You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@superset.apache.org by jl...@apache.org on 2026/04/12 04:23:06 UTC
(superset) branch embedded-e2e-tests created (now 5f2a43e8a66)
This is an automated email from the ASF dual-hosted git repository.
jli pushed a change to branch embedded-e2e-tests
in repository https://gitbox.apache.org/repos/asf/superset.git
at 5f2a43e8a66 feat: add embedded dashboard E2E tests to Playwright CI
This branch includes the following new commits:
new 5f2a43e8a66 feat: add embedded dashboard E2E tests to Playwright CI
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
(superset) 01/01: feat: add embedded dashboard E2E tests to Playwright CI
Posted by jl...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
jli pushed a commit to branch embedded-e2e-tests
in repository https://gitbox.apache.org/repos/asf/superset.git
commit 5f2a43e8a6672e1f13af41373b5774de615bcf5f
Author: sadpandajoe <jc...@gmail.com>
AuthorDate: Sun Apr 12 04:22:53 2026 +0000
feat: add embedded dashboard E2E tests to Playwright CI
Add end-to-end tests for the embedded dashboard flow, validating the
complete path from external app through the @superset-ui/embedded-sdk
to dashboard rendering in an iframe with guest token authentication.
New test infrastructure:
- Minimal static HTML test app served by Node.js http server in fixture
- EmbeddedPage page object for iframe interaction
- API helpers for embedded config and guest token management
- chromium-embedded Playwright project with dedicated test matching
Tests cover:
- Dashboard rendering in embedded iframe via SDK
- UI config options (hideTitle, hideTab, hideChartControls)
- Native filter functionality in embedded mode
- allowed_domains referrer validation (403 for unauthorized origins)
- Guest token authentication and data access
Config changes:
- Enable EMBEDDED_SUPERSET feature flag in test config
- Add CORS config for embedded test app origin (localhost:9000)
Co-Authored-By: Claude Opus 4.6 <no...@anthropic.com>
---
superset-frontend/playwright.config.ts | 13 +
.../playwright/embedded-app/index.html | 96 +++++++
.../playwright/helpers/api/embedded.ts | 123 ++++++++
superset-frontend/playwright/pages/EmbeddedPage.ts | 139 +++++++++
.../tests/embedded/embedded-dashboard.spec.ts | 311 +++++++++++++++++++++
superset-frontend/playwright/utils/constants.ts | 15 +
tests/integration_tests/superset_test_config.py | 10 +
7 files changed, 707 insertions(+)
diff --git a/superset-frontend/playwright.config.ts b/superset-frontend/playwright.config.ts
index 2c001297fe5..e14ed125d9c 100644
--- a/superset-frontend/playwright.config.ts
+++ b/superset-frontend/playwright.config.ts
@@ -94,6 +94,7 @@ export default defineConfig({
name: 'chromium',
testIgnore: [
'**/tests/auth/**/*.spec.ts',
+ '**/tests/embedded/**/*.spec.ts',
...(process.env.INCLUDE_EXPERIMENTAL ? [] : ['**/experimental/**']),
],
use: {
@@ -115,6 +116,18 @@ export default defineConfig({
// No storageState = clean browser with no cached cookies
},
},
+ {
+ // Embedded dashboard tests - validates the full embedding flow:
+ // external app -> SDK -> iframe -> guest token -> dashboard render
+ name: 'chromium-embedded',
+ testMatch: '**/tests/embedded/**/*.spec.ts',
+ use: {
+ browserName: 'chromium',
+ testIdAttribute: 'data-test',
+ // Uses admin auth for API calls to configure embedding and get guest tokens
+ storageState: 'playwright/.auth/user.json',
+ },
+ },
],
// Web server setup - disabled in CI (Flask started separately in workflow)
diff --git a/superset-frontend/playwright/embedded-app/index.html b/superset-frontend/playwright/embedded-app/index.html
new file mode 100644
index 00000000000..ef58a82ded0
--- /dev/null
+++ b/superset-frontend/playwright/embedded-app/index.html
