- ❌ Embed Chart modal flashes uninitialized content.
- ⚠️ Visual flicker when opening Embed Chart modal.

1. Open the Dashboard UI and click the chart "Embed chart" action that mounts the
EmbeddedChartModal component (UI flow described in PR). The modal renders the
ChartEmbedControls component defined at
`superset-frontend/src/dashboard/components/EmbeddedChartModal/index.tsx:61`.

2. On the initial render of ChartEmbedControls (component start at line 61), the code at
`index.tsx:63` initializes ready with `useState(true)`. Because ready is true, the
component proceeds to render the main UI instead of the Loading indicator.

3. Immediately after mount the useEffect at `index.tsx:129` runs and calls
`setReady(false)` to start the GET request for `/api/v1/chart/${chartId}/embedded` (see
lines 129-134). This causes a visible flash: the main UI is shown briefly, then the
component re-renders into the Loading state (`if (!ready) { return <Loading />; }` at
lines 151-153).

4. Expected behavior: Loading should show until the GET completes. The root cause is the
initial value at `index.tsx:63`. Initializing ready to false prevents the UI flash. If you
believe this pattern is intentional, note that the effect already sets ready false on
mount, but that still allows an initial render with ready=true and causes the flash.

This is a comment left during a code review.

**Path:** superset-frontend/src/dashboard/components/EmbeddedChartModal/index.tsx
**Line:** 63:63
**Comment:**
	*Logic Error: The component initializes the `ready` state to true, so the UI renders as if data is loaded before the GET request completes; this causes a flash of the main UI and bypasses the intended loading indicator. Initialize `ready` to false so the Loading spinner is shown until the fetch finishes.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.

- ❌ Dashboard "Embed chart" modal fails to open.
- ⚠️ Dashboard embed UI unusable for sharable charts.

1. Open a dashboard and open a chart's dropdown. The dropdown Menu is rendered with
onClick={handleMenuClick} in this file (SliceHeaderControls). The handleMenuClick switch
includes the EmbedChart branch at src/dashboard/components/SliceHeaderControls/index.tsx
lines ~292-299 where it calls setEmbedModalIsOpen(true).

2. Select the "Embed chart" menu entry (MenuKeys.EmbedChart). The case MenuKeys.EmbedChart
in handleMenuClick at index.tsx: ~294-298 executes setEmbedModalIsOpen(true).

3. The component tree includes <EmbeddedChartModal ... /> rendered at index.tsx:621-626.
That component instance receives props show and onHide (lines 623-625), not the
showModal/onHideModal shape used by other modals in this file (for example
DrillDetailModal in the same component uses showModal and onHideModal).

4. Because EmbeddedChartModal is passed show/onHide instead of showModal/onHideModal, the
modal's visibility API is not driven by the local state. Result: clicking "Embed chart"
sets embedModalIsOpen to true (verified at handleMenuClick: index.tsx:~294-298) but the
EmbeddedChartModal does not open. This reproduces the broken UI where the embed modal
never appears when the menu item is used.

This is a comment left during a code review.

**Path:** superset-frontend/src/dashboard/components/SliceHeaderControls/index.tsx
**Line:** 624:625
**Comment:**
	*Possible Bug: Prop-name mismatch on the rendered modal: other modals in this file use `showModal` / `onHideModal` naming (e.g. `DrillDetailModal`), but the new `EmbeddedChartModal` is rendered with `show` and `onHide`. If `EmbeddedChartModal` follows the same API as other dashboard modals, passing `show`/`onHide` will do nothing and the modal won't open/close as expected. Change the prop names to match the modal API used elsewhere (use `showModal` and `onHideModal`) so the component receives the visible state and close callback.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.

- ❌ Embed auth initialization fails; guest token ignored.
- ❌ Embedded charts fail to load without handshake.

1. Host an iframe pointing to the embeddable page
(superset-frontend/src/embeddedChart/index.tsx).

2. From the parent page, send a postMessage to the iframe using window.postMessage({
guestToken: 'abc' }, targetOrigin) without a `type` field.

3. The embedded page receives the message and the listener at line 287
(window.addEventListener) immediately calls validateMessageEvent at lines 129-134.

4. validateMessageEvent enforces `data.type === MESSAGE_TYPE` and throws because `type` is
absent; the listener's try/catch (lines 287-293) catches this and logs "ignoring message
unrelated to embedded comms" and returns, so the guestToken handling branches (lines
296-307 / Switchboard flow at 310+) never run.

