sadpandajoe commented on code in PR #43805:
URL: https://github.com/apache/superset/pull/43805#discussion_r3924122832
##########
superset/dashboards/api.py:
##########
@@ -1807,7 +1838,12 @@ def export_xlsx(self, pk: int) -> WerkzeugResponse:
# otherwise) so the guard works across the web server and workers and
is
# not a no-op under the default cache. The task releases it when it
# settles; the TTL is the backstop if that release is ever lost.
- lock_params = export_lock_params(g.user.id, dashboard.id)
+ # A guest/embedded requester has no DB-backed user id (GuestUser
carries
+ # no ``id`` attribute at all), so all guests share lock slot 0 for the
+ # dashboard; the task reconstructs the guest (with the token's RLS
rules
+ # and resource claims) from the token payload passed alongside.
+ user_id = get_user_id()
+ lock_params = export_lock_params(user_id or 0, dashboard.id)
Review Comment:
All guest sessions use `user_id=0` here, so a second authorized guest
exporting the same dashboard gets a 202 with no job ID and no email path to
retrieve the first guest's export. Can the lock distinguish guest sessions (or
return a usable polling ID for the in-flight export)?
##########
docs/docs/using-superset/exporting-dashboard-data.mdx:
##########
@@ -9,16 +9,18 @@ version: 1
Superset can export every chart on a dashboard to a single Excel workbook, with
each chart's underlying data rendered as its own worksheet. The export reflects
-the dashboard's currently applied filters and runs asynchronously: when it
-finishes, the requesting user receives an email with a time-limited download
-link.
+the dashboard's currently applied filters and runs asynchronously: the page
+polls for completion and downloads the workbook automatically, and a logged-in
+user with an email address also receives a time-limited download link by email.
+Sessions with no email on file — embedded guest-token sessions and anonymous
Review Comment:
These sessions have no email fallback, so they also cannot receive the
later-described list of skipped charts (it is only passed to
`send_export_email`). Can this explain how a guest or Public-role user learns
that part of the requested workbook was omitted?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
