Allow embedding dashboards and charts

[rclement]

While the generic /-/dashboards/ experience is fine for most cases, it can be useful to be able to embed either a dashboard or a single chart within an iframe, for instance:

<iframe
    src="/-/dashboards/my-dashboard-1/embed?start_date=2023-01-01&end_date=2023-12-31"
    frameborder="0"
    width="800"
    height="600"
    allowtransparency
>
</iframe>

<iframe
    src="/-/dashboards/my-dashboard-1/my-chart-1/embed?start_date=2023-01-01&end_date=2023-12-31"
    frameborder="0"
    width="800"
    height="600"
    allowtransparency
>
</iframe>

Ideas

Inspired by Metabase dashboard public embedding:

• Define dedicated URLs:
  • Dashboards: /-/dashboards/<dash>/embed
  • Charts: /-/dashboards/<dash>/<chart>/embed
• Dashboards display :
  • Hide header (breadcrumbs)
  • Keep footer ("Powered by Datasette")
  • Keep title, description, filters, charts
• Charts display:
  • Hide everything except the chart

Roadblocks

What about permissions?

• To allow embedding, selected dashboards and charts must be made public
• Dashboards and charts are currently sending requests to Datasette from client-side (JS), opening up the possibility to request other data behind the hood
• How to restrict access to dashboards and charts?
• How to restrict access to a dashboard/chart but enable public embedding?

[rclement]

Also, it would be nice to have a button to display the sharing URL to the user as well as an HTML snippet for webpage embedding.

For instance, here is the popup Metabase opens when clicking on the sharing button:

[rclement]

PR #79 implement dashboards and charts embedding. However, the current implementation does nothing extra regarding the permissions:

• If the Datasette instance has public access, so will embeds
• If the Datasette instance is behind authentication, so will embeds

In the future, we will had some RBAC control for dashboards and charts, and so will embeds, but this will require some more work.