deepujain opened a new pull request, #44558:
URL: https://github.com/apache/superset/pull/44558
### SUMMARY
Add an opt-in `png` format to `get_chart_preview` for saved charts,
addressing the rendered-image part of #41114. The response includes base64 PNG
bytes and the decoded image dimensions. Existing formats and the ASCII default
are unchanged.
The browser authenticates as the caller after chart and image-export
authorization. Each capture owns its browser and MCP ORM session; no shared
thumbnail cache or report executor is used. Guest users, unsaved chart state
and extra dashboard filters return an explicit unsupported-format error for
PNG. The additional metadata requested in #41114 remains separate work.
### BEFORE/AFTER SCREENSHOTS OR ANIMATED GIF
Not applicable to existing UI: this adds an MCP response format. A local
real-Chromium fixture rendered two concurrent caller-specific SVG pages through
the production machine-auth cookie path and verified distinct images and
identities.
### TESTING INSTRUCTIONS
With Playwright/Chromium installed on the MCP host and `WEBDRIVER_BASEURL`
pointing to Superset, call `get_chart_preview` with `{"identifier":
<saved-chart-id>, "format": "png"}`. Decode `content.data` as base64 PNG. Check
that it renders the saved chart as the calling user, and that a user without
chart access cannot capture it. Try guest auth, `form_data_key`, extra filters,
and viewport dimensions outside 64..4096; those requests must be rejected.
Local validation:
- Preview and adjacent WebDriver suites: `pytest
tests/unit_tests/mcp_service/chart/tool/test_get_chart_preview.py
tests/unit_tests/utils/webdriver_test.py -q`, 161 passed.
- The ORM regression failed against the initial implementation that copied
the parent session token; it passes with a distinct worker session and the
parent entity still attached after capture.
- Real Chromium and production machine-auth cookies exercised concurrently
against a local Flask/SVG fixture. Chart lookup and permission decisions were
stubbed in that fixture; this was not an end-to-end SQL/RLS dataset test.
- Staged `pre-commit run` passed, including mypy, Ruff and pylint.
Capture uses configured screenshot timeouts. Cancelling an MCP request does
not immediately interrupt the worker; its browser is closed when the capture
finishes or fails.
### ADDITIONAL INFORMATION
- [x] Has associated issue: #41114
- [ ] Required feature flags:
- [ ] Changes UI
- [ ] Includes DB Migration (follow approval process in
[SIP-59](https://github.com/apache/superset/issues/13351))
- [ ] Migration is atomic, supports rollback & is backwards-compatible
- [ ] Confirm DB migration upgrade and downgrade tested
- [ ] Runtime estimates and downtime expectations provided
- [x] Introduces new feature or API
- [ ] Removes existing feature or API
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
