fix: allow viewing shared dashboards without direct table access

frontend/src2/charts/chart.ts

@@ -52,7 +52,7 @@ function makeChart(name: string) {
 		if (!chart.isloaded) return {} as Query
 		return useQuery(chart.doc.data_query)
 	})
-	async function refresh(force?: boolean, reload?: boolean) {
+	async function refresh(force?: boolean, reload?: boolean, dashboard_name?: string) {
 		if (reload) {
 			await chart.load()
 		}
@@ -61,10 +61,19 @@ function makeChart(name: string) {
 			() => chart.isloaded && dataQuery.value.isloaded && useQuery(chart.doc.query).isloaded
 		)
 
+		if (dashboard_name) {
+			dataQuery.value.dashboardName = dashboard_name
+		}
+
 		const isValid = validateConfig()
 		if (!isValid) return
 
 		const query = useQuery('new-query-' + getUniqueId())
+
+		if (dataQuery.value.dashboardName) {
+			query.dashboardName = dataQuery.value.dashboardName
+		}
+
 		addSourceOperation(query)
 		addFilterOperation(query)
 		addChartOperation(query)
@@ -84,7 +93,10 @@ function makeChart(name: string) {
 
 		dataQuery.value.setOperations(copy(query.doc.operations))
 		dataQuery.value.doc.use_live_connection = query.doc.use_live_connection
-		return dataQuery.value.execute(force)
+		if (query.dashboardName) {
+			dataQuery.value.dashboardName = query.dashboardName
+		}
+		return dataQuery.value.execute(force, query.dashboardName)
 	}
 
 	function validateConfig() {

frontend/src2/charts/components/DrillDown.vue

@@ -31,7 +31,11 @@ wheneverChanges(
 		if (show.value) {
 			isQueryReady.value = false
 			nextTick(async () => {
-				await props.query.execute(true)
+				const dashboardName = dashboard?.doc?.name
+				if (dashboardName) {
+					props.query.dashboardName = dashboardName
+				}
+				await props.query.execute(true, dashboardName)
 				isQueryReady.value = true
 			})
 		}

frontend/src2/dashboard/dashboard.ts

@@ -210,7 +210,7 @@ function makeDashboard(name: string) {
 	function refreshChart(chart_name: string, force = false) {
 		const chart = useChart(chart_name)
 		chart.dataQuery.adhocFilters = getAdhocFilters(chart_name)
-		chart.refresh(force)
+		chart.refresh(force, false, dashboard.doc.name)
 	}
 
 	function getAdhocFilters(chart_name: string) {
@@ -307,6 +307,7 @@ function makeDashboard(name: string) {
 			column_name: column,
 			search_term,
 			adhoc_filters: adhocFilters,
+			dashboard_name: dashboard.doc.name
 		})
 	}
 

frontend/src2/query/query.ts

@@ -129,7 +129,13 @@ export function makeQuery(name: string) {
 	}
 
 	const adhocFilters = ref<AdhocFilters>()
-	async function execute(force: boolean = false) {
+	const dashboardName = ref<string>()
+	async function execute(force: boolean = false, dashboard_name?: string) {
+
+		if (dashboard_name) {
+			dashboardName.value = dashboard_name
+		}
+
 		if (!query.islocal) {
 			await waitUntil(() => query.isloaded)
 		}
@@ -156,6 +162,7 @@ export function makeQuery(name: string) {
 				active_operation_idx: activeOperationIdx.value,
 				adhoc_filters: adhocFilters.value,
 				force,
+				dashboard_name: dashboardName.value,
 			})
 			.then((response: any) => {
 				if (!response) return
@@ -567,7 +574,7 @@ export function makeQuery(name: string) {
                         currentDownloadToken.value = null
                     }
                 })
-		}	
+		}
 
 		_downloadResults()
 	}
@@ -593,6 +600,7 @@ export function makeQuery(name: string) {
 			column_name: column,
 			search_term,
 			limit,
+			dashboard_name: dashboardName.value
 		})
 	}
 
