You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@superset.apache.org by "richardfogaca (via GitHub)" <gi...@apache.org> on 2026/06/03 13:51:11 UTC
[PR] fix(embedded): add guest token to streaming exports [superset]
richardfogaca opened a new pull request, #40712:
URL: https://github.com/apache/superset/pull/40712
### SUMMARY
This fixes embedded dashboard streaming CSV exports for table-like charts whose row limit enters the large-export path.
Previously, the streaming export hook built a native `fetch` form request with chart export fields but did not include the active embedded guest token. Embedded users could load the dashboard, but the CSV export POST reached the chart data API without guest-auth material and failed before returning the CSV.
The change adds the configured guest token to the streaming export form body when one is present. Backend guest authentication remains the authority; the frontend only transports the existing token on the native streaming request path. The regression test covers the token-bearing case while existing hook coverage keeps the no-token and adjacent streaming behaviors intact.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
N/A - no public screenshot or recording is attached to this PR. The verified behavior is described in the testing instructions below.
### TESTING INSTRUCTIONS
- Live browser validation in a local Superset compose runtime: opened an embedded dashboard host with a guest token, used the chart More Options → Download → Export to .CSV flow for a table chart with `row_limit=100000`, and observed the CSV Export modal reach the successful state with a Download button. Regression condition: the previous export failure/401 state did not recur.
- Live API/network validation in the same local runtime: inspected the chart export POST to `/api/v1/chart/data` from that embedded export scenario and observed `guest_token` and `expected_rows=100000` in the submitted form, plus a `200 OK` `text/csv` response with CSV rows. Regression condition: the request no longer omitted embedded auth material or returned the prior unauthorized export failure.
- Focused regression command: `npm run test -- src/components/StreamingExportModal/useStreamingExport.test.ts`
### ADDITIONAL INFORMATION
- [ ] Has associated issue:
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [ ] Introduces new feature or API
- [ ] Removes existing feature or API
Reviewer focus: this is intentionally limited to the streaming export request builder and its tests; it should not change backend authorization rules, export thresholds, or provider-specific SQL execution.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(embedded): add guest token to streaming exports [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #40712:
URL: https://github.com/apache/superset/pull/40712#issuecomment-4613047218
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(embedded): add guest token to streaming exports [superset]
Posted by "aminghadersohi (via GitHub)" <gi...@apache.org>.
aminghadersohi commented on code in PR #40712:
URL: https://github.com/apache/superset/pull/40712#discussion_r3350479730
##########
superset-frontend/src/components/StreamingExportModal/useStreamingExport.test.ts:
##########
@@ -238,6 +242,32 @@ const createPrefixTestMockFetch = () =>
},
});
+test('chart streaming export includes guest token in form body when configured', async () => {
+ SupersetClient.getGuestToken.mockReturnValue('guest-token');
+ const mockFetch = createPrefixTestMockFetch();
+ global.fetch = mockFetch;
+
+ const { result } = renderHook(() => useStreamingExport());
+
+ act(() => {
+ result.current.startExport({
+ url: '/api/v1/chart/data',
+ payload: { datasource: '1__table', viz_type: 'table' },
+ exportType: 'csv',
+ });
+ });
+
+ await waitFor(() => {
+ expect(mockFetch).toHaveBeenCalledTimes(1);
+ });
+
+ const request = mockFetch.mock.calls[0][1];
+ expect(request.body.get('guest_token')).toBe('guest-token');
+ expect(request.body.get('form_data')).toBe(
+ JSON.stringify({ datasource: '1__table', viz_type: 'table' }),
+ );
+});
Review Comment:
**NIT:** The new test covers the token-present path, but no test (new or existing) explicitly asserts that `guest_token` is **absent** from the form body when `getGuestToken()` returns `undefined`. `beforeEach` resets the mock to `undefined` so all prior tests implicitly run without a token, but none assert the absence. A companion test or a single added assertion (e.g. `expect(request.body.get('guest_token')).toBeNull()` in an existing chart-export test) would guard against accidental token injection in a future refactor and make the boundary explicit.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(embedded): add guest token to streaming exports [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #40712:
URL: https://github.com/apache/superset/pull/40712#issuecomment-4614911269
<!-- Bito Reply -->
The reviewer's suggestion to explicitly assert the absence of `guest_token` in the form body when `getGuestToken()` returns `undefined` is a valid improvement. Adding an assertion like `expect(request.body.get('guest_token')).toBeNull()` in the test suite provides a clear boundary and prevents potential regressions where a token might be accidentally injected in future refactors.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(embedded): add guest token to streaming exports [superset]
Posted by "bito-code-review[bot] (via GitHub)" <gi...@apache.org>.
bito-code-review[bot] commented on PR #40712:
URL: https://github.com/apache/superset/pull/40712#issuecomment-4616045597
AI Code Review is in progress (usually takes 3 to 15 minutes unless it's a very large PR).
