msyavuz opened a new pull request, #44471: URL: https://github.com/apache/superset/pull/44471
### SUMMARY POC for initiative 3.13: the **widget**, not the dashboard, is the unit of embedding. A host app renders Superset widgets as React components, and every query still runs on the server from a stored definition or a validated inline spec, so a guest never sends SQL. - `@apache-superset/widgets` — the v2 builder's widgets, bus and data-client contract, extracted so the builder and a host app render the same components. - Saved widgets + `POST /api/v1/widget/data`; guest tokens gain a `widget` resource type and a `datasets` allowlist for inline specs. - Dashboards persist as node documents (`/api/v1/dashboard_v2`), with view/edit modes in the builder. - Claude artifacts have no network: there widgets read the viewer's own Superset MCP connector, which needs per-user tokens, so `MCP_OAUTH_ENABLED` adds an authorization server (code + PKCE, dynamic registration). - **Extension widgets embed too.** The type names its extension (`extensions.<publisher>.<name>.<type>`), so the page loads that extension's remote entry and hands it a `@apache-superset/core` backed by the embedded widget — the extension is unchanged. ```tsx <SupersetProvider supersetDomain="https://superset.example.com"; fetchGuestToken={mintToken}> <Chart dataBinding={{ datasetId: 17, metrics: ['sum__num'], dimensions: ['state'] }} chartType="bar" /> <Widget id="cedf0501-fa36-4e19-9f84-e9da6d657dcc" /> <Widget type="extensions.acme.widgets.funnel" props={{ dataBinding }} /> </SupersetProvider> ``` Six commits, one concern each; review them in order. ### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF None yet — this adds a package and APIs rather than changing an existing screen. The builder's new "Embed widget" modal and view mode are best seen by running the example app below. ### TESTING INSTRUCTIONS ```bash pytest tests/unit_tests/widgets tests/unit_tests/dashboard_v2 \ tests/unit_tests/extensions tests/unit_tests/mcp_oauth tests/unit_tests/mcp_service cd superset-frontend && npm run test -- packages/superset-widgets ``` End to end: `cd superset-frontend/packages/superset-widgets/example && npm install && npm run dev`, then open http://localhost:5173 logged in to Superset (see that README for the CORS/guest-token config). Widgets there cross-filter each other and respond to the host's own filter bar. In the builder, a widget's menu → *Embed widget* saves it and prints the snippet plus the guest-token claims it needs. ### ADDITIONAL INFORMATION - [x] Has associated issue: No — POC against the `dashboard-v2` feature branch, not `master`. - [x] Required feature flags: `EMBEDDED_SUPERSET` (guest tokens), `ENABLE_EXTENSIONS` + new `EMBEDDED_EXTENSION_ASSETS_PUBLIC` (extension widgets), `MCP_OAUTH_ENABLED` (artifacts). - [x] Changes UI: Yes — the v2 builder gains view/edit modes, save, and an *Embed widget* modal. - [x] Includes DB Migration (follow approval process in [SIP-59](https://github.com/apache/superset/issues/13351)): Yes — two: `saved_widget`, and the MCP OAuth tables. - [x] Migration is atomic, supports rollback & is backwards-compatible: Yes — both only create new tables, nothing existing is read or altered. - [ ] Confirm DB migration upgrade and downgrade tested: No — not exercised yet. POC stage; to be done before this leaves the feature branch. - [ ] Runtime estimates and downtime expectations provided: No — new empty tables, so no backfill, but no timings measured. - [x] Introduces new feature or API: Yes — `@apache-superset/widgets`, `/api/v1/widget/*`, `/api/v1/dashboard_v2/*`, three MCP widget tools, and an MCP OAuth authorization server. - [ ] Removes existing feature or API: No. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
