Currently when we request a Superset guest token for embedded dashboards (instructor dash and in-context) we request resources for all unlocalized and localized versions of ASPECTS_INSTRUCTOR_DASHBOARDS + ASPECTS_IN_CONTEXT_DASHBOARDS. If the settings are not overridden they will use the values from settings/common.py:
|
def plugin_settings(settings): |
When the LMS requests the token on versions of tutor-contrib-aspects < v2.2.0 the in-context dashboards will not exist. This causes Superset to reject the token request with a 400 error and logs on both Superset and the LMS do not state anything useful to debug the situation. The UI shows only this:
So we have 2 problems to fix:
- In-context dashboards should only be included in settings if the feature is turned on.
- Guest token errors need to a) work and b) explain the potential issue that it may be occurring due to a dashboard missing on the Superset side. This can also happen with certain localization mismatches between LMS and Aspects, and when we remove dashboards from the product.
One possibility to help with all of this is to have different code paths for in-context vs. instructor dash embeds. This is probably better from a security standpoint and would ensure that we're never trying to get a token for dashboards that we're not actually trying to look at.
Currently when we request a Superset guest token for embedded dashboards (instructor dash and in-context) we request resources for all unlocalized and localized versions of
ASPECTS_INSTRUCTOR_DASHBOARDS+ASPECTS_IN_CONTEXT_DASHBOARDS. If the settings are not overridden they will use the values fromsettings/common.py:platform-plugin-aspects/platform_plugin_aspects/settings/common.py
Line 18 in fb0b539
When the LMS requests the token on versions of tutor-contrib-aspects <
v2.2.0the in-context dashboards will not exist. This causes Superset to reject the token request with a 400 error and logs on both Superset and the LMS do not state anything useful to debug the situation. The UI shows only this:So we have 2 problems to fix:
One possibility to help with all of this is to have different code paths for in-context vs. instructor dash embeds. This is probably better from a security standpoint and would ensure that we're never trying to get a token for dashboards that we're not actually trying to look at.