bintocher/mcp-superset

Added

• Session-cookie authentication for SSO/OAuth instances. Where Superset sits behind OAuth/OIDC/SAML, REST password login is unavailable. Set SUPERSET_SESSION_COOKIE (and SUPERSET_SESSION_COOKIE_NAME when the instance renames the cookie) and the server sends a browser session cookie on every request, fetching CSRF tokens with it. Cookie mode takes precedence over SUPERSET_USERNAME/SUPERSET_PASSWORD; a 401 in this mode says the cookie needs refreshing, since an expired SSO session cannot be renewed server-side.
• First test suite (pytest + respx, 21 tests) covering both auth strategies, client wiring and the 401 paths. CI runs it.

Changed

• Authentication is an AuthStrategy protocol with two implementations (JwtAuthManager, CookieAuthManager) selected by build_auth_strategy(). SupersetClient no longer knows about bearer tokens. AuthManager was renamed to JwtAuthManager.

Fixed

• Authentication failures on mutating requests escaped as raw httpx.HTTPStatusError, bypassing SupersetAPIError and the cookie-refresh hint. All auth and CSRF failures are now wrapped consistently.
• post_form built its headers by hand and missed the same error handling; it now shares _get_headers. Error-detail extraction is a single helper used by _request, get_raw and post_form.

Thanks to @nail-k1 for the feature.