sadpandajoe commented on code in PR #43805:
URL: https://github.com/apache/superset/pull/43805#discussion_r3937167338
##########
docs/docs/using-superset/exporting-dashboard-data.mdx:
##########
@@ -72,33 +91,46 @@ will not register.
## Configuration keys
-| Key | Default | Description
|
-| ------------------------------- | ---------------------- |
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
|
-| `EXCEL_EXPORT_S3_BUCKET` | `None` | Destination
bucket. Required; `501` if unset.
|
-| `EXCEL_EXPORT_S3_KEY_PREFIX` | `"dashboard-exports/"` | Key prefix:
`{prefix}{dashboard_id}/{job_id}.xlsx`.
|
-| `EXCEL_EXPORT_LINK_TTL_SECONDS` | `86400` | Lifetime of the
pre-signed download URL (24h).
|
-| `EXCEL_EXPORT_S3_CLIENT_KWARGS` | `{}` | Extra kwargs for
`boto3.client("s3", ...)` — e.g. `region_name`, or `endpoint_url` for
MinIO/LocalStack.
|
-| `EXCEL_EXPORT_TABLE_VIZ_TYPES` | `None` | Viz types kept
tabular in **Export Images to Excel** mode; every other type is embedded as an
image. `None` uses the built-in default (`table`, `pivot_table`,
`pivot_table_v2`). |
-| `EXCEL_EXPORT_QUERY_CONTEXT_BUILDER` | `None` | Optional
`Callable[[form_data_dict], dict \| None]` to build a query context for a chart
missing a saved one, tried before the built-in form-data rebuild. Point it at a
service that runs the chart's real frontend `buildQuery` to faithfully export
viz types the built-in rebuild can't handle. Must return `None` when it can't
build faithfully, so the export falls back. |
-
-Credentials and region resolve through the standard boto3 chain (environment
-variables, shared config, or instance role) unless overridden via
-`EXCEL_EXPORT_S3_CLIENT_KWARGS`. The worker needs `s3:PutObject` on the bucket.
+| Key | Default |
Description
|
+| -------------------------------------- | ---------------------- |
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
|
+| `EXPORT_STORAGE["bucket"]` | unset |
Destination bucket. Required; `501` if unset.
|
+| `EXPORT_STORAGE["backend"]` | unset | Storage
backend instance: `S3ExportStorage()` (`superset.utils.s3`),
`GCSExportStorage()` (`superset.utils.gcs`), or a custom
`superset.utils.export_storage.ExportStorage` implementation. Required; `501`
if unset. |
+| `EXPORT_STORAGE["key_prefix"]` | `"dashboard-exports/"` | Object
key/blob prefix: `{prefix}{dashboard_id}/{job_id}.xlsx`. A callable (`() ->
str`) is invoked per export, for prefixes only known in request/task context
(e.g. per-tenant scoping of a shared bucket). |
+| `EXCEL_EXPORT_LINK_TTL_SECONDS` | `86400` | Lifetime
of the Superset download link (24h) shared in the email and polling response.
Each click streams the file from storage through Superset. Guest-token exports
cap the link at one hour regardless of this value, since a guest retrieves the
file within the polling window and has no email link to revisit later. |
+| `EXCEL_EXPORT_TABLE_VIZ_TYPES` | `None` | Viz types
kept tabular in **Export Images to Excel** mode; every other type is embedded
as an image. `None` uses the built-in default (`table`, `pivot_table`,
`pivot_table_v2`). |
+| `EXCEL_EXPORT_QUERY_CONTEXT_BUILDER` | `None` | Optional
`Callable[[form_data_dict], dict \| None]` to build a query context for a chart
missing a saved one, tried before the built-in form-data rebuild. Point it at a
service that runs the chart's real frontend `buildQuery` to faithfully export
viz types the built-in rebuild can't handle. Must return `None` when it can't
build faithfully, so the export falls back. |
+
+Credentials resolve through each SDK's standard chain — for S3, environment
+variables, shared config, or an instance role, with overrides available via
+`S3ExportStorage(client_kwargs={...})` (e.g. `region_name`, or `endpoint_url`
+for MinIO/LocalStack); for GCS, Application Default Credentials. Two tiers
+need bucket access, which matters when they run under separate identities:
+the **Celery worker** uploads the file (write, e.g. `s3:PutObject`), while
+the **web server** streams it back at download time (read, e.g.
+`s3:GetObject`; on S3 also grant `s3:ListBucket`, or a lifecycle-expired
+object surfaces as AccessDenied instead of a clean "link expired"). No
+signing permissions are needed on either tier: downloads stream through
+Superset rather than redirecting to a signed storage URL.
## Security considerations
-- The emailed link is a **pre-signed S3 URL**: anyone who holds it can download
- the workbook until it expires. Keep the bucket **private**, enable
- encryption, and consider a lifecycle rule to delete objects after a few days.
- Lower `EXCEL_EXPORT_LINK_TTL_SECONDS` if 24 hours is too long for your data.
+- The download link is an unguessable Superset URL: anyone who holds it can
+ download the workbook until the link expires, and every download streams
+ through Superset (never a transferable signed storage URL). Keep the bucket
+ **private**, enable encryption, and consider a lifecycle rule to delete
+ objects after a few days. Lower `EXCEL_EXPORT_LINK_TTL_SECONDS` if 24 hours
+ is too long for your data.
- The export runs with the requesting user's permissions; each chart's query is
access-checked, so users only ever receive data they are entitled to.
## Limitations
-- **Embedded dashboards / guest tokens are not supported** in this version,
- because guest users have no email address to deliver the link to. Logged-in
- users viewing an embedded dashboard can still use the export.
+- **Embedded guest-token sessions get the polling download only.** The export
+ runs under the guest token's RLS rules and resource claims, and the page
+ polls for completion and downloads automatically — but there is no email
+ fallback, so the browser tab must stay open until the export finishes.
+ **Export Images to Excel** is not available to guests (the webdriver cannot
Review Comment:
The Public-role path has no user ID as well, so it is also hidden by the
frontend and rejected by `export_xlsx` for `mode="images"`; this wording says
only guest sessions lack the option. Could this limitation include
anonymous/Public-role users so operators do not enable the webdriver flags
expecting that flow to work?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
