feat: embedded dashboard core #17530

suddjian · 2021-11-23T23:20:40Z

SUMMARY

This PR implements the core of the embedded dashboards feature as described in #17187.

All commits in this branch have been individually reviewed, so it should be merge-able without requiring detailed review of a large change set.

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

If you're at Preset, we have a demo host app that can help with testing: https://github.com/preset-io/embedded-demo. Just run that, and you'll be exercising this code.

If you're not at Preset, testing this will be more involved until more features, docs, and supporting utils are written. You'll need to build a host app that embeds the new dashboard view, fetches a guest token from the new api, and sends the guest token to the frontend using the postMessage and MessageChannel browser apis. Future PRs will add an SDK, documentation, UI, and a demo host app to make this easier.

Other things to QA could be making sure that access rights still work correctly outside the embed feature, but we already have automated tests for this.

ADDITIONAL INFORMATION

Has associated issue:
Required feature flags:
Changes UI
Includes DB Migration (follow approval process in SIP-59)
- Migration is atomic, supports rollback & is backwards-compatible
- Confirm DB migration upgrade and downgrade tested
- Runtime estimates and downtime expectations provided
Introduces new feature or API
Removes existing feature or API

* setup embedded provider * update ui configuration * fix test

codecov · 2021-12-07T02:26:37Z

Codecov Report

Merging #17530 (cf26feb) into master (4675ca3) will decrease coverage by 0.45%.
The diff coverage is 66.37%.

❗ Current head cf26feb differs from pull request most recent head e3dc5ee. Consider uploading reports for the commit e3dc5ee to get more accurate results

@@            Coverage Diff             @@
##           master   #17530      +/-   ##
==========================================
- Coverage   66.35%   65.89%   -0.46%     
==========================================
  Files        1570     1588      +18     
  Lines       61772    62351     +579     
  Branches     6243     6273      +30     
==========================================
+ Hits        40991    41089      +98     
- Misses      19182    19641     +459     
- Partials     1599     1621      +22

Flag	Coverage Δ
hive	`?`
mysql	`81.27% <67.87%> (-0.82%)`	⬇️
postgres	`81.32% <67.87%> (-0.82%)`	⬇️
presto	`?`
python	`81.41% <67.87%> (-1.18%)`	⬇️
sqlite	`81.01% <67.87%> (-0.82%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
...rt-controls/src/operators/rollingWindowOperator.ts	`100.00% <ø> (ø)`
...ui-chart-controls/src/operators/utils/constants.ts	`100.00% <ø> (ø)`
.../superset-ui-core/src/connection/SupersetClient.ts	`100.00% <ø> (ø)`
...superset-ui-core/src/query/types/PostProcessing.ts	`100.00% <ø> (ø)`
.../src/time-format/TimeFormatterRegistrySingleton.ts	`100.00% <ø> (ø)`
...ackages/superset-ui-core/src/utils/featureFlags.ts	`100.00% <ø> (ø)`
...s/legacy-plugin-chart-country-map/src/countries.ts	`100.00% <ø> (ø)`
...src/BigNumber/BigNumberWithTrendline/buildQuery.ts	`9.09% <ø> (ø)`
...hart-echarts/src/MixedTimeseries/transformProps.ts	`0.00% <0.00%> (ø)`
...chart-echarts/src/Timeseries/Area/controlPanel.tsx	`33.33% <0.00%> (-6.67%)`	⬇️
... and 133 more

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 4675ca3...e3dc5ee. Read the comment docs.

* generate an embed token * improve existing tests * add some auth setup, and rename token * fix the stuff for compatibility with external request loaders * docs, standard jwt claims, tweaks * black * lint * tests, and safer token decoding * linting * type annotation * prettier * add feature flag * quiet pylint * apparently typing is a problem again * Make guest role name configurable * fake being a non-anonymous user * just one log entry * customizable algo * lint * lint again * 403 works now! * get guest token from header instead of cookie * Revert "403 works now!" This reverts commit df2f49a. * fix tests * Revert "Revert "403 works now!"" This reverts commit 883dff3. * rename method

HeshamMeneisi · 2021-12-21T05:08:35Z

Hello @suddjian I was looking into embedded dashboards and came by this. In your current design, would there be a way to use user-related data (from the JWT) as filters? Something like some_table.uid=external_user.uid where external_user is part of the JWT?

