edited

Loading

codecov Bot commented Jun 23, 2026 •

edited

Loading

bito-code-review Bot commented Jun 23, 2026 •

edited

Loading