How to add new header to metabase response

navdeepghai · February 21, 2018, 8:23am

Hi Community,

I wanted to update headers of metabase response while loading metabase.
Is there any reference for achieving this ?

I have full control over server.

Thanks
Navdeep

navdeepghai · February 21, 2018, 1:49pm

I found https://github.com/metabase/metabase/blob/master/src/metabase/middleware.clj#L174 this link after searching from internet, Will it be helpful?
If yes?
Then how I can use it?

AndrewMBaines · February 21, 2018, 4:16pm

What are you trying to achieve?

navdeepghai · February 22, 2018, 3:27am

@AndrewMBaines,

I am trying to update Response Headers.

For example these are default headers in response

200 OK
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Mon, 18 Jul 2016 16:06:00 GMT
Etag: "c561c68d0ba92bbeb8b0f612a9199f722e3a621a"
Keep-Alive: timeout=5, max=997
Last-Modified: Mon, 18 Jul 2016 02:36:04 GMT
Server: Apache
Set-Cookie: mykey=myvalue; expires=Mon, 17-Jul-2017 16:06:00 GMT; Max-Age=31449600; Path=/; secure
Transfer-Encoding: chunked
Vary: Cookie, Accept-Encoding
X-Backend-Server: developer2.webapp.scl3.mozilla.com
X-Cache-Info: not cacheable; meta data too large
X-kuma-revision: 1085259
x-frame-options: DENY

and I want to add one more header like this:
User-Id: Value

Detailed Info:
I am trying to add extension for metabase, In this extension I have to verify the user access. If the user is authorized then I will update response header with value User-Id: Value and give user access to resources.

jornh · February 22, 2018, 7:23am

An extension, interesting Please do share a bit more on how. Maybe there’s room for collaboration?

Let me have a go at it, but be warned, I’m new to Clojure. But maybe we can explore (pair?) together in the style of illiterate programming (originally I think a guy called D. Knuth wrote a book almost with that title). Here we go, with the start of it:

In this function call a bunch of headers are added, some conditionally

github.com

metabase/metabase/blob/master/src/metabase/middleware.clj#L256


"Add HTTP headers to tell browsers not to cache API responses."
[handler]
(fn [request]
  (let [response (handler request)]
    (update response :headers merge (cond
                                      (api-call? request) (api-security-headers)
                                      (public? request)   (html-page-security-headers, :allow-iframes? true)
                                      (embed? request)    (html-page-security-headers, :allow-iframes? true)
                                      (index? request)    (html-page-security-headers))))))




;;; ------------------------------------------------ SETTING SITE-URL ------------------------------------------------


;; It's important for us to know what the site URL is for things like returning links, etc. this is stored in the
;; `site-url` Setting; we can set it automatically by looking at the `Origin` or `Host` headers sent with a request.
;; Effectively the very first API request that gets sent to us (usually some sort of setup request) ends up setting
;; the (initial) value of `site-url`


(defn maybe-set-site-url
"Middleware to set the `site-url` Setting if it's unset the first time a request is made."
[handler]

In this function based on the iframes condition parameter passed from the one above it either adds that DENY header or not to it’s return value:

github.com

metabase/metabase/blob/master/src/metabase/middleware.clj#L241-L243


"X-Permitted-Cross-Domain-Policies" "none"
;; Tell browser not to use MIME sniffing to guess types of files -- protect against MIME type confusion attacks
"X-Content-Type-Options"            "nosniff"}))

So I guess you just want to add merge of (when userisallowed? {"x:userid" theidoftheuserwhoisallowed}) somewhere. Now we just created two new problems for ourselves (I know, the world is so cruel … ):

a function userisallowed returning true when we handle a request from a logged in user.
another one returning the users id.

Right?

But luckily when I was scrolling to the top of that same file I stumbled into a function defn with this nice documentation string:

github.com

metabase/metabase/blob/master/src/metabase/middleware.clj#L130-L136


[handler]
(fn [request]
  (if-let [current-user-id (:metabase-user-id request)]
    (binding [*current-user-id*              current-user-id
              *is-superuser?*                (:is-superuser? request)
              *current-user*                 (delay (db/select-one current-user-fields, :id current-user-id))
              *current-user-permissions-set* (delay (user/permissions-set current-user-id))]

Well, that sure looks very handy… lets see if we can decipher that bit of Clojure?

Looking at it it looks like it’s a Request handler, and that the handler gets passed in a :metabase-user-id Clojure keyword. (Note to self: that’s a term I should look/google up once more, then link from here). At least on some occasions … I hope it the appropriate ones … and I hope/presume it maps to a request header picked up by that [handler] of (fn [request] ... which I’m thinking the code we’re looking at could be referred to as … Now let’s just quickly assume that the handler is tucked nicely away behind some other middleware that guards this handler from being called at all if the user didn’t auth properly.

github.com

metabase/metabase/blob/master/src/metabase/middleware.clj#L139


*  `current-user-permissions-set*` delay that returns the set of permissions granted to the current user from DB"
[handler]
(fn [request]
  (if-let [current-user-id (:metabase-user-id request)]
    (binding [*current-user-id*              current-user-id
              *is-superuser?*                (:is-superuser? request)
              *current-user*                 (delay (db/select-one current-user-fields, :id current-user-id))
              *current-user-permissions-set* (delay (user/permissions-set current-user-id))]
      (handler request))
    (handler request))))




(defn wrap-api-key
"Middleware that sets the `:metabase-api-key` keyword on the request if a valid API Key can be found. We check the
request headers for `X-METABASE-APIKEY` and if it's not found then then no keyword is bound to the request."
[handler]
(comp handler (fn [{:keys [headers] :as request}]
                (if-let [api-key (headers metabase-api-key-header)]
                  (assoc request :metabase-api-key api-key)
                  request))))

So, I guess next step would be to look if the info from the request is already stored away somewhere or we’ll have to do all the legwork to make those ends meet. Anyway … now i have to dash off for work - so it’s gotta be later …

navdeepghai · February 22, 2018, 10:46am

@jornh

This is python based connector which will help user to automate the process for integration of Open Source ERP with Metabase.

Automation:
Install the development or production version of metabase (including all the dependencies using Bash Script) and start the metabase using bash script.

User don’t need to touch physical server. They can install this using HTML forms interaction.

jornh · February 22, 2018, 12:01pm

Aah, sweet! So integration will be on GitHub maybe?

I’ve looked at ERPNext (and a little bit Odoo) for a hobby of mine. A local craft beer brewing association here that I’m a member of. Right now our treasurer is doing everything with Excel … so far we haven’t really been able to find the time to really move on it though…

Oh, and did anything of my “blurp” above make any sense … so far …?

navdeepghai · February 22, 2018, 6:33pm

Yeah, I am building this package now on my local computer, once I finalised the package then I will update it to GitHub as a ERPNext app setup.

once it available to github user just need to clone and install the package to use with ERPNext Everything in one go.
This Metabase is also amazing