* create entry for embedded dashboard in webpack * add cookies * lint * token message handshake * guestTokenHeaderName * use setupClient instead of calling configure * rename the webpack chunk * simplified handshake * embedded entrypoint: render a proper app * make the embedded page accept anonymous connections * format * lint * fix test # Conflicts: # superset-frontend/src/embedded/index.tsx # superset/views/core.py * lint * Update superset-frontend/src/embedded/index.tsx Co-authored-by: David Aaron Suddjian <1858430+suddjian@users.noreply.github.com> * comment out origins checks * move embedded for core to dashboard * pylint * isort Co-authored-by: David Aaron Suddjian <aasuddjian@gmail.com> Co-authored-by: David Aaron Suddjian <1858430+suddjian@users.noreply.github.com>

* helper methods and dashboard access * guest token dashboard authz * adjust csrf exempt list * eums don't work that way * Remove unnecessary import * move row level security tests to their own file * a bit of refactoring * add guest token security tests * refactor tests * clean imports * variable names can be too long apparently * missing argument to get_user_roles * don't redefine builtins * remove unused imports * fix test import * default to global user when getting roles * missing import * mock it * test get_user_roles * infer g.user for ease of tests * remove redundant check * tests for guest user security manager fns * use algo to get rid of warning messages * tweaking access checks * fix guest token security tests * missing imports * more tests * more testing and also some small refactoring * move validation out of parsing * fix dashboard access check again * add more test Co-authored-by: Lily Kuang <lily@preset.io>

* helper methods and dashboard access * guest token dashboard authz * adjust csrf exempt list * eums don't work that way * Remove unnecessary import * move row level security tests to their own file * a bit of refactoring * add guest token security tests * refactor tests * clean imports * variable names can be too long apparently * missing argument to get_user_roles * don't redefine builtins * remove unused imports * fix test import * default to global user when getting roles * missing import * mock it * test get_user_roles * infer g.user for ease of tests * remove redundant check * tests for guest user security manager fns * use algo to get rid of warning messages * tweaking access checks * fix guest token security tests * missing imports * more tests * more testing and also some small refactoring * move validation out of parsing * fix dashboard access check again * rls rules for guest tokens * test guest token rls rules * more flexible rls rules * lint * fix tests * fix test * defaults * fix some tests * fix some tests * lint Co-authored-by: Lily Kuang <lily@preset.io>

suddjian · 2022-01-22T07:07:13Z

Hello @suddjian I was looking into embedded dashboards and came by this. In your current design, would there be a way to use user-related data (from the JWT) as filters? Something like some_table.uid=external_user.uid where external_user is part of the JWT?

Sorry for the delayed reply, I just saw this. Yes, the guest token can contain Row Level Security rules. More details available in the corresponding pr

lilykuang

🎉

superset/config.py

superset/security/guest_token.py

superset-frontend/src/embedded/index.tsx

Co-authored-by: Lily Kuang <lily@preset.io>

ad-m · 2022-01-27T17:18:10Z

superset/security/guest_token.py

+# specific language governing permissions and limitations
+# under the License.
+from enum import Enum
+from typing import List, Optional, TypedDict, Union


@suddjian TypedDict was introduced in Python 3.8 ( https://www.python.org/dev/peps/pep-0589/ , https://docs.python.org/3/whatsnew/3.8.html#typing ). The minimal supported version of Python by Superset is 3.7 ( https://github.com/apache/superset/blob/master/setup.py#L173-L175 ). We have to express that in a different way or drop support for Python 3.7.

I would like add that it make pre-commit hook mypy fail on Python 3.7:

superset/security/guest_token.py:18: error: Module "typing" has no attribute "TypedDict"; maybe "_TypedDict"? superset/security/guest_token.py:24: error: Unexpected keyword argument "total" for "__init_subclass__" of "object" Found 2 errors in 1 file (checked 2 source files)

Oh no, I'll push a fix. Sorry for the inconvenience.

