hughhhh opened a new pull request, #45890: URL: https://github.com/apache/superset/pull/45890
### SUMMARY **Stacked on #45068. The diff includes all of #45068; review only the top two commits (`5107dbad69`, `4c72545c17`). Merge after #45068.** With `EMBEDDED_CREDENTIAL_FALLBACK` on, an embedded dashboard on a Snowflake connection that has "Impersonate logged in user" on but no OAuth2 client stops loading for outside viewers. Refusing those viewers is intended, but nobody could tell why. The viewer saw only "Data error: An error occurred while fetching the data.", and the server log said the connection's settings "may have been lost", which is rarely the cause. On Snowflake, impersonation without OAuth2 never changed the login, so these connections were usually just never set up for OAuth2. The docs also left out several limits an admin needs to know before turning the flag on. **Refusal message (`5107dbad69`)** - Guest errors are redacted to the generic message unless Superset wrote the error type. Both guest refusals (no OAuth2 client, no embedded credential) now raise `DATABASE_SECURITY_ACCESS_ERROR`, which survives that redaction, with a fixed message that names nothing about the connection: *"This chart can't be shown here because its database connection isn't set up for embedded dashboards. Please contact the dashboard's owner."* - A server-log warning names the connection and says how to fix it. With no OAuth2 client: turn off "Impersonate logged in user", or configure an OAuth2 client and embedded guest credentials. With no credential: add embedded guest credentials. **Docs (`4c72545c17`)**: UPDATING.md, `embedding.mdx` and the SIP now cover: - which embedded dashboards stop loading when the flag is turned on, and the two ways to fix them; - with `GLOBAL_ASYNC_QUERIES` on, logged-in users' charts on a Snowflake OAuth2 connection run as the base account (this predates the flag); - with "Per user caching" off, logged-in users on an OAuth2 connection can be shown each other's cached results; - connections created in SQLAlchemy URI mode show neither the OAuth2 nor the embedded credential section, so set those values in Secure extra instead; - turning off "Impersonate logged in user" moves embedded viewers, and logged-in users, onto the base account. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF Not captured. The embedded viewer's banner changes from "Data error: An error occurred while fetching the data." to the message above. ### TESTING INSTRUCTIONS 1. Enable `EMBEDDED_SUPERSET` and `EMBEDDED_CREDENTIAL_FALLBACK`. 2. Create a Snowflake connection with a username and password, turn on "Impersonate logged in user", and configure no OAuth2 client. 3. Embed a dashboard with a chart on it and open it with a guest token. The chart shows the new message, and the server log has a `Refused an embedded viewer's query on database connection ...` warning naming the connection and both fixes. 4. Turn off "Impersonate logged in user" and reload. The chart loads under the base account. Unit tests: `pytest tests/unit_tests/models/core_test.py` ### ADDITIONAL INFORMATION - [ ] Has associated issue: - [x] Required feature flags: `EMBEDDED_SUPERSET`, `EMBEDDED_CREDENTIAL_FALLBACK` - [ ] Changes UI - [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)) - [ ] Migration is atomic, supports rollback & is backwards-compatible - [ ] Confirm DB migration upgrade and downgrade tested - [ ] Runtime estimates and downtime expectations provided - [ ] Introduces new feature or API - [ ] Removes existing feature or API Created with Claude Opus 5.5 in Claude Code. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
