* Add allowed iframe host setting (#48805)

* add allowed iframe host setting wip

* use allowed-iframe-hosts setting in the CSP header

* add a test for the frame-src csp directive

* Update allowed-iframe-hosts setting definition

* Add error state for forbidden iframe url domains

* Move out iframe e2e test suite

* Add e2e test

* Update error message in view mode

* Fix unit tests

* Update setting on the admin page

* Update error state

* Add links to error states

* Update docs links

* Update link anchors

* Add default allowed hosts to public setting

* Update allowed domain check logic

* Fix default value display in admin page

* Don't update setting without changes

* Update error message spacing

* correct the parsing of allowed-hosts string for CSP header entries

* fix test

* fix not handling wildcard ports

* Fix failing e2e test

* Fix subdomain test

* address review

 - the parse-allowed-iframe-hosts fn is now memoized
 - a * entry is handled and doesn't produce a weird *:* entry
 - no more try/catch, errors in parsing will be logged but the list returns all valid entries
 - when www. is encountered, an entry including www. is added
 - trailing / is 'cleaned' and the entry is used as if there was no trailing /

* Fixup test for expecting a few more frame sources

* indentation fix for linter 



* Fix type error

---------

Co-authored-by: Adam James <adam.vermeer2@gmail.com>
Co-authored-by: Anton Kulyk <kuliks.anton@gmail.com>
Co-authored-by: dan sutton <dan@dpsutton.com>

* Fix type error

---------

Co-authored-by: Aleksandr Lesnenko <alxnddr@users.noreply.github.com>
Co-authored-by: Adam James <adam.vermeer2@gmail.com>
Co-authored-by: Anton Kulyk <kuliks.anton@gmail.com>
Co-authored-by: dan sutton <dan@dpsutton.com>

Co-authored-by: Oleksandr Yakushev <alex@bytopia.org>

* ui implementation of new emb homepage, tests will come later

* change padding of the last card to be consistent with the top one

* update beta badge spacing

* update tests

* fix stories type error

* use quick-start for url

* update HomeContent tests

* update events + related e2e

* Update frontend/src/metabase/home/components/EmbedHomepage/StaticEmbedContent.tsx

Co-authored-by: Nicolò Pretto <info@npretto.com>

Co-authored-by: Aleksandr Lesnenko <alxnddr@users.noreply.github.com>

* Do not create personal collections for API keys

Co-authored-by: John Swanson <john.swanson@metabase.com>
Co-authored-by: Noah Moss <32746338+noahmoss@users.noreply.github.com>

This is to allow for the possibiliy of adding more metricsv2 usage and error metrics in the future while still
distinguishing the source of the errors.

Co-authored-by: appleby <86076+appleby@users.noreply.github.com>

Co-authored-by: bryan <bryan.maass@gmail.com>

Co-authored-by: Chris Truter <crisptrutski@users.noreply.github.com>

This was throwing errors trying to `nippy/freeze!` an Atom.

That was because in certain circumstances a pMBQL query can end up in
`(:json_query metadata)` for a query, and those can contain an atom
due to `metabase.lib.cache` and both `CachedMetadataProvider` and
`InvocationTracker`.

I added `lib.query/serializable` as a single location to strip out
anything that isn't serializable, such as atoms. (And the entire
`:lib/metadata`, which is a wasted effort to serialize.)

Co-authored-by: Braden Shepherdson <braden@metabase.com>

Co-authored-by: Oisin Coveney <oisin@metabase.com>

Co-authored-by: Ngoc Khuat <qn.khuat@gmail.com>

* cumulative changes

* Apply suggestions from code review



---------

Co-authored-by: Alex Yarosh <alexandra@metabase.com>
Co-authored-by: Jeff Bruemmer <jeff.bruemmer@gmail.com>

* Add `use-temp-storage` hook

* Remove try/catch

* Add reducer

* Add tests

* Use RTK to create a new slice and reducer

Co-authored-by: Nemanja Glumac <31325167+nemanjaglumac@users.noreply.github.com>

* improve pie-sunburst chart labels visibility algo

* specs, docs

* Update Loki Snapshots

* handle big arcs > PI with small inner cord

---------

Co-authored-by: Aleksandr Lesnenko <alxnddr@gmail.com>

* Fix native query preview for mongo

* Add tests

* Add tests

* Do not rely on join identity

Co-authored-by: Alexander Polyankin <alexander.polyankin@metabase.com>

* Reset join condition state when the rhs table changes (#48951)

* Update Loki Snapshots

---------

Co-authored-by: Alexander Polyankin <alexander.polyankin@metabase.com>

Remove localization for some additional metrics that were missed in 2882692b.