* feat(dashboard): embedded dashboard UI configuration (apache#17175) (apache#17450) * setup embedded provider * update ui configuration * fix test * feat: Guest token (for embedded dashboard auth) (apache#17517) * generate an embed token * improve existing tests * add some auth setup, and rename token * fix the stuff for compatibility with external request loaders * docs, standard jwt claims, tweaks * black * lint * tests, and safer token decoding * linting * type annotation * prettier * add feature flag * quiet pylint * apparently typing is a problem again * Make guest role name configurable * fake being a non-anonymous user * just one log entry * customizable algo * lint * lint again * 403 works now! * get guest token from header instead of cookie * Revert "403 works now!" This reverts commit df2f49a. * fix tests * Revert "Revert "403 works now!"" This reverts commit 883dff3. * rename method * correct import * feat: entry for embedded dashboard (apache#17529) * create entry for embedded dashboard in webpack * add cookies * lint * token message handshake * guestTokenHeaderName * use setupClient instead of calling configure * rename the webpack chunk * simplified handshake * embedded entrypoint: render a proper app * make the embedded page accept anonymous connections * format * lint * fix test # Conflicts: # superset-frontend/src/embedded/index.tsx # superset/views/core.py * lint * Update superset-frontend/src/embedded/index.tsx Co-authored-by: David Aaron Suddjian <1858430+suddjian@users.noreply.github.com> * comment out origins checks * move embedded for core to dashboard * pylint * isort Co-authored-by: David Aaron Suddjian <aasuddjian@gmail.com> Co-authored-by: David Aaron Suddjian <1858430+suddjian@users.noreply.github.com> * feat: Authorizing guest access to embedded dashboards (apache#17757) * helper methods and dashboard access * guest token dashboard authz * adjust csrf exempt list * eums don't work that way * Remove unnecessary import * move row level security tests to their own file * a bit of refactoring * add guest token security tests * refactor tests * clean imports * variable names can be too long apparently * missing argument to get_user_roles * don't redefine builtins * remove unused imports * fix test import * default to global user when getting roles * missing import * mock it * test get_user_roles * infer g.user for ease of tests * remove redundant check * tests for guest user security manager fns * use algo to get rid of warning messages * tweaking access checks * fix guest token security tests * missing imports * more tests * more testing and also some small refactoring * move validation out of parsing * fix dashboard access check again * add more test Co-authored-by: Lily Kuang <lily@preset.io> * feat: Row Level Security rules for guest tokens (apache#17836) * helper methods and dashboard access * guest token dashboard authz * adjust csrf exempt list * eums don't work that way * Remove unnecessary import * move row level security tests to their own file * a bit of refactoring * add guest token security tests * refactor tests * clean imports * variable names can be too long apparently * missing argument to get_user_roles * don't redefine builtins * remove unused imports * fix test import * default to global user when getting roles * missing import * mock it * test get_user_roles * infer g.user for ease of tests * remove redundant check * tests for guest user security manager fns * use algo to get rid of warning messages * tweaking access checks * fix guest token security tests * missing imports * more tests * more testing and also some small refactoring * move validation out of parsing * fix dashboard access check again * rls rules for guest tokens * test guest token rls rules * more flexible rls rules * lint * fix tests * fix test * defaults * fix some tests * fix some tests * lint Co-authored-by: Lily Kuang <lily@preset.io> * SupersetClient guest token test * Apply suggestions from code review Co-authored-by: Lily Kuang <lily@preset.io> Co-authored-by: Lily Kuang <lily@preset.io>

lilykuang and others added 2 commits November 16, 2021 10:31

feat(dashboard): embedded dashboard UI configuration (#17175) (#17450)