@@ -700,6 +708,11 @@ export function makeQuery(name: string) {
 		const drill_down_query = useQuery('new-query-' + getUniqueId())
 		drill_down_query.doc.title = 'Drill Down'
 		drill_down_query.doc.use_live_connection = query.doc.use_live_connection
+
+		if (dashboardName.value) {
+			drill_down_query.dashboardName = dashboardName.value
+		}
+
 		drill_down_query.autoExecute = true
 
 		let filters: FilterArgs[] = []
@@ -821,6 +834,11 @@ export function makeQuery(name: string) {
 	) {
 		const drill_down_query = useQuery('new-query-' + getUniqueId())
 		drill_down_query.doc.title = 'Drill Down'
+
+		if (dashboardName.value) {
+			drill_down_query.dashboardName = dashboardName.value
+		}
+
 		drill_down_query.autoExecute = true
 		drill_down_query.doc.workbook = query.doc.workbook
 		drill_down_query.doc.use_live_connection = query.doc.use_live_connection
@@ -937,6 +955,7 @@ export function makeQuery(name: string) {
 		currentOperations,
 		activeEditOperation,
 		adhocFilters,
+		dashboardName,
 
 		autoExecute,
 		executing,

insights/insights/doctype/insights_dashboard_v3/insights_dashboard_v3.py

@@ -80,16 +80,17 @@ def set_linked_charts(self):
         )
 
     @frappe.whitelist()
-    def get_distinct_column_values(self, query, column_name, search_term=None, adhoc_filters=None):
+    def get_distinct_column_values(self, query, column_name, search_term=None, adhoc_filters=None, dashboard_name=None):
         is_guest = frappe.session.user == "Guest"
         if is_guest and not self.is_public:
             raise frappe.PermissionError
 
         self.check_linked_filters(query, column_name)
 
         doc = frappe.get_cached_doc("Insights Query v3", query)
+        dashboardname = dashboard_name or self.name
         return doc.get_distinct_column_values(
-            column_name, search_term=search_term, adhoc_filters=adhoc_filters
+            column_name, search_term=search_term, adhoc_filters=adhoc_filters, dashboard_name=dashboardname
         )
 
     def check_linked_filters(self, query, column_name):

insights/insights/doctype/insights_query_v3/insights_query_v3.py

@@ -108,7 +108,21 @@ def build(self, active_operation_idx=None, use_live_connection=None):
         return ibis_query
 
     @frappe.whitelist()
-    def execute(self, active_operation_idx=None, adhoc_filters=None, force=False):
+    def execute(self, active_operation_idx=None, adhoc_filters=None, force=False, dashboard_name=None):
+        if dashboard_name:
+            from insights.permissions import InsightsPermissions
+            permissions = InsightsPermissions()
+            allowed_tables = permissions.get_dashboard_query_tables(
+                dashboard_name,
+                query_name=self.name
+            )
+            if allowed_tables:
+                frappe.flags.permitted_dashboard_tables = allowed_tables
+            else:
+                return
+        else:
+            return
+
         with set_adhoc_filters(adhoc_filters):
             ibis_query = self.build(active_operation_idx)
 
@@ -186,7 +200,21 @@ def get_distinct_column_values(
         search_term=None,
         limit=20,
         adhoc_filters=None,
+        dashboard_name=None,
     ):
+
+        if dashboard_name:
+            from insights.permissions import InsightsPermissions
+            permissions = InsightsPermissions()
+            allowed_tables = permissions.get_dashboard_query_tables(
+                dashboard_name=dashboard_name,
+                query_name=self.name
+            )
+            if allowed_tables:
+                frappe.flags.permitted_dashboard_tables = allowed_tables
+            else:
+                return
+
         with set_adhoc_filters(adhoc_filters):
             ibis_query = self.build(active_operation_idx)
 

insights/insights/doctype/insights_team/insights_team.py

@@ -269,16 +269,19 @@ def check_table_permission(data_source, table, user=None, raise_error=True):
     table_name = get_table_name(data_source, table)
     allowed_tables = get_allowed_resources_for_user("Insights Table v3", user)
 
-    if table_name not in allowed_tables:
-        if raise_error:
-            frappe.throw(
-                "You do not have permission to access this table",
-                exc=frappe.PermissionError,
-            )
-        else:
-            return False
+    if table_name in allowed_tables:
+        return True
 
-    return True
+    permitted_tables = getattr(frappe.flags, "permitted_dashboard_tables", None)
+    if permitted_tables and table_name in permitted_tables:
+        return True
+
+    if raise_error:
+        frappe.throw(
+            "You do not have permission to access this table",
+            exc=frappe.PermissionError,
+        )
+    return False
 
 
 def get_table_restrictions(data_source, table, user=None):