@@ -0,0 +1,96 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements. See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership. The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied. See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+<!DOCTYPE html>
+<html lang="en">
+<head>
+ <meta charset="UTF-8" />
+ <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+ <title>Embedded Dashboard Test App</title>
+ <style>
+ html, body { margin: 0; padding: 0; height: 100%; }
+ #superset-container { width: 100%; height: 100vh; }
+ #superset-container iframe { width: 100%; height: 100%; border: none; }
+ #error { color: red; padding: 20px; display: none; }
+ #status { padding: 10px; font-family: monospace; font-size: 12px; }
+ </style>
+</head>
+<body>
+ <div id="status">Initializing embedded dashboard...</div>
+ <div id="error"></div>
+ <div id="superset-container" data-test="embedded-container"></div>
+
+ <script src="/sdk/index.js"></script>
+ <script>
+ (async function () {
+ const params = new URLSearchParams(window.location.search);
+ const uuid = params.get('uuid');
+ const supersetDomain = params.get('supersetDomain');
+
+ if (!uuid || !supersetDomain) {
+ document.getElementById('error').style.display = 'block';
+ document.getElementById('error').textContent =
+ 'Missing required query params: uuid, supersetDomain';
+ return;
+ }
+
+ const statusEl = document.getElementById('status');
+
+ // fetchGuestToken is injected by Playwright via page.exposeFunction()
+ // Falls back to window.__guestToken for simple/static token injection
+ async function fetchGuestToken() {
+ if (typeof window.__fetchGuestToken === 'function') {
+ statusEl.textContent = 'Fetching guest token...';
+ const token = await window.__fetchGuestToken();
+ statusEl.textContent = 'Guest token received, loading dashboard...';
+ return token;
+ }
+ if (window.__guestToken) {
+ return window.__guestToken;
+ }
+ throw new Error('No guest token source available');
+ }
+
+ try {
+ // Parse optional UI config from query params
+ const uiConfig = {};
+ if (params.get('hideTitle') === 'true') uiConfig.hideTitle = true;
+ if (params.get('hideTab') === 'true') uiConfig.hideTab = true;
+ if (params.get('hideChartControls') === 'true') uiConfig.hideChartControls = true;
+
+ const dashboard = await supersetEmbeddedSdk.embedDashboard({
+ id: uuid,
+ supersetDomain: supersetDomain,
+ mountPoint: document.getElementById('superset-container'),
+ fetchGuestToken: fetchGuestToken,
+ dashboardUiConfig: Object.keys(uiConfig).length > 0 ? uiConfig : undefined,
+ debug: params.get('debug') === 'true',
+ });
+
+ statusEl.textContent = 'Dashboard embedded successfully';
+ // Expose dashboard API on window for Playwright assertions
+ window.__embeddedDashboard = dashboard;
+ } catch (err) {
+ document.getElementById('error').style.display = 'block';
+ document.getElementById('error').textContent = 'Embed failed: ' + err.message;
+ statusEl.textContent = 'Error';
+ }
+ })();
+ </script>
+</body>
+</html>
diff --git a/superset-frontend/playwright/helpers/api/embedded.ts b/superset-frontend/playwright/helpers/api/embedded.ts
new file mode 100644
index 00000000000..d16a03d5159
--- /dev/null
+++ b/superset-frontend/playwright/helpers/api/embedded.ts
@@ -0,0 +1,123 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Page, APIResponse } from '@playwright/test';
+import { apiPost, apiPut, apiGet } from './requests';
+
+export const ENDPOINTS = {
+ SECURITY_LOGIN: 'api/v1/security/login',
+ GUEST_TOKEN: 'api/v1/security/guest_token/',
+ DASHBOARD: 'api/v1/dashboard/',
+} as const;
+
+export interface EmbeddedConfig {
+ uuid: string;
+ allowed_domains: string[];
+ dashboard_id: string;
+}
+
+/**
+ * Enable embedding on a dashboard and return the embedded UUID.