5. Observed outcome: guest token is ignored and the embedded app does not initialize
authentication or render charts.

Note: This is a concrete failure when parent code posts guestToken without adding a `type`
property (a likely integration pattern).

This is a comment left during a code review.

**Path:** superset-frontend/src/embeddedChart/index.tsx
**Line:** 131:131
**Comment:**
	*Logic Error: Logic/compatibility bug: `validateMessageEvent` currently rejects any message that does not have `data.type === MESSAGE_TYPE`, which will also reject legitimate direct guest-token or handshake messages that omit `type`. As a result, valid messages carrying `guestToken` or `handshake` may be ignored. Relax validation to allow messages that carry `guestToken` or `handshake` in addition to the typed messages.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.

- ❌ POST /api/v1/embedded_chart/ creation fails.
- ❌ Generated guest token rejected by access checks.
- ⚠️ UI \"Embed chart\" flow returns errors.
- ⚠️ MCP tool embed creation may error.

1. Call the embeddable-chart creation API: POST /api/v1/embedded_chart/ which maps to
EmbeddedChartRestApi.post in superset/embedded_chart/api.py (post method defined around
lines 177-301 in the PR).

2. Execution reaches the guest-token creation block at
superset/embedded_chart/api.py:lines 261-283 (guest_user and resources construction),
specifically the resources dict at lines 267-272 is built with
GuestTokenResourceType.CHART_PERMALINK (enum instance).

3. The code calls security_manager.create_guest_access_token(...) at
superset/embedded_chart/api.py:lines 276-281. The guest token creation serializes the
resources payload into a JWT JSON body.

4. Because the resource \"type\" contains an Enum object
(GuestTokenResourceType.CHART_PERMALINK) rather than a primitive string, JSON
serialization or downstream validation either (a) raises a serialization error or (b)
produces a payload that does not match the string-based checks in
_validate_guest_token_access (superset/embedded_chart/api.py:_validate_guest_token_access,
lines ~58-75). The POST request therefore either returns HTTP 500 (serialization error) or
issues a guest token that will fail access checks when used to fetch the embed (leading to
401).

This is a comment left during a code review.

**Path:** superset/embedded_chart/api.py
**Line:** 269:269
**Comment:**
	*Type Error: The resource `type` is passed as an enum object when creating the guest token resources, but later code (and token payloads) expect the string value; this can cause a mismatch during serialization or when validating the guest token (access will be denied because the types won't match). Change the resource `type` to use the enum's `.value` so a string is stored.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.

- ❌ Embedded iframe fails to load (404).
- ⚠️ Dashboard UI \"Embed chart\" unusable.
- ⚠️ Third-party embeds get invalid URLs.

1. Create an embed by calling POST /api/v1/embedded_chart/ (EmbeddedChartRestApi.post in
superset/embedded_chart/api.py, method body lines ~177-301). The response includes the
iframe_url built at superset/embedded_chart/api.py:lines 291-292.

2. Take the returned iframe_url (example: https://host/embedded/chart/?permalink_key=XYZ)
and load it in a browser iframe.

3. Browser requests GET https://host/embedded/chart/ without a path parameter; the GET
handler is defined as @expose("/<permalink_key>", methods=("GET",)) in
superset/embedded_chart/api.py (get method at lines ~94-166). Because the path parameter
is missing, Flask routing does not match the GET endpoint for the permalink and the iframe
request yields 404/invalid route instead of returning the chart state.

4. Result: embedded iframe fails to load chart configuration; frontend cannot render
embed. The mismatch is reproducible using the API response from step 1 and loading that
iframe_url.

This is a comment left during a code review.

**Path:** superset/embedded_chart/api.py
**Line:** 293:293
**Comment:**
	*Logic Error: The GET endpoint expects the permalink as a path parameter, but the generated `iframe_url` places the permalink as a query parameter; this mismatch means the iframe URL will not match the API route and the iframe will fail to load the embed. Construct the iframe URL using the path-style route (embed path + permalink) to match the GET route.

Validate the correctness of the flagged issue. If correct, How can I resolve this? If you propose a fix, implement it and please make it concise.

- ❌ Embedded deletion bypasses ownership checks.
- ❌ Deletion can proceed despite associated reports.
- ❌ TypeError when embedded is missing.
- ⚠️ Affects command layer: superset/commands/chart/delete.py.