Co-authored-by: appleby <86076+appleby@users.noreply.github.com>

* add athena and databricks logos + update paths

* Add fallback for `druid-jdbc`

---------

Co-authored-by: Kyle Doherty <5248953+kdoh@users.noreply.github.com>
Co-authored-by: Nemanja Glumac <31325167+nemanjaglumac@users.noreply.github.com>

Co-authored-by: Jeff Bruemmer <jeff.bruemmer@gmail.com>

* add prometheus tracking for sdk-embedding

* indentation

* improve track-sdk-response api

* register :metabase-sdk/response-{ok,error} + test

* avoid cyclic dependency whe nusing prometheus

fixes:
[ /metabase/api/common ]
<- /metabase/models/setting
<- /metabase/analytics/settings
<- /metabase/analytics/prometheus
<- /metabase/analytics/sdk
<- /metabase/models/view_log
<- /metabase/events/schema
<- /metabase/events
<- [ /metabase/api/common ]
<- /metabase/public_settings/premium_features
<- /metabase/auth_provider
<- /metabase/driver
<- /dev/debug_qp
<- /dev

* nix dependency: events.schema --> models.view-log

- make them both read context from view-log-impl instead

* cljfmt

Co-authored-by: Bryan Maass <bryan.maass@gmail.com>

Co-authored-by: Oisin Coveney <oisin@metabase.com>

Co-authored-by: Oisin Coveney <oisin@metabase.com>

* tweak sunburst chart styles

* Update Loki Snapshots

* Update Loki Snapshots

* Update Loki Snapshots

---------

Co-authored-by: Aleksandr Lesnenko <alxnddr@users.noreply.github.com>

Co-authored-by: Metabase bot <metabase-bot@metabase.com>

* Popover timing tweaks (#48888)

* Increase the size of the overlay spacer

* Increase the delay of the popover opening

* Hard-code the popover delays

* Remove delay props from info components

* Fix unit test

* Shorten popover timeout to 500ms

* Make popover delay configurable again

* Increase openDelay for header info

* Accept loki changes

---------

Co-authored-by: Romeo Van Snick <romeo@romeovansnick.be>

it's been long ago that Ring has been updated to depend on org.apache.commons/commons-fileupload2-core

Co-authored-by: Alexander Solovyov <alexander@solovyov.net>

There was a new version that supports jetty 11.0.24 https://github.com/ring-clojure/ring/blob/master/CHANGELOG.md



Co-authored-by: Luis Paolini <paoliniluis@gmail.com>

* Automate npm version

* Make troubleshooting SDK release process easier

* Fix quote situation

* Allow deploying SDK to different branches at the same time

Because they won't be in conflict with each other

* Make checkout a bit faster

* Remove unnecessary console.log



* Tidy up `jq` command



* Tidy up multiple GitHub actions summary log



---------

Co-authored-by: Mahatthana (Kelvin) Nomsawadi <me@bboykelvin.dev>
Co-authored-by: Phoomparin Mano <poom@metabase.com>

* Fix a Couple bugs related to pivot exports

 - pivot-grouping value, when not an int (in the case of Oracle dbs), would cause exports to contain zero rows. This
 fixes that
 - json formatted/unformatted for the dataset API endpoints (unsaved questions) was not being used, so all exports
 were formatted

* json and csv use (int group) to check row inclusion

* grouping change fix tests

* json formatted/unformatted test

* xlsx formatters are correct when pivot-grouping col is removed

* cljfmt

* fix up failing tests

* fix test

* Update src/metabase/api/dataset.clj

Co-authored-by: adam-james <21064735+adam-james-v@users.noreply.github.com>

Co-authored-by: Jeff Bruemmer <jeff.bruemmer@gmail.com>

Co-authored-by: Oisin Coveney <oisin@metabase.com>

Co-authored-by: Case Nelson <case@metabase.com>

* Reset the question's viz settings when converting to a model

* Update e2e/test/scenarios/models/reproductions.cy.spec.ts



* Test model metadata

* Test model metadata

* Test model metadata

* Test model metadata

---------

Co-authored-by: Alexander Polyankin <alexander.polyankin@metabase.com>
Co-authored-by: Kamil Mielnik <kamil@kamilmielnik.com>

* Fix #48878 by avoiding to use entity framework which can serve incomplete card objects

* Make sure canWrite is a boolean

* Remove redundant optional chaining

* Add repro for #48878

* Optimize

* Improve comment

* Fix test setup

---------

Co-authored-by: Kamil Mielnik <kamil@kamilmielnik.com>

Co-authored-by: Ryan Laurie <30528226+iethree@users.noreply.github.com>

Hide time inputs in the date picker when the column does not support date+time filters (#48818) (#48935)

Co-authored-by: Alexander Polyankin <alexander.polyankin@metabase.com>

Co-authored-by: Oleksandr Yakushev <alex@bytopia.org>

Co-authored-by: Anton Kulyk <kuliks.anton@gmail.com>

https://github.com/jetty/jetty.project/security/advisories/GHSA-g8m5-722r-8whq



Co-authored-by: Alexander Solovyov <alexander@solovyov.net>

* run prettier on sdk readme

* fix code snippets so that prettier can format them

* put back the empty new line on the package.json

Co-authored-by: Nicolò Pretto <info@npretto.com>