+ * Uses PUT (upsert) to preserve UUID across repeated calls.
+ */
+export async function apiEnableEmbedding(
+ page: Page,
+ dashboardIdOrSlug: number | string,
+ allowedDomains: string[] = [],
+): Promise<EmbeddedConfig> {
+ const response = await apiPut(
+ page,
+ `${ENDPOINTS.DASHBOARD}${dashboardIdOrSlug}/embedded`,
+ { allowed_domains: allowedDomains },
+ );
+ const body = await response.json();
+ return body.result as EmbeddedConfig;
+}
+
+/**
+ * Get a guest token for an embedded dashboard.
+ * Uses the admin login flow (login → access_token → guest_token).
+ */
+export async function getGuestToken(
+ page: Page,
+ dashboardId: string,
+ options?: {
+ username?: string;
+ password?: string;
+ rls?: Array<{ dataset: number; clause: string }>;
+ },
+): Promise<string> {
+ const username = options?.username ?? 'admin';
+ const password = options?.password ?? 'general';
+ const rls = options?.rls ?? [];
+
+ // Step 1: Login to get access token
+ const loginResponse = await apiPost(
+ page,
+ ENDPOINTS.SECURITY_LOGIN,
+ {
+ username,
+ password,
+ provider: 'db',
+ refresh: true,
+ },
+ { allowMissingCsrf: true },
+ );
+ const loginBody = await loginResponse.json();
+ const accessToken = loginBody.access_token;
+
+ // Step 2: Fetch guest token using the access token
+ const guestResponse = await page.request.post(ENDPOINTS.GUEST_TOKEN, {
+ data: {
+ user: {
+ username: 'embedded_test_user',
+ first_name: 'Embedded',
+ last_name: 'TestUser',
+ },
+ resources: [{ type: 'dashboard', id: dashboardId }],
+ rls,
+ },
+ headers: {
+ 'Content-Type': 'application/json',
+ Authorization: `Bearer ${accessToken}`,
+ },
+ });
+ const guestBody = await guestResponse.json();
+ return guestBody.token;
+}
+
+/**
+ * Get a dashboard by slug, returning its numeric ID.
+ */
+export async function getDashboardIdBySlug(
+ page: Page,
+ slug: string,
+): Promise<number | null> {
+ const response = await apiGet(
+ page,
+ `${ENDPOINTS.DASHBOARD}?q=(filters:!((col:slug,opr:eq,value:'${slug}')))`,
+ { failOnStatusCode: false },
+ );
+ if (!response.ok()) return null;
+ const body = await response.json();
+ if (body.result?.length > 0) {
+ return body.result[0].id;
+ }
+ return null;
+}
diff --git a/superset-frontend/playwright/pages/EmbeddedPage.ts b/superset-frontend/playwright/pages/EmbeddedPage.ts
new file mode 100644
index 00000000000..a03261668e2
--- /dev/null
+++ b/superset-frontend/playwright/pages/EmbeddedPage.ts
@@ -0,0 +1,139 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { Page, FrameLocator } from '@playwright/test';
+import { EMBEDDED } from '../utils/constants';
+
+/**
+ * Page object for the embedded dashboard test app.
+ *
+ * The test app runs on a separate origin (localhost:9000) and uses the
+ * @superset-ui/embedded-sdk to render a Superset dashboard in an iframe.
+ * Playwright's page.exposeFunction() bridges the guest token from Node.js
+ * into the browser page.
+ */
+export class EmbeddedPage {
+ private readonly page: Page;
+
+ private static readonly SELECTORS = {
+ CONTAINER: '[data-test="embedded-container"]',
+ IFRAME: 'iframe[title="Embedded Dashboard"]',
+ STATUS: '#status',
+ ERROR: '#error',
+ } as const;
+
+ constructor(page: Page) {
+ this.page = page;
+ }
+
+ /**
+ * Set up the guest token bridge before navigating.