7108e6b

* setup embedded provider * update ui configuration * fix test

Merge branch 'master' into embedded

71421e4

superset-github-bot bot added the preset-io label Nov 23, 2021

pull-request-size bot added the size/L label Nov 23, 2021

This was referenced Nov 25, 2021

feat: Guest token (for embedded dashboard auth) #17517

Merged

feat: entry for embedded dashboard #17529

Merged

Merge branch 'master' into embedded

68795a7

suddjian and others added 3 commits December 9, 2021 10:12

Merge branch 'master' into embedded

d2e088c

Merge branch 'master' into embedded

ee71eb8

pull-request-size bot added size/XL and removed size/L labels Dec 14, 2021

This was referenced Dec 15, 2021

feat: Authorizing guest access to embedded dashboards #17757

Merged

feat: Row Level Security rules for guest tokens #17836

Merged

suddjian and others added 3 commits January 13, 2022 15:04

Merge branch 'master' into embedded

d2774e4

correct import

4c74e53

lilykuang closed this Jan 18, 2022

lilykuang force-pushed the embedded branch from fe63435 to 7d22c9c Compare January 18, 2022 22:14

pull-request-size bot added size/XS and removed size/XL labels Jan 18, 2022

lilykuang reopened this Jan 18, 2022

pull-request-size bot added size/XL and removed size/XS labels Jan 18, 2022

lilykuang and others added 2 commits January 18, 2022 14:44

Merge branch 'master' into embedded

8f2bba9

pull-request-size bot added size/XXL and removed size/XL labels Jan 21, 2022

suddjian requested review from lilykuang and betodealmeida January 22, 2022 07:03

suddjian marked this pull request as ready for review January 22, 2022 07:03

suddjian changed the title ~~wip: embedded dashboards feature branch~~ feat: embedded dashboard core Jan 22, 2022

SupersetClient guest token test

8fb08b1

lilykuang approved these changes Jan 25, 2022

View reviewed changes

suddjian commented Jan 25, 2022

View reviewed changes

superset/config.py Outdated Show resolved Hide resolved

suddjian commented Jan 25, 2022

View reviewed changes

superset/security/guest_token.py Outdated Show resolved Hide resolved

lilykuang reviewed Jan 25, 2022

View reviewed changes

superset-frontend/src/embedded/index.tsx Outdated Show resolved Hide resolved

Apply suggestions from code review

e3dc5ee

Co-authored-by: Lily Kuang <lily@preset.io>

suddjian merged commit 4ad5ad0 into master Jan 26, 2022

This was referenced Jan 26, 2022

error Unexpected token < in JSON at position 0 #18126

Closed

Dashboard Filterbox iframe not displaying #17436

Closed

ad-m reviewed Jan 27, 2022

View reviewed changes

lilykuang deleted the embedded branch August 30, 2022 16:23

dpgaspar mentioned this pull request Nov 15, 2023

chore: exempt cache-warmup endpoint from CSRF protection #25978

Closed

9 tasks

mistercrunch added 🏷️ bot A label used by `supersetbot` to keep track of which PR where auto-tagged with release labels 🚢 1.5.0 labels Mar 13, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: embedded dashboard core #17530

feat: embedded dashboard core #17530

suddjian commented Nov 23, 2021 •

edited

codecov bot commented Dec 7, 2021 •

edited

HeshamMeneisi commented Dec 21, 2021

suddjian commented Jan 22, 2022

lilykuang left a comment

ad-m Jan 27, 2022

ad-m Jan 27, 2022

suddjian Jan 28, 2022

feat: embedded dashboard core #17530

feat: embedded dashboard core #17530

Conversation

suddjian commented Nov 23, 2021 • edited

SUMMARY

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

codecov bot commented Dec 7, 2021 • edited

Codecov Report

HeshamMeneisi commented Dec 21, 2021

suddjian commented Jan 22, 2022

lilykuang left a comment

Choose a reason for hiding this comment

ad-m Jan 27, 2022

Choose a reason for hiding this comment

ad-m Jan 27, 2022

Choose a reason for hiding this comment

suddjian Jan 28, 2022

Choose a reason for hiding this comment

suddjian commented Nov 23, 2021 •

edited

codecov bot commented Dec 7, 2021 •

edited