MW-1449 - Superset embedded dashboard support

[dszafranek]

Replaces the legacy superset-patchup OAuth flow with guest token authentication compatible with Superset 6.0 and the new SolDeveloreporting stack. WIP until the reporting stack integration is tested and merged.

Summary

• Add GET /api/reports/superset/guest-token endpoint that proxies guest token requests to Superset
• Add embeddedUuid field to DashboardReport entity for storing Superset embedded dashboard UUIDs
• Add SupersetService for Superset API communication (login, CSRF, guest token)

[sonarqubecloud]

Quality Gate passed

Issues
9 New issues
0 Accepted issues

Measures
0 Security Hotspots
91.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[mgrochalskisoldevelo]

Two points:

• CHANGELOG entry is missing.
• The migration timestamp doesn't match the existing convention. Existing migrations follow the yyyyMMddHHmmssSSS pattern (14 characters), but the new one is 20260401000000000__... (17 characters). The easiest fix is to regenerate it using the Gradle task, which produces the correct format automatically:
  • docker compose run --service-ports report
  • gradle generateMigration -PmigrationName=name_of_migration
• Please avoid hardcoded English error messages - I'd recommend throwing with a generic message key instead of including the raw csrfBody in the exception.

Also what are your thoughts on these?

• Do we actually need defaults for superset.admin.user and superset.admin.password? If not, I'd drop them from the config and require them via environment variables only.
• A couple of thoughts on SupersetGuestTokenController.getGuestToken:
  • It might be worth looking up the dashboard_reports row by embedded_uuid and returning 404 if it's missing, rather than passing the request through unconditionally.
  • Optionally, we could check the user's role and permissions against which dashboards they're allowed to see. This may be follow-up scope rather than something for this PR - just flagging.

[sonarqubecloud]

Quality Gate passed

Issues
11 New issues
0 Accepted issues

Measures
0 Security Hotspots
89.1% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[dszafranek]

Two points:

• CHANGELOG entry is missing.

• The migration timestamp doesn't match the existing convention. Existing migrations follow the yyyyMMddHHmmssSSS pattern (14 characters), but the new one is 20260401000000000__... (17 characters). The easiest fix is to regenerate it using the Gradle task, which produces the correct format automatically:

  • docker compose run --service-ports report
  • gradle generateMigration -PmigrationName=name_of_migration

• Please avoid hardcoded English error messages - I'd recommend throwing with a generic message key instead of including the raw csrfBody in the exception.

Also what are your thoughts on these?

• Do we actually need defaults for superset.admin.user and superset.admin.password? If not, I'd drop them from the config and require them via environment variables only.

• A couple of thoughts on SupersetGuestTokenController.getGuestToken:

  • It might be worth looking up the dashboard_reports row by embedded_uuid and returning 404 if it's missing, rather than passing the request through unconditionally.
  • Optionally, we could check the user's role and permissions against which dashboards they're allowed to see. This may be follow-up scope rather than something for this PR - just flagging.

Thanks for the review. Changes made:

• I added the changelog
• I modified the migration file name, it's generated with the gradle task now. Note that it is still 17 characters not 14, all other migrations in this repo follow the same convention. Please let me know if I'm missing something here
• Error messages are localized now

From your "optional" suggestions:

• Good point on the defaults, it's better to skip it. I removed default superset login/password. I left it as an empty string so that the service still builds for implementations that do not want to use superset. I also added a check in SupersetService.getGuestToken to make sure to throw an exception when credentials are empty
• I modified getGuestToken method to throw NotFoundMessageException if no dashboard matches
• I added simple permission check by using "permissionService.canViewReports()". I think if we need anything more complex it should be handled by a separate ticket like you suggested.

@mgrochalskisoldevelo Could you please review again?

[mgrochalskisoldevelo]

lgtm