+ * Must be called BEFORE goto() since embedDashboard() calls fetchGuestToken
+ * immediately on page load.
+ */
+ async exposeTokenFetcher(tokenFn: () => Promise<string>): Promise<void> {
+ await this.page.exposeFunction('__fetchGuestToken', tokenFn);
+ }
+
+ /**
+ * Navigate to the embedded test app with the given parameters.
+ */
+ async goto(params: {
+ uuid: string;
+ supersetDomain: string;
+ hideTitle?: boolean;
+ hideTab?: boolean;
+ hideChartControls?: boolean;
+ debug?: boolean;
+ }): Promise<void> {
+ const searchParams = new URLSearchParams({
+ uuid: params.uuid,
+ supersetDomain: params.supersetDomain,
+ });
+ if (params.hideTitle) searchParams.set('hideTitle', 'true');
+ if (params.hideTab) searchParams.set('hideTab', 'true');
+ if (params.hideChartControls) searchParams.set('hideChartControls', 'true');
+ if (params.debug) searchParams.set('debug', 'true');
+
+ await this.page.goto(`${EMBEDDED.APP_URL}/?${searchParams.toString()}`);
+ }
+
+ /**
+ * Get a FrameLocator for the embedded dashboard iframe.
+ */
+ getIframeLocator(): FrameLocator {
+ return this.page.frameLocator(EmbeddedPage.SELECTORS.IFRAME);
+ }
+
+ /**
+ * Wait for the iframe to appear in the DOM.
+ */
+ async waitForIframe(options?: { timeout?: number }): Promise<void> {
+ await this.page
+ .locator(EmbeddedPage.SELECTORS.IFRAME)
+ .waitFor({
+ state: 'attached',
+ timeout: options?.timeout ?? EMBEDDED.IFRAME_LOAD,
+ });
+ }
+
+ /**
+ * Wait for dashboard content to render inside the iframe.
+ * Looks for the grid-container which indicates charts are loading/loaded.
+ */
+ async waitForDashboardContent(options?: { timeout?: number }): Promise<void> {
+ const frame = this.getIframeLocator();
+ await frame
+ .locator('.grid-container, [data-test="grid-container"]')
+ .first()
+ .waitFor({
+ state: 'visible',
+ timeout: options?.timeout ?? EMBEDDED.DASHBOARD_RENDER,
+ });
+ }
+
+ /**
+ * Get the status text from the test app.
+ */
+ async getStatus(): Promise<string> {
+ return this.page.locator(EmbeddedPage.SELECTORS.STATUS).textContent() ?? '';
+ }
+
+ /**
+ * Get the error text, if any.
+ */
+ async getError(): Promise<string> {
+ const errorEl = this.page.locator(EmbeddedPage.SELECTORS.ERROR);
+ const display = await errorEl.evaluate(el => getComputedStyle(el).display);
+ if (display === 'none') return '';
+ return (await errorEl.textContent()) ?? '';
+ }
+
+ /**
+ * Check if the dashboard title is visible inside the iframe.
