fix(embedded): restore chart rendering for guest dashboards by rusackas · Pull Request #43095 · apache/superset

rusackas · 2026-08-12T17:37:41Z

SUMMARY

Embedded dashboards recently stopped rendering their charts for guest (embedded) users. The dashboard payload was leaving out the member charts and their form_data, so the embedded frontend had nothing to render and sat on the loading spinner. It surfaced as an intermittent failure of the embedded Playwright suite.

An embedded guest reaches a dashboard and its charts through its guest token rather than a standalone datasource grant, so the chart branch of raise_for_access didn't recognize a guest while serializing a dashboard's member charts (the dashboard and form_data context that a chart-data request supplies isn't present during serialization). This grants a guest access to a member chart of a dashboard their token covers, bounded by the token's dataset allowlist. Non-guest access is unchanged.

The embedded Playwright helper keeps the small diagnostic that surfaces the embed error message instead of blindly timing out (which is what pinned this down), along with the cold-CI render timeout.

TESTING INSTRUCTIONS

tests/unit_tests/security/test_embedded_guest_chart_access.py covers the guest chart-access branch (granted vs. non-granted dashboard, the feature-flag gate, the non-guest path) and the dataset-allowlist bound. The existing guest-token allowlist tests still pass unchanged. The embedded Playwright suite exercises the end-to-end render.

To verify manually: embed a dashboard with a guest token and confirm its charts render.

ADDITIONAL INFORMATION

Changes UI (embedded dashboard rendering)

bito-code-review · 2026-08-12T17:37:52Z

Code Review Agent Run #e42548

Actionable Suggestions - 0

Review Details

Files reviewed - 2 · Commit Range: ed338a6..ed338a6
- superset-frontend/playwright/pages/EmbeddedPage.ts
- superset-frontend/playwright/tests/embedded/embedded-dashboard.spec.ts
Files skipped - 0
Tools
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful
- Eslint (Linter) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers a full AI review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

bito-code-review · 2026-08-12T17:42:48Z

The flagged issue is correct. The render method in EmbeddedPage.ts implements a retry loop that uses the default EMBEDDED.DASHBOARD_RENDER timeout for each attempt. If the total time for multiple attempts exceeds the Playwright test timeout (60 seconds), the test will be aborted before the retries can complete. To resolve this, you should pass a reduced timeout to the render method or calculate a total budget that ensures the test completes within the 60-second limit.

Would you like me to implement a fix for this issue? If you would also like me to check and address other comments on this PR, please let me know.

superset-frontend/playwright/pages/EmbeddedPage.ts

async render(
    params: Parameters<EmbeddedPage['goto']>[0],
    options?: { attempts?: number; timeout?: number },
  ): Promise<void> {
    const attempts = options?.attempts ?? 2;
    // Calculate a timeout per attempt that fits within the test limit
    const timeout = options?.timeout ?? Math.floor(60000 / attempts) - 5000;
    for (let attempt = 1; ; attempt += 1) {

codecov · 2026-08-12T17:49:05Z

Codecov Report

❌ Patch coverage is 10.00000% with 9 lines in your changes missing coverage. Please review.
✅ Project coverage is 66.62%. Comparing base (0915a39) to head (08238c8).
⚠️ Report is 1 commits behind head on master.

Files with missing lines	Patch %	Lines
superset/security/manager.py	10.00%	8 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #43095      +/-   ##
==========================================
- Coverage   66.63%   66.62%   -0.01%     
==========================================
  Files        2866     2866              
  Lines      162740   162750      +10     
  Branches    37487    37490       +3     
==========================================
- Hits       108445   108437       -8     
- Misses      52197    52213      +16     
- Partials     2098     2100       +2

Flag	Coverage Δ
hive	`38.19% <10.00%> (-0.01%)`	⬇️
javascript	`73.67% <ø> (-0.01%)`	⬇️
mysql	`57.87% <10.00%> (-0.01%)`	⬇️
postgres	`57.90% <10.00%> (-0.01%)`	⬇️
presto	`40.15% <10.00%> (-0.01%)`	⬇️
python	`59.30% <10.00%> (-0.01%)`	⬇️
sqlite	`57.54% <10.00%> (-0.01%)`	⬇️
unit	`100.00% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

netlify · 2026-08-12T21:55:11Z

✅ Deploy Preview for superset-docs-preview ready!

