sadpandajoe commented on code in PR #43805:
URL: https://github.com/apache/superset/pull/43805#discussion_r4076968939
##########
docs/static/resources/openapi.json:
##########
@@ -18435,6 +18438,76 @@
]
}
},
+ "/api/v1/dashboard/export_xlsx/download/{job_id}/": {
+ "get": {
+ "description": "Intentionally requires no login: the unguessable
job_id, emailed only to the original requester (or handed to their own session
via export_xlsx_status), is the credential. The dashboard access check already
ran once, when the export was requested -- see
security_manager.raise_for_access in export_xlsx. The file streams through
Superset with the deployment's own storage credentials instead of redirecting
to a signed storage URL, so it works for ambient identities that cannot sign
(e.g. workload identity federation) and never mints a bearer URL Superset
cannot observe or revoke.",
+ "parameters": [
+ {
+ "description": "The job_id from the export_xlsx response",
+ "in": "path",
+ "name": "job_id",
+ "required": true,
+ "schema": {
+ "format": "uuid",
+ "type": "string"
+ }
+ }
+ ],
+ "responses": {
+ "200": {
+ "description": "The .xlsx file as an attachment"
+ },
+ "410": {
+ "description": "The link is unknown, expired, or the export failed"
+ },
+ "501": {
+ "description": "Excel export is not configured on this server"
+ }
+ },
+ "security": [],
+ "summary": "Download a completed dashboard Excel export",
+ "tags": [
+ "Dashboards"
+ ]
+ }
+ },
+ "/api/v1/dashboard/export_xlsx/status/{job_id}/": {
+ "get": {
+ "description": "For a session with no email address to be notified at
(e.g. an embedded/guest session), the frontend polls this endpoint with the
job_id from the export_xlsx response instead of waiting for an email. Behind
the same @protect() as the export request itself, unlike the login-free
download_xlsx stream (which also has to work when clicked from a plain email
link, possibly with no active session at all).",
+ "parameters": [
+ {
+ "description": "The job_id from the export_xlsx response",
+ "in": "path",
+ "name": "job_id",
+ "required": true,
+ "schema": {
+ "format": "uuid",
+ "type": "string"
+ }
+ }
+ ],
+ "responses": {
+ "200": {
+ "description": "Job status: {\"status\": \"pending\"} while
queued, {\"status\": \"running\"} once a worker has started executing,
{\"status\": \"ready\", \"download_url\": \"...\"} once the file is available,
or {\"status\": \"error\", \"message\": \"...\"} if the export failed."
+ },
+ "401": {
Review Comment:
This protected endpoint can return 403 when the caller lacks `can_export`,
but the generated OpenAPI only documents 200 and 401. Could this include the
standard 403 response so clients can handle a permission denial correctly?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