+ */
+ async isTitleVisible(): Promise<boolean> {
+ const frame = this.getIframeLocator();
+ return frame
+ .locator(
+ '[data-test="dashboard-header-container"] [data-test="editable-title"]',
+ )
+ .isVisible();
+ }
+}
diff --git a/superset-frontend/playwright/tests/embedded/embedded-dashboard.spec.ts b/superset-frontend/playwright/tests/embedded/embedded-dashboard.spec.ts
new file mode 100644
index 00000000000..059bce97bbf
--- /dev/null
+++ b/superset-frontend/playwright/tests/embedded/embedded-dashboard.spec.ts
@@ -0,0 +1,311 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { test, expect } from '@playwright/test';
+import { createServer, IncomingMessage, ServerResponse, Server } from 'http';
+import { readFileSync, existsSync } from 'fs';
+import { join, extname } from 'path';
+import {
+ apiEnableEmbedding,
+ getGuestToken,
+ getDashboardIdBySlug,
+} from '../../helpers/api/embedded';
+import { EmbeddedPage } from '../../pages/EmbeddedPage';
+import { EMBEDDED } from '../../utils/constants';
+
+/**
+ * MIME types for the static file server
+ */
+const MIME_TYPES: Record<string, string> = {
+ '.html': 'text/html',
+ '.js': 'text/javascript',
+ '.css': 'text/css',
+ '.json': 'application/json',
+};
+
+/**
+ * Superset domain (Flask server) — set by CI or defaults to local dev
+ */
+const SUPERSET_DOMAIN = (() => {
+ const url = process.env.PLAYWRIGHT_BASE_URL || 'http://localhost:8088';
+ return url.replace(/\/+$/, '');
+})();
+
+/**
+ * Path to the SDK bundle built from superset-embedded-sdk/
+ */
+const SDK_BUNDLE_PATH = join(
+ __dirname,
+ '../../../../superset-embedded-sdk/bundle/index.js',
+);
+
+/**
+ * Path to the embedded test app static files
+ */
+const EMBED_APP_DIR = join(__dirname, '../../embedded-app');
+
+/**
+ * Create a minimal static file server for the embedded test app.
+ * Serves HTML from embedded-app/ and the SDK bundle from superset-embedded-sdk/bundle/.
+ */
+function createEmbedAppServer(): Server {
+ return createServer((req: IncomingMessage, res: ServerResponse) => {
+ const urlPath = req.url?.split('?')[0] || '/';
+
+ // Serve SDK bundle at /sdk/index.js
+ if (urlPath === '/sdk/index.js') {
+ if (!existsSync(SDK_BUNDLE_PATH)) {
+ res.writeHead(404);
+ res.end(
+ 'SDK bundle not found. Run: cd superset-embedded-sdk && npm ci && npm run build',
+ );
+ return;
+ }
+ res.writeHead(200, { 'Content-Type': 'text/javascript' });
+ res.end(readFileSync(SDK_BUNDLE_PATH));
+ return;
+ }
+
+ // Serve static files from embedded-app/
+ const filePath = join(
+ EMBED_APP_DIR,
+ urlPath === '/' ? 'index.html' : urlPath,
+ );
+ if (!existsSync(filePath)) {
+ res.writeHead(404);
+ res.end('Not found');
+ return;
+ }
+
+ const ext = extname(filePath);
+ const contentType = MIME_TYPES[ext] || 'application/octet-stream';
+ res.writeHead(200, { 'Content-Type': contentType });
+ res.end(readFileSync(filePath));
+ });
+}
+
+// ─── Test Suite ────────────────────────────────────────────────────────────
+
+test.describe('Embedded Dashboard E2E', () => {
+ let server: Server;
+ let embedUuid: string;
+ let dashboardId: number;
+
+ test.beforeAll(async ({ browser }) => {
+ // Start the embedded test app server
+ server = createEmbedAppServer();
+ await new Promise<void>((resolve, reject) => {
+ server.on('error', reject);
+ server.listen(EMBEDDED.APP_PORT, () => resolve());
+ });
+
+ // Use a fresh page with auth to set up test data via API
+ const context = await browser.newContext({
+ storageState: 'playwright/.auth/user.json',