Name	Link
🔨 Latest commit	`348d10b`
🔍 Latest deploy log	https://app.netlify.com/projects/superset-docs-preview/deploys/6a7d22602ae5450008ed8a60
😎 Deploy Preview	https://deploy-preview-43095--superset-docs-preview.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

bito-code-review · 2026-08-12T21:57:01Z

Code Review Agent Run #9cc143

Actionable Suggestions - 0

Review Details

Files reviewed - 1 · Commit Range: ed338a6..9005438
- superset-frontend/playwright/tests/embedded/embedded-dashboard.spec.ts
Files skipped - 0
Tools
- Eslint (Linter) - ✔︎ Successful
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers a full AI review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

rusackas · 2026-08-13T01:49:28Z

Well... still stuck/iterating here... le sigh...

For posterity...

@sadpandajoe thanks for keeping the heat on this. I chased down those "Dashboard embedded successfully" timeouts and it turned out to be a real bug, not test timing.

From the failing run's trace, the embed handshake succeeds and every chunk downloads fine, but the DashboardContainer chunk comes back "preloaded but not used" and its lazy import never resolves, so the dashboard just sits on the Suspense spinner. It's the /* webpackPreload: true */ on that import in DashboardPage: under load the browser's preload cache races webpack's script injection and the load event gets dropped, hanging the chunk promise. Dropping the preload hint lets it load on demand and resolve reliably.

Since that's the actual fix, I pulled the retry back out, so the retry-budget/timeout math from the earlier threads is moot now. Also applied the oxfmt output so pre-commit's happy, and rebased on master. Mind taking another look?

bito-code-review · 2026-08-13T03:58:08Z

Code Review Agent Run #470e06

Actionable Suggestions - 0

Review Details

Files reviewed - 4 · Commit Range: 862b497..862b497
- superset-frontend/playwright/pages/EmbeddedPage.ts
- superset-frontend/playwright/tests/embedded/embedded-dashboard.spec.ts
- superset-frontend/playwright/utils/constants.ts
- superset-frontend/src/dashboard/containers/DashboardPage.tsx
Files skipped - 0
Tools
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful
- Eslint (Linter) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers a full AI review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

Embedded dashboards stopped rendering their charts for guest (embedded) users: the dashboard payload dropped member charts and withheld their form_data, so the frontend had nothing to render and hung on the loading spinner. An embedded guest carries no standalone datasource grant, so the chart branch of raise_for_access could not recognise a guest during dashboard serialization (the dashboard/form_data context a chart-data request provides is absent there). Grant a guest access to a member chart of a dashboard their token covers, bounded by the token's dataset allowlist. Non-guest access is unchanged. Also keep the embedded Playwright helper's error-surfacing diagnostic and the cold-CI render timeout, which is what pinned this down. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

rusackas · 2026-08-13T04:45:00Z

Heya @sha174n! The embedded Playwright flake turned out to be a real rendering regression rather than test timing, so I reworked this PR to fix the actual cause. It lands in the member-chart serialization path you were recently in, so I'd love your eyes on it. Does the guest handling look right to you?

bito-code-review · 2026-08-13T07:48:36Z

Code Review Agent Run #c4a258

Actionable Suggestions - 0

Additional Suggestions - 2

superset-frontend/playwright/pages/EmbeddedPage.ts - 2
- Promise.race ignores loser state · Line 127-127
  
  `Promise.race` resolves on whichever promise settles first. When the grid times out, `ready` settles to `'gridTimeout'` even though the error box might already be visible — its promise is still pending because its own `.catch()` hasn't fired yet. The real error message is then lost and replaced with an unhelpful status read.
- Timeout error discards available error text · Line 133-139
  
  When both the grid and error box time out, the code falls through to read `#status` and throws a timeout error — but `errorBox` content is already available (the `failed` promise resolved to `'errorTimeout'`, which means the `.catch` ran and `textContent` was captured). The actual error text is discarded, and callers only see the status value.

Filtered by Review Rules

Bito filtered these suggestions based on rules created automatically for your feedback. Manage rules.

superset/security/manager.py - 1
- Missing return type annotation · Line 4950-4950
tests/unit_tests/security/test_embedded_guest_chart_access.py - 2
- Missing return type annotation · Line 137-137
- Missing return type annotation · Line 150-150

Review Details

Files reviewed - 4 · Commit Range: 08238c8..08238c8
- superset-frontend/playwright/pages/EmbeddedPage.ts
- superset-frontend/playwright/utils/constants.ts
- superset/security/manager.py
- tests/unit_tests/security/test_embedded_guest_chart_access.py
Files skipped - 0
Tools
- MyPy (Static Code Analysis) - ✔︎ Successful
- Astral Ruff (Static Code Analysis) - ✔︎ Successful
- Whispers (Secret Scanner) - ✔︎ Successful
- Detect-secrets (Secret Scanner) - ✔︎ Successful
- Eslint (Linter) - ✔︎ Successful

Bito Usage Guide

Commands

Type the following command in the pull request comment and save the comment.

