Superset 4.1.0RC2 - New Sankey charts cannot be embedded = "Guest user cannot modify chart payload"

[nemccarthy]

Bug description

When adding the new ECharts version of the Sankey to a dashboard that is embedded using the embedding SDK using a guest user token the chart will not render with error Guest user cannot modify chart payload

How to reproduce the bug

1. Create a new Sankey chart
2. Create a new dashboard and add the Sankey chart to the new dash
3. Embed the dashboard into a web app using the embed functionality in Superset to get the embedding ID and add it using the embedding SDK.
4. Create a guest token using the embedding SDK
5. Load the page as a guest user (loading chart not logged in the superset UI works fine)

Screenshots/recordings

Superset version

master / latest-dev

Python version

3.9

Node version

18 or greater

Browser

Chrome

Additional context

No response

Checklist

• [X] I have searched Superset docs and Slack and didn't find a solution to my problem.
• [X] I have searched the GitHub issue tracker and didn't find a similar bug report.
• [X] I have checked Superset's logs for errors and if I found a relevant Python stacktrace, I included it here as text in the "additional context" section.

[dosubot[bot]]

I found a similar open issue: 4.0 - Imported charts shows error on embedding, which was last updated on September 04, 2024. This issue is related to the error "Guest user cannot modify chart payload" when embedding charts.

The error occurs because guest users are not allowed to modify the chart payload. This restriction is enforced to prevent guest users from requesting different charts or ad-hoc metrics from what is saved. The relevant code snippet checks if the user is a guest and if the query context has been modified. If both conditions are true, it raises a SupersetSecurityException with the message "Guest user cannot modify chart payload" ^[1].

To address this issue, you can automate the update of the query_context for each chart. This can be achieved by either directly interacting with the Superset backend database or using Superset's REST API to fetch and update charts. Here’s a brief overview of both approaches:

1. Direct Database Manipulation: Write a script that connects to the Superset database, fetches all charts, updates the query_context field in their metadata, and saves the changes back to the database. This method requires direct access to the database and careful handling to avoid data corruption.

2. Using Superset APIs: A safer, albeit potentially slower, method involves using the Superset REST API. You would use the GET /chart/ endpoint to fetch chart configurations, update the query_context in each configuration, and then use the PUT /chart/{pk} endpoint to update each chart.

Here’s a simplified example of how you might use Python to update chart metadata using Superset’s API:

import requests

SUPSERET_API_URL = "http://your-superset-instance/api/v1/chart"
API_TOKEN = "your_api_token"

def update_chart(chart_id, updated_config):
    headers = {"Authorization": f"Bearer {API_TOKEN}"}
    response = requests.put(f"{SUPSERET_API_URL}/{chart_id}", json=updated_config, headers=headers)
    if response.status_code == 200:
        print(f"Successfully updated chart {chart_id}")
    else:
        print(f"Failed to update chart {chart_id}: {response.text}")

# Example usage
chart_id = 123  # Example chart ID
updated_config = {
    # Your updated chart configuration including the new query_context
}
update_chart(chart_id, updated_config)

This script is a basic example and will need to be adjusted based on your specific requirements, including authentication and the exact structure of the updated_config ^[2].

Additionally, the Superset Embedded SDK documentation explains that embedded resources use a special auth token called a Guest Token to grant Superset access to your users without requiring them to log in directly. The guest token allows authentication to your Superset instance via creating an Anonymous user object, which defaults to the public role. This setup ensures that guest users have limited permissions, including restrictions on modifying chart payloads ^[3].

To continue talking to Dosu, mention @dosu.

[rusackas]

@betodealmeida I know you'd done some work around an error with the same text. Not sure if we "missed a spot," this is something new, or there's a fix coming in RC3. CC @sadpandajoe who may also have context here.

[sadpandajoe]

@nemccarthy does this work with the legacy sankey chart?

[sadpandajoe]

@nemccarthy do you also have logs? I wasn't able to reproduce this on one of my embedded dashboards and it shows up just fine.