GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — fix: Unwrap SecretStr tokens when building Trino auth objects by AdityaPatil22 · Pull Request #6771 · feast-dev/feast

fix: Unwrap SecretStr tokens when building Trino auth objects #6771

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ntkathole merged 2 commits into feast-dev:master from AdityaPatil22:fix/trino-offline-store-failures
Sep 15, 2026

Uh oh!

There was an error while loading. Please reload this page.
Merged

fix: Unwrap SecretStr tokens when building Trino auth objects #6771

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
17a332c
fix: Unwrap SecretStr tokens when building Trino auth objects
AdityaPatil22 Aug 21, 2026
af4200b
test: Cover basic auth plain fields in Trino auth conversion
AdityaPatil22 Aug 24, 2026
File filter
Filter by extension
Clear filters
Conversations
Failed to load comments.
Loading

Uh oh!

There was an error while loading. Please reload this page.
Jump to
Jump to file
Failed to load files.
Loading

Uh oh!

There was an error while loading. Please reload this page.
Diff view
Diff view

There are no files selected for viewing

6 changes: 5 additions & 1 deletion 6 sdk/python/feast/infra/offline_stores/contrib/trino_offline_store/trino.py
Show comments
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,7 +127,11 @@ def to_trino_auth(self):

model_cls = CLASSES_BY_AUTH_TYPE[auth_type]["auth_model"]
model = model_cls(**self.config)
return trino_auth_cls(**model.model_dump())
kwargs = {
field: value.get_secret_value() if isinstance(value, SecretStr) else value
for field, value in model.model_dump().items()
}
return trino_auth_cls(**kwargs)


class TrinoOfflineStoreConfig(FeastConfigBaseModel):
Expand Down
75 changes: 75 additions & 0 deletions 75 sdk/python/tests/unit/infra/offline_stores/contrib/trino_offline_store/test_trino_auth.py
Show comments
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,75 @@
from pydantic import SecretStr
from trino.auth import BasicAuthentication, JWTAuthentication, OAuth2Authentication

from feast.infra.offline_stores.contrib.trino_offline_store.trino import (
CLASSES_BY_AUTH_TYPE,
AuthConfig,
FeastConfigBaseModel,
)


def test_jwt_auth_produces_plain_str_token():
Comment thread

@aniketpalu aniketpalu Aug 24, 2026

Copy link
Copy Markdown
Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not a blocker: While this test ensures OAuth2 auth still works, it could be enhanced to test a config with actual OAuth2 parameters to ensure non-SecretStr fields are handled correctly in the new code path.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions

@AdityaPatil22 AdityaPatil22 Aug 24, 2026

Copy link
Copy Markdown
Contributor Author

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the suggestion - OAuth2 doesn't actually have any config parameters in CLASSES_BY_AUTH_TYPE (its auth_model is None, and to_trino_auth() short-circuits to trino_auth_cls() with no fields at all), so there's no non-SecretStr field handling to exercise on that path. The new test_to_trino_auth_unwraps_only_secret_fields_in_mixed_model and test_basic_auth_with_plain_fields_unaffected tests cover the non-SecretStr field handling instead.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
auth = AuthConfig(
type="jwt",
config={"token": "my-secret-token"}, # pragma: allowlist secret
)

trino_auth = auth.to_trino_auth()

assert isinstance(trino_auth, JWTAuthentication)
assert trino_auth.token == "my-secret-token" # pragma: allowlist secret
assert isinstance(trino_auth.token, str)


def test_oauth2_auth_unchanged():
auth = AuthConfig(type="oauth2", config=None)

trino_auth = auth.to_trino_auth()

assert isinstance(trino_auth, OAuth2Authentication)


def test_basic_auth_with_plain_fields_unaffected():
auth = AuthConfig(
type="basic",
config={"username": "alice", "password": "hunter2"}, # pragma: allowlist secret
)

trino_auth = auth.to_trino_auth()

assert isinstance(trino_auth, BasicAuthentication)
assert trino_auth._username == "alice"
assert trino_auth._password == "hunter2" # pragma: allowlist secret


class _MixedAuthModel(FeastConfigBaseModel):
username: str
token: SecretStr


class _MixedAuth:
def __init__(self, username: str, token: str):
self.username = username
self.token = token


def test_to_trino_auth_unwraps_only_secret_fields_in_mixed_model(monkeypatch):
monkeypatch.setitem(
CLASSES_BY_AUTH_TYPE,
"jwt",
{"auth_model": _MixedAuthModel, "trino_auth": _MixedAuth},
)
auth = AuthConfig(
type="jwt",
config={
"username": "alice",
"token": "my-secret-token", # pragma: allowlist secret
},
)

trino_auth = auth.to_trino_auth()

assert trino_auth.username == "alice"
assert trino_auth.token == "my-secret-token" # pragma: allowlist secret
assert isinstance(trino_auth.username, str)
assert isinstance(trino_auth.token, str)
Loading
Oops, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit. This suggestion is invalid because no changes were made to the code. Suggestions cannot be applied while the pull request is closed. Suggestions cannot be applied while viewing a subset of changes. Only one suggestion per line can be applied in a batch. Add this suggestion to a batch that can be applied as a single commit. Applying suggestions on deleted lines is not supported. You must change the existing code in this line in order to create a valid suggestion. Outdated suggestions cannot be applied. This suggestion has been applied or marked resolved. Suggestions cannot be applied from pending reviews. Suggestions cannot be applied on multi-line comments. Suggestions cannot be applied while the pull request is queued to merge. Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.