Co-authored-by: Ryan Laurie <iethree@gmail.com>

* add allowed iframe host setting wip

* use allowed-iframe-hosts setting in the CSP header

* add a test for the frame-src csp directive

* Update allowed-iframe-hosts setting definition

* Add error state for forbidden iframe url domains

* Move out iframe e2e test suite

* Add e2e test

* Update error message in view mode

* Fix unit tests

* Update setting on the admin page

* Update error state

* Add links to error states

* Update docs links

* Update link anchors

* Add default allowed hosts to public setting

* Update allowed domain check logic

* Fix default value display in admin page

* Don't update setting without changes

* Update error message spacing

* correct the parsing of allowed-hosts string for CSP header entries

* fix test

* fix not handling wildcard ports

* Fix failing e2e test

* Fix subdomain test

* address review

 - the parse-allowed-iframe-hosts fn is now memoized
 - a * entry is handled and doesn't produce a weird *:* entry
 - no more try/catch, errors in parsing will be logged but the list returns all valid entries
 - when www. is encountered, an entry including www. is added
 - trailing / is 'cleaned' and the entry is used as if there was no trailing /

* Fixup test for expecting a few more frame sources

* indentation fix for linter 



* Fix type error

---------

Co-authored-by: Adam James <adam.vermeer2@gmail.com>
Co-authored-by: Anton Kulyk <kuliks.anton@gmail.com>
Co-authored-by: dan sutton <dan@dpsutton.com>

* ui implementation of new emb homepage, tests will come later

* change padding of the last card to be consistent with the top one

* update beta badge spacing

* update tests

* fix stories type error

* use quick-start for url

* update HomeContent tests

* update events + related e2e

* Update frontend/src/metabase/home/components/EmbedHomepage/StaticEmbedContent.tsx

* Do not create personal collections for API keys

Co-authored-by: Noah Moss <32746338+noahmoss@users.noreply.github.com>

* Add `graph.max_categories` viz setting

* Allow grouping series into "other" category

* Add tooltip

* Toggle "other" series visibility

* WIP: new implementation for `graph.series_order`

* Remove not used function

* Make "other" series a regular `SeriesModel`

* Fix stacked bar charts

* Remove colors from "other" tooltip

* Sort "other" tooltip values

* Update `graph.max_categories` setting

- negative number validation
- 0 value turns off grouping

* Fix Loki test

* Add basic loki test

* Add loki test for stacked chart

* Add loki test for stacked normalized chart

* slight refactor of series_order setting

* Add screenshots

* Handle different kinds of aggregations for "other"

* Handle different aggregation kinds in tooltips

* Add `graph.other_series_aggregation_fn` viz setting

* Fix type errors

* Fix unit tests

* settings ui

* remove sorting by value to match series order setting, other color

* hide grouped series controls

* Add e2e test

* Update screenshots

* Fix incorrect series grouping for stacked charts

* group series into other settings

* Update e2e test to work with new viz settings

* Disable drills for the "Other" series

* fix max_categories setting popover positioning

* fix total row has misaligned columns on other series values

* Remove redundant `click({ force: true })`

* Rename aggregation fn viz setting

* Move aggregation fn setting to the popover

* WIP

* Update popover

* Fix `it.only`

* Fix legend sync issue

* Disable "Other" category by default (temporary)

* Enable aggregation fn picker for MBQL queries (temporary)

* Move "Other" category summary to a tooltip row

* Add `graph.max_categories_enabled` to viz settings type

* Reuse already computed "Other" value in tooltips

* Add null check

* Fix series length check

---------

Co-authored-by: Aleksandr Lesnenko <alxnddr@gmail.com>

This is to allow for the possibiliy of adding more metricsv2 usage and error metrics in the future while still
distinguishing the source of the errors.

### Description

This is a low level step towards applying table-level permissions to native queries.

It replaces the more generic and powerful `:ast-walker-1` analyzer with the more conservative `:basic-select` version we recently landed. The advantage of this version is that it protects against dynamic table references and false negatives due to masking.

This was throwing errors trying to `nippy/freeze!` an Atom.

That was because in certain circumstances a pMBQL query can end up in
`(:json_query metadata)` for a query, and those can contain an atom
due to `metabase.lib.cache` and both `CachedMetadataProvider` and
`InvocationTracker`.

I added `lib.query/serializable` as a single location to strip out
anything that isn't serializable, such as atoms. (And the entire
`:lib/metadata`, which is a wasted effort to serialize.)

* cumulative changes

* Apply suggestions from code review

Co-authored-by: Jeff Bruemmer <jeff.bruemmer@gmail.com>

---------

Co-authored-by: Jeff Bruemmer <jeff.bruemmer@gmail.com>

* Add `use-temp-storage` hook

* Remove try/catch

* Add reducer

* Add tests

* Use RTK to create a new slice and reducer

* improve pie-sunburst chart labels visibility algo

* specs, docs

* Update Loki Snapshots

* handle big arcs > PI with small inner cord

---------

Co-authored-by: Metabase Automation <github-automation@metabase.com>

* Fix native query preview for mongo

* Add tests

* Add tests

* Do not rely on join identity

Remove localization for some additional metrics that were missed in 2882692b.

* add athena and databricks logos + update paths

* Add fallback for `druid-jdbc`

---------

Co-authored-by: Nemanja Glumac <31325167+nemanjaglumac@users.noreply.github.com>

* Fix reference in deprecation notice

* Add lock_filled icon

* Add view-only tag to the question header for questions with hidden source tables

* Simplify the useHasHiddenSourceTables helper

* Add typings to useHasHiddenSourceTables

* Show 'view-only' badge when the question is not editable

* Set up card endpoints

* Add test for hidden tables

* Add e2e test for View-only tag

* Add visibilityType to TableDisplayInfo

* Use unfiltered table display info to determine which tables are hidden

* Rename util to hooks

* Use rem for border-radius

* Sign in in beforeEach

* Add tests for more visibility types

* Fix unit tests

* Remove empty file

* Add test for unavailable cards

* Remove unnecessary card endpoint

* Add unit test for inaccessible card

* Move ViewOnlyTag to it's own file

* Add more unit tests for ViewOnly tag

* Use MBQL to create queryies where possible

Co-authored-by: Metabase bot <metabase-bot@metabase.com>

it's been long ago that Ring has been updated to depend on org.apache.commons/commons-fileupload2-core

There was a new version that supports jetty 11.0.24 https://github.com/ring-clojure/ring/blob/master/CHANGELOG.md

* Increase the size of the overlay spacer

* Increase the delay of the popover opening

* Hard-code the popover delays

* Remove delay props from info components

* Fix unit test

* Shorten popover timeout to 500ms

* Make popover delay configurable again

* Increase openDelay for header info

* Fix a Couple bugs related to pivot exports

 - pivot-grouping value, when not an int (in the case of Oracle dbs), would cause exports to contain zero rows. This
 fixes that
 - json formatted/unformatted for the dataset API endpoints (unsaved questions) was not being used, so all exports
 were formatted

* json and csv use (int group) to check row inclusion

* grouping change fix tests

* json formatted/unformatted test

* xlsx formatters are correct when pivot-grouping col is removed

* cljfmt

* fix up failing tests

* fix test

* Update src/metabase/api/dataset.clj

* tweak sunburst chart styles

* Update Loki Snapshots

* Update Loki Snapshots

* Update Loki Snapshots

---------

Co-authored-by: Metabase Automation <github-automation@metabase.com>

* dont run release log on forks

* dont run cron actions on forks at all