Error when embedding explore-assistant-extension within application

[jamesjsq]

Hey all, we've recently been working with the looker-explore-assistant within looker. We've been able to add customizations, connect to data providers and run prompts successfully. However, when attempting to plugin the extension to our application after successfully authenticating and creating an authenticated embed url via looker sdk, we are encountering the following error:

Error

On it's own, this error is pretty generic. However, after digging into the network tab, after a few successful authenticated calls to the looker api from the browser, I notice network requests to {looker_instance}/api/internal/core/4.0/sql_queries are returning a 404. However, requests to other endpoints such as /api/internal/session/heartbeat and /api/internal/core/4.0/folders/search return 200 from the browse.

This is interesting, because i never noticed these issues when using the extension directly within looker or when calling the extension directly within an iframe (this isn't a viable solution).

Configuration

Our bundle.js was build using the following env variables (with some values redacted):

VERTEX_AI_ENDPOINT=https://super-secret-cloud-functioncloudfunctions.net/explore-assistant-api
VERTEX_CF_AUTH_TOKEN=SOME-TOKEN
VERTEX_BIGQUERY_LOOKER_CONNECTION_NAME=SOME-NAME
BIGQUERY_EXAMPLE_PROMPTS_CONNECTION_NAME=bigquery
BIGQUERY_EXAMPLE_PROMPTS_DATASET_NAME=explore_assistant

Our manifest.lkml looks like this:

application: explore_assistant {
    label: "Looker GenAI"
    # url: "https://localhost:8080/bundle.js"
    file: "bundle.js"
    entitlements: {
      core_api_methods: ["lookml_model_explore","create_sql_query","run_sql_query","run_query","create_query"]
      navigation: yes
      use_embeds: yes
      use_iframes: yes
      new_window: yes
      new_window_external_urls: ["https://developers.generativeai.google/*"]
      local_storage: yes
      external_api_urls: ["https://super-secret-cloud-function.cloudfunctions.net/explore-assistant-api"]
    }
   }

UPDATE: I've determined that isn't related to the config described above, the issue occurs because embed users have a limited subset of permissions compared to standard users. Ie. they do not have the appropriate permissions hit the api/internal/core/4.0/sql_queries, since this requires use_sql_runner.

Note: in my search I also encountered this PR that is also attempting to bypass that endpoint due to permissions issues.

Questions

1. Are there any known workarounds for getting this to work with signed embeds?
2. Was this extension intentionally built so that it wouldn't work with signed embeds?