/review - Manually triggers a full AI review.
/pause - Pauses automatic reviews on this pull request.
/resume - Resumes automatic reviews.
/resolve - Marks all Bito-posted review comments as resolved.
/abort - Cancels all in-progress reviews.

Refer to the documentation for additional commands.

Configuration

This repository uses Superset You can customize the agent settings here or contact your Bito workspace admin at evan@preset.io.

Documentation & Help

AI Code Review powered by

sha174n

Reviewed the guest-dashboard rendering change — the grant is on the chart-definition path only and stays bounded to the token's dashboards + dataset allowlist; the data-query path is unchanged. LGTM.

pull-request-size Bot added the size/M label Aug 12, 2026

dosubot Bot added the embedded label Aug 12, 2026

github-actions Bot added preset-io and removed embedded labels Aug 12, 2026

codeant-ai-for-open-source Bot reviewed Aug 12, 2026

View reviewed changes

Comment thread superset-frontend/playwright/pages/EmbeddedPage.ts Outdated

sadpandajoe reviewed Aug 12, 2026

View reviewed changes

Comment thread superset-frontend/playwright/pages/EmbeddedPage.ts

sadpandajoe reviewed Aug 12, 2026

View reviewed changes

Comment thread superset-frontend/playwright/tests/embedded/embedded-dashboard.spec.ts Outdated

rusackas force-pushed the fix/embedded-dashboard-e2e-flake branch from 9005438 to 73a6e5c Compare August 13, 2026 00:57

rusackas changed the title ~~test(embedded): stabilize flaky embedded dashboard E2E~~ fix(dashboard): drop webpackPreload that stalls embedded dashboard load Aug 13, 2026

sadpandajoe reviewed Aug 13, 2026

View reviewed changes

Comment thread superset-frontend/playwright/pages/EmbeddedPage.ts Outdated

rusackas force-pushed the fix/embedded-dashboard-e2e-flake branch 2 times, most recently from 401935d to 348d10b Compare August 13, 2026 01:48

rusackas force-pushed the fix/embedded-dashboard-e2e-flake branch from 348d10b to 862b497 Compare August 13, 2026 03:06

rusackas force-pushed the fix/embedded-dashboard-e2e-flake branch from 862b497 to 08238c8 Compare August 13, 2026 04:42

pull-request-size Bot added size/L and removed size/M labels Aug 13, 2026

rusackas changed the title ~~fix(dashboard): drop webpackPreload that stalls embedded dashboard load~~ fix(embedded): restore chart rendering for guest dashboards Aug 13, 2026

sha174n approved these changes Aug 13, 2026

View reviewed changes

rusackas merged commit 5936158 into master Aug 13, 2026
84 checks passed

rusackas deleted the fix/embedded-dashboard-e2e-flake branch August 13, 2026 12:39

Uh oh!

Conversation

rusackas commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

SUMMARY

TESTING INSTRUCTIONS

ADDITIONAL INFORMATION

Uh oh!

bito-code-review Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #e42548

Uh oh!

Uh oh!

bito-code-review Bot commented Aug 12, 2026

Uh oh!

codecov Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

Uh oh!

netlify Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for superset-docs-preview ready!

Uh oh!

bito-code-review Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #9cc143

Uh oh!

Uh oh!

rusackas commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bito-code-review Bot commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #470e06

Uh oh!

rusackas commented Aug 13, 2026

Uh oh!

bito-code-review Bot commented Aug 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Agent Run #c4a258

Uh oh!

sha174n left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

rusackas commented Aug 12, 2026 •

edited

Loading

bito-code-review Bot commented Aug 12, 2026 •

edited

Loading

codecov Bot commented Aug 12, 2026 •

edited

Loading

netlify Bot commented Aug 12, 2026 •

edited

Loading

bito-code-review Bot commented Aug 12, 2026 •

edited

Loading

rusackas commented Aug 13, 2026 •

edited

Loading

bito-code-review Bot commented Aug 13, 2026 •

edited

Loading

bito-code-review Bot commented Aug 13, 2026 •

edited

Loading