4.0 - Imported charts shows error on embedding

[ss-ravi]

Bug description

「Guest user cannot modify chart payload」 Error is displayed for imported charts.
It's related to this issue, but with a specific reproduction flow. (#27177)

How to reproduce the bug

1. Create 2 superset 4.0 instances
2. Create a dashboard with a few charts (tested with "big-number" chart)
3. Export the dashboard and import it into the other superset instance
4. Try to embed the dashboard (using the sdk) into a web app
5. 「Guest user cannot modify chart payload」Error is displayed for each chart

Screenshots/recordings

Superset version

4.0.0

Python version

3.9

Node version

16

Browser

Chrome

Additional context

It seems that the export/import functionality doesn't copy the query_context field. (It becomes null after import)
I believe the query_context became important after this PR: https://github.com/apache/superset/pull/27484/files

Workaround

I noticed that just by opening the imported chart in the superset side updates the query_context and the embed starts working for that chart. We can't use this workaround as we have hundreds of charts for each of our clients.

Checklist

• I have searched Superset docs and Slack and didn't find a solution to my problem.
• I have searched the GitHub issue tracker and didn't find a similar bug report.
• I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

[dosubot]

To address the issue of "Guest user cannot modify chart payload" for imported charts in Apache Superset 4.0.0, you can automate the update of the query_context for each chart. This can be achieved by either directly interacting with the Superset backend database or using Superset's REST API to fetch and update charts. Here's a brief overview of both approaches:

1. Direct Database Manipulation: Write a script that connects to the Superset database, fetches all charts, updates the query_context field in their metadata, and saves the changes back to the database. This method requires direct access to the database and careful handling to avoid data corruption.

2. Using Superset APIs: A safer, albeit potentially slower, method involves using the Superset REST API. You would use the GET /chart/ endpoint to fetch chart configurations, update the query_context in each configuration, and then use the PUT /chart/{pk} endpoint to update each chart.

Before proceeding with either method, ensure you have a complete backup of your database to prevent data loss. It's also recommended to test your solution in a development environment before applying it to production.

Here's a simplified example of how you might use Python to update chart metadata using Superset's API:

import requests

SUPSERET_API_URL = "http://your-superset-instance/api/v1/chart"
API_TOKEN = "your_api_token"

def update_chart(chart_id, updated_config):
    headers = {"Authorization": f"Bearer {API_TOKEN}"}
    response = requests.put(f"{SUPSERET_API_URL}/{chart_id}", json=updated_config, headers=headers)
    if response.status_code == 200:
        print(f"Successfully updated chart {chart_id}")
    else:
        print(f"Failed to update chart {chart_id}: {response.text}")

# Example usage
chart_id = 123  # Example chart ID
updated_config = {
    # Your updated chart configuration including the new query_context
}
update_chart(chart_id, updated_config)

This script is a basic example and will need to be adjusted based on your specific requirements, including authentication and the exact structure of the updated_config.

Details

Sources

• superset/security/manager.py
• superset/common/query_context.py
• superset/charts/schemas.py
• superset/commands/dashboard/importers/v1/init.py
• superset/common/query_context_processor.py
• superset/common/query_context_factory.py
• superset-frontend/packages/superset-ui-core/src/query/buildQueryContext.ts
• superset/security/api.py
• superset-embedded-sdk/src/index.ts
• superset/commands/dashboard/importers/v1/utils.py
• tests/unit_tests/security/manager_test.py
• tests/integration_tests/security/guest_token_security_tests.py

About Dosu
This response is meant to be useful and save you time. It is not meant to be a precise solution, but rather a starting point for your own research.

Help me be more useful! Please leave a 👍 if this is helpful and 👎 if it is irrelevant.

To continue the conversation, mention @dosu.

[ss-ravi]

I actually tried to call the update api to see if the query_context would be automatically created, but it wasn't. I would have to know the exact json to put there, which I don't. Even if it were doable, It still feels that the query_context should also be copied with the import functionality.

[ss-ravi]

I also noticed a different related issue.
When you are embedding standalone charts, if the chart has no query_context it will try to update the chart from the iframe, and since the Public role doesn't have permission to update the chart, it ends up redirecting to the login page and you end up having iframes with login pages showing on them.

[fbgeobit]

I could patch the issue described (「Guest user cannot modify chart payload」):
Just opening each chart giving mentioned error and, without having to modify anything, saving it again.
That worked for me.

[rusackas]

@betodealmeida am I taking crazy pills or does this sound like the issue you fixed in unblocking 4.0?

[lindenh]

I think the issue blocking 4.0 previously was without imports, embeds would show that error for certain charts. This is a blocker for us though, as we use a multi-environment setup and have to use imports to deploy to higher environments. Adding a new manual step to an already cumbersome pipeline wouldn't bode well.

[rengawlaup]

Any update on this? We use a multi-environment set up and this presently a blocker.
Please and thank you.