+ baseURL: SUPERSET_DOMAIN.endsWith('/')
+ ? SUPERSET_DOMAIN
+ : `${SUPERSET_DOMAIN}/`,
+ });
+ const setupPage = await context.newPage();
+
+ try {
+ // Find a well-known example dashboard
+ const id = await getDashboardIdBySlug(setupPage, 'world_health');
+ if (!id) {
+ throw new Error(
+ 'Dashboard "world_health" not found. Ensure load_examples ran in CI setup.',
+ );
+ }
+ dashboardId = id;
+
+ // Enable embedding on the dashboard (empty allowed_domains = allow all)
+ const embedded = await apiEnableEmbedding(setupPage, dashboardId);
+ embedUuid = embedded.uuid;
+ } finally {
+ await context.close();
+ }
+ });
+
+ test.afterAll(async () => {
+ if (server) {
+ await new Promise<void>(resolve => server.close(() => resolve()));
+ }
+ });
+
+ test('dashboard renders in embedded iframe', async ({ page }) => {
+ const embeddedPage = new EmbeddedPage(page);
+
+ // Bridge the guest token from Node.js into the browser
+ await embeddedPage.exposeTokenFetcher(async () => {
+ return getGuestToken(page, String(dashboardId));
+ });
+
+ // Navigate to the embed app
+ await embeddedPage.goto({
+ uuid: embedUuid,
+ supersetDomain: SUPERSET_DOMAIN,
+ });
+
+ // Wait for the iframe to be created by the SDK
+ await embeddedPage.waitForIframe();
+
+ // Verify the iframe src points to Superset's /embedded/ endpoint
+ const iframeSrc = await page
+ .locator('iframe[title="Embedded Dashboard"]')
+ .getAttribute('src');
+ expect(iframeSrc).toContain(`/embedded/${embedUuid}`);
+
+ // Wait for dashboard content to render inside the iframe
+ await embeddedPage.waitForDashboardContent();
+
+ // Verify no errors in the test app
+ const error = await embeddedPage.getError();
+ expect(error).toBe('');
+ });
+
+ test('UI config hideTitle hides dashboard title', async ({ page }) => {
+ const embeddedPage = new EmbeddedPage(page);
+
+ await embeddedPage.exposeTokenFetcher(async () => {
+ return getGuestToken(page, String(dashboardId));
+ });
+
+ await embeddedPage.goto({
+ uuid: embedUuid,
+ supersetDomain: SUPERSET_DOMAIN,
+ hideTitle: true,
+ });
+
+ await embeddedPage.waitForIframe();
+ await embeddedPage.waitForDashboardContent();
+
+ // The iframe URL should include uiConfig parameter
+ const iframeSrc = await page
+ .locator('iframe[title="Embedded Dashboard"]')
+ .getAttribute('src');
+ expect(iframeSrc).toContain('uiConfig=');
+ });
+
+ test('native filters are functional in embedded mode', async ({ page }) => {
+ const embeddedPage = new EmbeddedPage(page);
+
+ await embeddedPage.exposeTokenFetcher(async () => {
+ return getGuestToken(page, String(dashboardId));
+ });
+
+ await embeddedPage.goto({
+ uuid: embedUuid,
+ supersetDomain: SUPERSET_DOMAIN,
+ });
+
+ await embeddedPage.waitForIframe();
+ await embeddedPage.waitForDashboardContent();
+
+ // Verify the filter bar is present in the iframe
+ const frame = embeddedPage.getIframeLocator();
+ const filterBar = frame.locator(
+ '[data-test="filter-bar"], [data-test="dashboard-filters-panel"]',
+ );
+ // The World Health dashboard may or may not have filters,
+ // so we just verify the dashboard rendered without errors
+ const charts = frame.locator(
+ '.chart-container, [data-test="chart-container"]',
+ );
+ await expect(charts.first()).toBeVisible({
+ timeout: EMBEDDED.DASHBOARD_RENDER,
+ });
+ });
+
+ test('allowed_domains blocks unauthorized referrer', async ({ page }) => {
+ // Set up a second embedded config with restricted domains
+ const context = await page
+ .context()
+ .browser()!
