bito-code-review[bot] commented on code in PR #36933: URL: https://github.com/apache/superset/pull/36933#discussion_r2932239891
########## superset/mcp_service/embedded_chart/schemas.py: ########## @@ -0,0 +1,101 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +from datetime import datetime +from typing import Any + +from pydantic import BaseModel, Field + +# Import the same ChartConfig used by generate_chart +from superset.mcp_service.chart.schemas import ChartConfig + + +class GetEmbeddableChartRequest(BaseModel): + """Request schema for get_embeddable_chart tool. + + Uses the same simplified ChartConfig schema as generate_chart for consistency. + """ + + datasource_id: int | str = Field( + ..., + description="Dataset ID (numeric) or UUID", + ) + config: ChartConfig = Field( + ..., + description=( + "Chart configuration using simplified schema. Use chart_type='xy' for " + "line/bar/area/scatter charts, or chart_type='table' for tables. " + 'Example: {"chart_type": "xy", "x": {"name": "genre"}, ' + '"y": [{"name": "sales", "aggregate": "SUM"}], "kind": "bar"}' + ), + ) + ttl_minutes: int = Field( + default=60, + ge=1, + le=10080, # max 1 week + description="Permalink TTL in minutes (default: 60, max: 10080 = 1 week)", + ) + height: int = Field( + default=400, + ge=100, + le=2000, + description="Chart height in pixels for iframe (default: 400)", + ) + rls_rules: list[dict[str, Any]] = Field( + default_factory=list, + description="Row-level security rules to apply to the guest token", + ) + allowed_domains: list[str] = Field( Review Comment: <!-- Bito Reply --> No, the suggestion to change allowed_domains to list[HttpUrl] isn’t fully correct — it would require full URLs like 'https://example.com', but the embedding use case supports bare hostnames (e.g., 'localhost:3000', 'example.com') for domain matching. API validation at lines 247-252 ensures it's a list of strings, and same_origin() handles scheme/port normalization by comparing hosts. **superset/embedded_chart/api.py** ``` # Validate allowed_domains is a list of strings if not isinstance(allowed_domains, list) or not all( isinstance(d, str) for d in allowed_domains ): return self.response_400( message="allowed_domains must be a list of strings" ) ``` **superset/embedded_chart/api.py** ``` def same_origin(url1: str | None, url2: str | None) -> bool: """Check if two URLs have the same origin (scheme + netloc).""" if not url1 or not url2: return False parsed1 = urlparse(url1) parsed2 = urlparse(url2) # For domain matching, we just check if the host matches # url2 might just be a domain like "example.com" ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
