aminghadersohi commented on PR #39601: URL: https://github.com/apache/superset/pull/39601#issuecomment-5007708946
Hey @mistercrunch 👋 — we're taking this PR over to carry it from POC to merge-ready (coordinated with Amin). Recent pushes: rebased onto latest master (twice), wired the standalone Explore page so the chart actually renders end-to-end (SupersetClient now picks up the guest token client-side), and added an `EMBEDDED_SUPERSET` fail-fast in the tool. Direction from here: - Move the guest token out of the URL query string (fragment-based delivery, so it never reaches server logs) - Inherit the MCP caller's RLS rules when minting chart-scoped tokens (currently `rls=[]`) - Integration deny-case tests for the new authz branches - Converge with the MCP service's embedded guest auth (`MCP_EMBEDDED_GUEST_AUTH_ENABLED`) where it makes sense Happy to adjust course if you had a different plan for any of this — comments welcome. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
