Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(embedded): Disable share clickable links for chart and tab title if can_export permission is missing #31359

Draft
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

cezudas
Copy link

@cezudas cezudas commented Dec 9, 2024

SUMMARY

While in embedded mode, one could argue that sharing should be disabled since the links do not work in embed mode and clicking them will redirect a GUEST_USER to the standalone version of superset and will hit a "login wall".
Such a share link is http://localhost:8088/superset/dashboard/p/4aRGDe0MLmo/. See the screenshot below.

In my experience it is enough to:

  • ensure the role used as GUEST_ROLE_NAME lacks the following permissions
{
    "permission": { "name": "can_export" },
    "view_menu": { "name": "Dashboard" }
},
{
    "permission": { "name": "can_export" },
    "view_menu": { "name": "Chart" }
}

  • conditionally render the share links for Tab title and Chart title based on the permissions listed above

BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF

Before:
Clickable links
Screenshot 2024-12-09 at 22 31 02

Screenshot 2024-12-09 at 22 31 09

TESTING INSTRUCTIONS

I used a user WITHOUT the following permissions

{
    "permission": { "name": "can_export" },
    "view_menu": { "name": "Dashboard" }
},
{
    "permission": { "name": "can_export" },
    "view_menu": { "name": "Chart" }
}

ADDITIONAL INFORMATION

  • Has associated issue:
  • Required feature flags:
  • Changes UI
  • Includes DB Migration (follow approval process in SIP-59)
    • Migration is atomic, supports rollback & is backwards-compatible
    • Confirm DB migration upgrade and downgrade tested
    • Runtime estimates and downtime expectations provided
  • Introduces new feature or API
  • Removes existing feature or API

… title if `can_export` permission is missing
@dosubot dosubot bot added the change:frontend Requires changing the frontend label Dec 9, 2024
@cezudas cezudas marked this pull request as draft December 9, 2024 20:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
change:frontend Requires changing the frontend review:draft size/M
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants