Adds superset:<resource>:<action> scope support to the MCP service:
- CompositeTokenVerifier now propagates an API key's own ApiKey.scopes
(via a new SupersetSecurityManager.get_api_key_scopes lookup) instead
of always stamping the verifier-global required_scopes on the token.
- check_tool_permission/_token_scope_allows accept a per-resource scope
(e.g. superset:dashboard:read, derived from the tool's
class_permission_name) as an alternative grant path alongside the
existing flat superset:read/superset:write scopes, which keep working
for already-issued tokens.
- SupersetSecurityManager.create_api_key validates requested scopes
against the issuing user's own RBAC before delegating to FAB
(intersection rule: a key can never be scoped beyond the user's own
permissions; flat scopes are Admin-only to self-issue; unknown scopes
are rejected).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Amin Ghadersohi