Summary

Superset Extensions need a stable, safe, and well-scoped API to persist data. Without a first-class storage API, extensions are forced to roll their own storage — writing directly to localStorage with ad-hoc keys on the client, or inserting rows into Superset's internal key_value table on the server — with no consistent namespacing, no isolation from Superset's own data, and no defined cleanup path on uninstall. This PR adds a first-class storage API that implements Tier 1, Tier 2, and Tier 3 of the Extensions Storage Design Proposal.

Changes

• Add managed storage APIs for extensions with automatic namespace isolation
• Tier 1: Browser-based storage (ctx.storage.local, ctx.storage.session) with user isolation
• Tier 2: Server-side cache (ctx.storage.ephemeral) with TTL support and Redis/Memcached compatibility
• Tier 3: Database-backed persistent storage (ctx.storage.persistent) that survives server restarts and cache evictions
• Storage is accessed via getContext() which is bound to each extension via Module Federation
• Update webpack externals to support subpath imports like @apache-superset/core/extensions
• Add new documentation page explaining how storage works

Tier 1: Local State (Browser Storage)

import { getContext } from '@apache-superset/core/extensions';

const ctx = getContext();

// Persists across browser sessions
await ctx.storage.local.set('sidebar_collapsed', true);
const isCollapsed = await ctx.storage.local.get('sidebar_collapsed');

// Cleared when tab closes
await ctx.storage.session.set('wizard_step', 3);

Tier 2: Ephemeral State (Server Cache)

import { getContext } from '@apache-superset/core/extensions';

const ctx = getContext();

// Store with default TTL (1 hour)
await ctx.storage.ephemeral.set('job_progress', { pct: 42, status: 'running' });

// Store with custom TTL (5 minutes)
await ctx.storage.ephemeral.set('quick_cache', data, { ttl: 300 });

// Retrieve
const progress = await ctx.storage.ephemeral.get('job_progress');

from superset_core.extensions.context import get_context

ctx = get_context()

# Store job progress
ctx.storage.ephemeral.set('job_progress', {'pct': 42, 'status': 'running'}, ttl=3600)

# Retrieve
progress = ctx.storage.ephemeral.get('job_progress')

Tier 3: Persistent State (Database)

Database-backed storage that survives server restarts, cache evictions, and browser clears. Use for any data that must not be lost.

import { getContext } from '@apache-superset/core/extensions';

const ctx = getContext();

// Store user preferences
await ctx.storage.persistent.set('preferences', { theme: 'dark', locale: 'en' });

// Retrieve
const prefs = await ctx.storage.persistent.get('preferences');

// Remove
await ctx.storage.persistent.remove('preferences');

from superset_core.extensions.context import get_context

ctx = get_context()

# Store user preferences
ctx.storage.persistent.set('preferences', {'theme': 'dark', 'locale': 'en'})

# Retrieve
prefs = ctx.storage.persistent.get('preferences')

# Remove
ctx.storage.persistent.remove('preferences')

Shared State (Cross-User)

All storage operations are user-scoped by default. Use the .shared accessor to read/write state visible to all users:

const ctx = getContext();

await ctx.storage.local.shared.set('device_id', 'abc-123');
await ctx.storage.ephemeral.shared.set('shared_result', { data: [1, 2, 3] });
await ctx.storage.persistent.shared.set('global_config', { version: 2 });

API Endpoints (Tier 2 & Tier 3)

All endpoints follow the pattern /api/v1/extensions/{publisher}/{name}/storage/{tier}/{key}. Append ?shared=true to any endpoint to operate on shared state visible to all users instead of the default user-scoped state.

Test plan

• Verify ctx.storage.local persists data across page reloads in browser localStorage
• Verify ctx.storage.session clears when browser tab is closed
• Verify ctx.storage.ephemeral stores/retrieves data via the backend API
• Verify ctx.storage.persistent stores/retrieves data and survives server restart
• Verify storage is isolated per extension (different extensions using same key don't collide)
• Verify user-scoped storage is isolated per user
• Verify shared storage is accessible across users

🤖 Generated with Claude Code