gabotorresruiz opened a new pull request, #43805: URL: https://github.com/apache/superset/pull/43805
### SUMMARY Consolidates and supersedes #43336 and #43340 into one reviewable PR against master, carrying the full dashboard Excel export hardening stack. @eschutho's storage chain commits are preserved with her authorship; the branch is her stack plus every review round fix, merged with current master (all conflicts were import unions, verified by test suites and a byte comparison of the export code region). What it contains, grouped: **Guest and identity fixes** - Guest (embedded) requesters no longer crash the export request on `g.user.id`; the worker reconstructs the guest from the token payload (`async_queries` pattern), preserving RLS rules and resource claims. - Anonymous (Public role) requesters run under the anonymous principal. - `mode=images` is rejected server side for any session without a user id, matching the UI gate. - Frontend delivery copy and the image export option follow the session principal instead of iframe detection. **Pluggable export storage** - `EXPORT_STORAGE` config with explicit `S3ExportStorage`/`GCSExportStorage` backends and a lazy, callable `key_prefix` for multi tenant deployments. **Streamed downloads (replaces signed URLs)** - The login free download endpoint streams the file through Superset with the deployment's own storage credentials instead of redirecting to a signed storage URL. - Rationale: signing is architecturally impossible under direct workload identity federation (no service account to sign as; the IAM signBytes call fails 400 in production), and a signed URL is a transferable bearer credential Superset can neither observe nor revoke. - `Content-Length` is declared, so a stream that dies midway is a failed download in the browser rather than a silently truncated file. - The link record stores which backend uploaded the file and refuses to serve with a mismatched one after a storage migration. **Status and polling** - A `running` status is recorded (and committed immediately) when a worker picks the job up, so queue delay does not consume the client's polling window. - One 12 minute poll window for every session; the export email is best effort and no longer treated as a fallback. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF No visual changes beyond toast copy; the export/download flows are API level. ### TESTING INSTRUCTIONS - `pytest tests/unit_tests/tasks/test_export_dashboard_excel.py tests/unit_tests/utils/gcs_tests.py tests/unit_tests/utils/s3_tests.py` (70 tests) - `pytest tests/integration_tests/dashboards/api_tests.py -k "export_xlsx or download_xlsx"` (25 tests) - `npm run test -- DownloadMenuItems.test.tsx` (22 tests) - End to end: configure `EXPORT_STORAGE`, export a dashboard logged in and as an embedded guest, click the download link; the file streams as an attachment with a declared length. GCS streaming additionally verified against fake-gcs-server, and the stack is validated in production on a GKE cluster using direct workload identity federation. ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [ ] Required feature flags: - [x] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Introduces new feature or API - [ ] Removes existing feature or API -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