<details>
<summary>
Bito Usage Guide
</summary>
**Commands**
Type the following command in the pull request comment and save the comment.
- `/review` - Manually triggers a full AI review.
- `/pause` - Pauses automatic reviews on this pull request.
- `/resume` - Resumes automatic reviews.
- `/resolve` - Marks all Bito-posted review comments as resolved.
- `/abort` - Cancels all in-progress reviews.
Refer to the <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/available-commands" target="_blank" rel="noopener noreferrer">documentation</a> for additional commands.
**Configuration**
This repository uses `Superset` You can customize the agent settings <a href="https://alpha.bito.ai/home/ai-agents/code-review-agent" target="_blank" rel="noopener noreferrer">here</a> or contact your Bito workspace admin at evan@preset.io.
**Documentation & Help**
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/getting-started/install-run-using-bito-cloud/create-or-customize-an-agent-instance" target="_blank" rel="noopener noreferrer">Customize agent settings</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/implementing-custom-code-review-rules" target="_blank" rel="noopener noreferrer">Review rules</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent" target="_blank" rel="noopener noreferrer">General documentation</a>
- <a href="https://docs.bito.ai/bito-dev-agents/ai-code-review-agent/faqs" target="_blank" rel="noopener noreferrer">FAQ</a>
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(embedded): add guest token to streaming exports [superset]
Posted by "netlify[bot] (via GitHub)" <gi...@apache.org>.
netlify[bot] commented on PR #40712:
URL: https://github.com/apache/superset/pull/40712#issuecomment-4613069240
### <span aria-hidden="true">✅</span> Deploy Preview for *superset-docs-preview* ready!
| Name | Link |
|:-:|------------------------|
|<span aria-hidden="true">🔨</span> Latest commit | 4244b4ab51e60bac93e17f89c51eb2f924c68385 |
|<span aria-hidden="true">🔍</span> Latest deploy log | https://app.netlify.com/projects/superset-docs-preview/deploys/6a203150bc333a000958d02a |
|<span aria-hidden="true">😎</span> Deploy Preview | [https://deploy-preview-40712--superset-docs-preview.netlify.app](https://deploy-preview-40712--superset-docs-preview.netlify.app) |
|<span aria-hidden="true">📱</span> Preview on mobile | <details><summary> Toggle QR Code... </summary><br /><br /><br /><br />_Use your smartphone camera to open QR code link._</details> |
|<span aria-hidden="true">🤖</span> Make changes | [Run an agent on this branch](https://app.netlify.com/projects/superset-docs-preview/agent-runs#DctLCoAgEADQu8y6gTEprBt0DFNBIVNG-xHdPXdv817InGKuMAN0sLLejW9m41EIhaac6O6cuOIVqkdOF24hhoqhlMO1Yl3e0rPYlkbdkxQDrUZKqYloGpSlXsP3Aw) |
---
<!-- [superset-docs-preview Preview](https://deploy-preview-40712--superset-docs-preview.netlify.app) -->
_To edit notification comments on pull requests, go to your [Netlify project configuration](https://app.netlify.com/projects/superset-docs-preview/configuration/notifications#deploy-notifications)._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(embedded): add guest token to streaming exports [superset]
Posted by "richardfogaca (via GitHub)" <gi...@apache.org>.
richardfogaca merged PR #40712:
URL: https://github.com/apache/superset/pull/40712
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org
Re: [PR] fix(embedded): add guest token to streaming exports [superset]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #40712:
URL: https://github.com/apache/superset/pull/40712#issuecomment-4615256576
## [Codecov](https://app.codecov.io/gh/apache/superset/pull/40712?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 64.07%. Comparing base ([`e5c7200`](https://app.codecov.io/gh/apache/superset/commit/e5c7200551af51a544ba471eedf1aebbf9f20cde?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)) to head ([`3a6fc56`](https://app.codecov.io/gh/apache/superset/commit/3a6fc56fdb95e7e13de0404bf116e8d3baa2e190?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
:warning: Report is 2 commits behind head on master.
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## master #40712 +/- ##
=======================================
Coverage 64.07% 64.07%
=======================================
Files 2663 2663
Lines 143505 143508 +3
Branches 32993 32994 +1
=======================================
+ Hits 91951 91954 +3
Misses 49952 49952
Partials 1602 1602
```
| [Flag](https://app.codecov.io/gh/apache/superset/pull/40712/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [javascript](https://app.codecov.io/gh/apache/superset/pull/40712/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `67.57% <100.00%> (+<0.01%)` | :arrow_up: |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>
[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/apache/superset/pull/40712?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@superset.apache.org
For additional commands, e-mail: notifications-help@superset.apache.org