Make REDASH_DISABLE_PUBLIC_URLS win over stale DB org settings

disable_public_urls is not editable in the admin UI, but the settings form
posts back every value it received from GET /api/settings/organization, so
the env-derived value got persisted into organizations.settings. From then
on the stored copy shadowed the environment variable, and flipping
REDASH_DISABLE_PUBLIC_URLS had no effect.

Introduce an "environment only" set of org settings (currently just
disable_public_urls):

- Organization.get_setting() ignores stored values for these keys, so
  existing stale rows written by older versions are neutralized without
  requiring DB surgery.
- The settings endpoint skips persisting them and reports the effective
  (environment) value.

Fixes #7630

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: ekanshul

redash/handlers/settings.py

@@ -3,6 +3,9 @@
 from redash.handlers.base import BaseResource
 from redash.models import Organization, db
 from redash.permissions import require_admin
+from redash.settings.organization import (
+    environment_only as environment_only_org_settings,
+)
 from redash.settings.organization import settings as org_settings
 
 
@@ -11,7 +14,7 @@ def get_settings_with_defaults(defaults, org):
     settings = {}
 
     for setting, default_value in defaults.items():
-        current_value = values.get(setting)
+        current_value = values.get(setting) if setting not in environment_only_org_settings else None
         if current_value is None and default_value is None:
             continue
 
@@ -41,6 +44,9 @@ def post(self):
 
         previous_values = {}
         for k, v in new_values.items():
+            if k in environment_only_org_settings:
+                continue
+
             if k == "auth_google_apps_domains":
                 previous_values[k] = self.current_org.google_apps_domains
                 self.current_org.settings[Organization.SETTING_GOOGLE_APPS_DOMAINS] = v

redash/models/organizations.py

@@ -2,6 +2,9 @@
 from sqlalchemy.orm.attributes import flag_modified
 from sqlalchemy_utils.models import generic_repr
 
+from redash.settings.organization import (
+    environment_only as environment_only_org_settings,
+)
 from redash.settings.organization import settings as org_settings
 
 from .base import Column, db, primary_key
@@ -66,7 +69,7 @@ def set_setting(self, key, value):
         flag_modified(self, "settings")
 
     def get_setting(self, key, raise_on_missing=True):
-        if key in self.settings.get("settings", {}):
+        if key in self.settings.get("settings", {}) and key not in environment_only_org_settings:
             return self.settings["settings"][key]
 
         if key in org_settings:

redash/settings/organization.py

@@ -81,3 +81,10 @@
     "hide_plotly_mode_bar": HIDE_PLOTLY_MODE_BAR,
     "disable_public_urls": DISABLE_PUBLIC_URLS,
 }
+
+# Settings that are controlled exclusively through environment variables and are
+# not editable from the admin UI. Values for these keys that were persisted into
+# the organizations table (e.g. by the admin settings form of older versions
+# posting back every setting it received) are ignored, so the environment
+# variable remains the source of truth.
+environment_only = frozenset(["disable_public_urls"])

tests/handlers/test_settings.py

@@ -3,6 +3,32 @@
 
 
 class TestOrganizationSettings(BaseTestCase):
+    def test_environment_only_settings_ignore_stored_values(self):
+        # A value persisted into the organizations table by an older version
+        # must not shadow the environment variable (#7630).
+        self.factory.org.settings["settings"] = {"disable_public_urls": True}
+
+        self.assertEqual(self.factory.org.get_setting("disable_public_urls"), False)
+
+    def test_post_does_not_persist_environment_only_settings(self):
+        admin = self.factory.create_admin()
+        rv = self.make_request(
+            "post",
+            "/api/settings/organization",
+            data={"disable_public_urls": True, "auth_password_login_enabled": True},
+            user=admin,
+        )
+        self.assertEqual(rv.status_code, 200)
+        self.assertEqual(rv.json["settings"]["disable_public_urls"], False)
+        self.assertNotIn("disable_public_urls", self.factory.org.settings["settings"])
+
+    def test_get_returns_effective_environment_only_settings(self):
+        admin = self.factory.create_admin()
+        self.factory.org.settings["settings"] = {"disable_public_urls": True}
+
+        rv = self.make_request("get", "/api/settings/organization", user=admin)
+        self.assertEqual(rv.json["settings"]["disable_public_urls"], False)
+
     def test_post(self):
         admin = self.factory.create_admin()
         rv = self.make_request(