+ .newContext({
+ storageState: 'playwright/.auth/user.json',
+ baseURL: SUPERSET_DOMAIN.endsWith('/')
+ ? SUPERSET_DOMAIN
+ : `${SUPERSET_DOMAIN}/`,
+ });
+ const setupPage = await context.newPage();
+
+ try {
+ // Restrict to a domain that is NOT localhost:9000
+ const restrictedEmbed = await apiEnableEmbedding(setupPage, dashboardId, [
+ 'https://allowed.example.com',
+ ]);
+
+ const embeddedPage = new EmbeddedPage(page);
+ await embeddedPage.exposeTokenFetcher(async () => {
+ return getGuestToken(page, String(dashboardId));
+ });
+
+ await embeddedPage.goto({
+ uuid: restrictedEmbed.uuid,
+ supersetDomain: SUPERSET_DOMAIN,
+ });
+
+ // The iframe should load but get a 403 from Superset's referrer check
+ await embeddedPage.waitForIframe();
+
+ // Give the iframe time to receive the response
+ await page.waitForTimeout(3000);
+
+ // The dashboard content should NOT render (403 response)
+ const frame = embeddedPage.getIframeLocator();
+ const content = frame.locator(
+ '.grid-container, [data-test="grid-container"]',
+ );
+ await expect(content).not.toBeVisible({ timeout: 5000 });
+ } finally {
+ // Restore the open embedding config for other tests
+ await apiEnableEmbedding(setupPage, dashboardId, []);
+ await context.close();
+ }
+ });
+
+ test('guest token enables dashboard data access', async ({ page }) => {
+ const embeddedPage = new EmbeddedPage(page);
+
+ let tokenCallCount = 0;
+ await embeddedPage.exposeTokenFetcher(async () => {
+ tokenCallCount++;
+ return getGuestToken(page, String(dashboardId));
+ });
+
+ await embeddedPage.goto({
+ uuid: embedUuid,
+ supersetDomain: SUPERSET_DOMAIN,
+ });
+
+ await embeddedPage.waitForIframe();
+ await embeddedPage.waitForDashboardContent();
+
+ // The SDK should have called fetchGuestToken at least once
+ expect(tokenCallCount).toBeGreaterThanOrEqual(1);
+
+ // Verify charts are actually rendering data (not just loading spinners)
+ const frame = embeddedPage.getIframeLocator();
+ const charts = frame.locator(
+ '.chart-container, [data-test="chart-container"]',
+ );
+ const chartCount = await charts.count();
+ expect(chartCount).toBeGreaterThan(0);
+ });
+});
diff --git a/superset-frontend/playwright/utils/constants.ts b/superset-frontend/playwright/utils/constants.ts
index 7f882d9630d..5d943facb9b 100644
--- a/superset-frontend/playwright/utils/constants.ts
+++ b/superset-frontend/playwright/utils/constants.ts
@@ -59,3 +59,18 @@ export const TIMEOUT = {
*/
FILE_IMPORT: 30000, // 30s for file import operations
} as const;
+
+/**
+ * Embedded dashboard test app configuration.
+ * The test app is served by a Node.js http server started in the test fixture.
+ */
+export const EMBEDDED = {
+ /** Port for the embedded test app static server */
+ APP_PORT: 9000,
+ /** Full URL for the embedded test app */
+ APP_URL: 'http://localhost:9000',
+ /** Timeout for iframe to appear in the DOM */
+ IFRAME_LOAD: 15000, // 15s
+ /** Timeout for dashboard content to render inside the iframe */
+ DASHBOARD_RENDER: 30000, // 30s
+} as const;
diff --git a/tests/integration_tests/superset_test_config.py b/tests/integration_tests/superset_test_config.py
index c16591ed375..38cdbfd253b 100644
--- a/tests/integration_tests/superset_test_config.py
+++ b/tests/integration_tests/superset_test_config.py
@@ -74,10 +74,20 @@ FEATURE_FLAGS = {
"DRILL_TO_DETAIL": True,
"DRILL_BY": True,
"GLOBAL_TASK_FRAMEWORK": True,
+ "EMBEDDED_SUPERSET": True,
}
WEBDRIVER_BASEURL = "http://0.0.0.0:8081/"
+# Enable CORS for embedded dashboard E2E tests (test app on port 9000)
+ENABLE_CORS = True
+CORS_OPTIONS: dict = {
+ "origins": [
+ "http://localhost:9000",
+ ],
+ "supports_credentials": True,
+}
+
def GET_FEATURE_FLAGS_FUNC(ff): # noqa: N802
ff_copy = copy(ff)