A cleaner right side of the navbar with a Github link #666
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Member
mistercrunch
commented
Jun 23, 2016
mistercrunch
commented
8 tasks
zhaoyongjie
pushed a commit
to zhaoyongjie/incubator-superset
that referenced
this pull request
Nov 17, 2021
zhaoyongjie
pushed a commit
to zhaoyongjie/incubator-superset
that referenced
this pull request
Nov 24, 2021
zhaoyongjie
pushed a commit
to zhaoyongjie/incubator-superset
that referenced
this pull request
Nov 25, 2021
zhaoyongjie
pushed a commit
to zhaoyongjie/incubator-superset
that referenced
this pull request
Nov 26, 2021
mistercrunch
added
🏷️ bot
aminghadersohi
added a commit
to aminghadersohi/superset
that referenced
this pull request
Jan 6, 2026
- Remove literal color apache#666 from embeddedChart (use default text color) - Shorten long description lines in schemas.py - Fix import ordering in app.py - Add EmbeddedChartRestApi and EmbeddedChartView to security allowlist 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <[email protected]>
aminghadersohi
added a commit
to aminghadersohi/superset
that referenced
this pull request
Jan 8, 2026
Add a new MCP tool `get_embeddable_chart` that enables AI agents to create ephemeral chart visualizations with guest token authentication. This allows charts to be embedded in external applications (Claude Desktop, ChatGPT, etc.) without persisting them to the database. Key changes: - Add CHART_PERMALINK resource type to GuestTokenResourceType enum - Add validation for chart_permalink resources in SecurityManager - Add EMBEDDABLE_CHARTS_MCP feature flag (disabled by default) - Create embedded_chart backend module with API and view - Create MCP tool with schemas for get_embeddable_chart - Create frontend embeddedChart entry using StatefulChart component The feature uses the existing permalink system for chart state storage with TTL support, and leverages StatefulChart for lightweight rendering that handles data fetching internally. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <[email protected]> fix: address CI failures for embeddable charts PR - Remove literal color apache#666 from embeddedChart (use default text color) - Shorten long description lines in schemas.py - Fix import ordering in app.py - Add EmbeddedChartRestApi and EmbeddedChartView to security allowlist 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <[email protected]> fix: address code review feedback for embeddable charts - Fix null pointer in validateMessageEvent (typeof null === 'object') - Fix race condition with started flag - reset on failure - Fix security issue - don't leak exception message in 500 response - Add docstrings to exception classes - Remove redundant %s formatting in logger.exception 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <[email protected]> fix: remove exception chaining to prevent internal detail leakage Remove `from ex` in exception handling to prevent leaking internal exception details. Re-raise EmbeddedChartPermalinkNotFoundError directly if already raised, otherwise raise a new instance without chaining. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <[email protected]> fix: use 'from None' to satisfy ruff B904 rule Within an except clause, using 'from None' explicitly suppresses exception chaining which prevents internal error details from being exposed. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <[email protected]> chore: format with ruff 0.9.7 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <[email protected]> chore: format embeddedChart with prettier 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <[email protected]> fix: add proper type annotations for mypy compliance - Import GuestTokenUser, GuestTokenResource, GuestTokenRlsRule types - Add type annotations to guest_user, resources, rls_rules - Use GuestTokenResourceType enum directly instead of .value - Handle bytes return type from create_guest_access_token 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <[email protected]> fix: use .get() for GUEST_TOKEN_HEADER_NAME config access Provides a default value to prevent potential KeyError. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <[email protected]> chore: re-trigger CI for flaky test The sharded-jest-tests (3) failure is a flaky test timeout (DatasourceEditor.test.tsx) unrelated to this PR's changes. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <[email protected]> fix(mcp): add referrer validation and @Protect() decorator for embeddable charts Security improvements based on code review comparing with dashboard embedding: 1. Add optional allowed_domains parameter to get_embeddable_chart MCP tool - Stored in permalink state for later validation - Allows restricting which domains can embed the chart 2. Add referrer validation to EmbeddedChartView - Validates request.referrer against allowed_domains - Uses same same_origin() check as dashboard embedding - Returns 403 if referrer not in allowed domains list 3. Add @Protect() decorator to EmbeddedChartRestApi.get() - Consistent with EmbeddedDashboardRestApi pattern - Adds class_permission_name for FAB permissions 4. Include allowed_domains in API response - Useful for debugging and validation 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <[email protected]> chore: re-trigger CI for flaky test The sharded-jest-tests (3) failure is a flaky test timeout (DatasourceEditor.test.tsx) unrelated to this PR's changes. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <[email protected]> fix(mcp): fix API response format and PyJWT compatibility for embeddable charts 1. Fix API response format to match frontend expectations: - Frontend expects { state: { formData: {...} } } - Was returning { result: { form_data: {...} } } - Now returns state directly from permalink 2. Fix PyJWT compatibility: - PyJWT 2.0+ returns string, older versions return bytes - Handle both cases when decoding guest token 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <[email protected]> fix(mcp): add guest token security for embedded chart data access - Add guest token validation in embedded_chart API to verify permalink access - Add has_guest_chart_permalink_access() to security manager to allow guest users with chart_permalink resources to access datasources - Add can_read CurrentUserRestApi to PUBLIC_ROLE_PERMISSIONS for frontend initialization in embedded views - Remove redundant referrer validation from view (now handled by guest token) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <[email protected]> fix(mcp): remove EMBEDDABLE_CHARTS_MCP feature flag, use EMBEDDED_SUPERSET Per PR review feedback, avoid adding a new feature flag since MCP is already feature-flagged. Embedded charts now use the existing EMBEDDED_SUPERSET flag which is consistent with dashboard embedding. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <[email protected]> fix(mcp): remove all feature flag checks from embedded charts Per PR review feedback, remove all feature flag usage. The embedded chart functionality is now always available - no feature flags needed. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <[email protected]> fix(mcp): add isinstance check for GuestUser in has_guest_chart_permalink_access The method was failing for regular User objects that don't have a resources attribute. Added explicit isinstance(user, GuestUser) check to ensure we only access user.resources for actual GuestUser instances. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <[email protected]> fix(mcp): fix ruff linting issues in embedded chart files - Fix import sorting in api.py - Remove unused imports in view.py (Any, cast, same_origin, GetExplorePermalinkCommand) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude Opus 4.5 <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.