docs: document undocumented recent Cube Cloud features - #11444
Conversation
- default_ui_filters: add is empty / is not empty operators - KPI Progress bar / Sparkline: document per-block Format setting - KPI Progress bar: fix stale static-goal tip, native custom-goal toggle exists now - Chart legend: document click-to-hide category interaction - Python analysis: document python widgets now run on view under the viewer's own security context on dashboards, and pick up dashboard filters - Manage users: document the Effective access panel - Multiple data sources: document that the default source can now be deleted - Monitoring integrations: document the Query History export redaction toggle Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SxmFho1mRuVMzwwnkbVbHe
|
Claude finished @keydunov's task in 2m 21s —— View job Review complete — 1 medium, 5 low. Docs-only; main issue is
|
| # | Severity | File | Issue |
|---|---|---|---|
| 1 | Medium | docs/explore-analyze/workbooks/python-analysis.mdx |
Two unedited statements now contradict the rewrite — line 119 ("viewing a dashboard never re-runs anything") and the "Who the analysis runs as" <Warning> ("RLS is applied at run time, not at view time"). The latter is a security-behavior claim readers use for access-control decisions. |
| 2 | Low | docs/explore-analyze/charts/chart-types/kpi.mdx |
Tip points at Use custom goal, but the settings table above it doesn't list that toggle. Also, the two new Format rows are worded asymmetrically ("target/goal text" vs "headline value"). |
| 3 | Low | reference/data-modeling/view.mdx |
is empty isn't distinguished from is null anywhere; and dashboards/widgets/controls.mdx:21 still lists the String operator set without the new operators, despite the "same labels as the filter bar" framing. |
| 4 | Low | admin/connect-to-data/multiple-data-sources.mdx |
"stop resolving" doesn't name the actual symptom (build error? query error?). Given the blast radius of deleting the default source, this reads better as a <Warning>. |
| 5 | Low | admin/monitoring/monitoring-integrations/index.mdx |
Section is framed as "keep values from leaving", but only api_query is redacted — security_context also carries sensitive values and is exported unredacted. Worth stating explicitly. |
| 6 | Low | docs/explore-analyze/charts/configuration/color-and-stacking.mdx |
Four-clause run-on sentence; suggestion posted inline. Open question on whether hidden categories persist across save / dashboard add. |
Not applicable
Security, performance, and test-coverage review dimensions don't apply — no executable code changed. Linting/tests were not run for the same reason.
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
| each widget shows whatever the last **Run** produced. | ||
| A python widget re-runs its script under the **viewer's own security context** when | ||
| a dashboard is opened, rather than showing the report's saved output — this keeps | ||
| row-level security correct, since a stored result would otherwise leak whatever |
There was a problem hiding this comment.
The rewrite is correct, but two other statements in this same file now contradict it and weren't updated:
- Line 119 (just above this section): "Run is the only way the saved result changes. Opening the report, reloading the page, or viewing a dashboard never re-runs anything on its own." — "or viewing a dashboard" is now false.
- Lines 141–148, the "Who the analysis runs as"
<Warning>: "Python runs with the security context of the person who pressed Run… Row-level security is applied at run time, not at view time. A user with broad access can Run, and the stored output is then readable by people whose own access is narrower." — that's exactly the leak this change fixes for dashboards. As written, a reader hits the warning after your new section and can't tell which one is current.
This matters more than the other nits: the stale Warning is a security-behavior claim, and readers making access-control decisions will act on it. Suggest scoping both to the workbook-report path and cross-referencing the dashboard behavior, e.g. line 119 → "Opening the report or reloading the page never re-runs anything on its own; dashboards are different", and the Warning → note that the run-time-RLS caveat applies to the saved result shown in the workbook, while dashboard widgets re-run per viewer.
Line 28 ("renders the saved output without re-running") is arguably fine since it's about the report, but a "(on dashboards it re-runs — see below)" would remove the ambiguity.
|
|
||
| <Tip> | ||
| To compare against a static number like a quarterly goal, add a calculated field that always returns that number and use it as the **Target** field. | ||
| To compare against a static number like a quarterly goal, toggle **Use custom goal** and enter the number directly — no calculated field needed. |
There was a problem hiding this comment.
The Tip now points at a Use custom goal toggle, but the settings table right above it (lines 55–61) doesn't list that toggle — so the one place a reader scans for available settings omits the very control the Tip tells them to use. Worth adding a row, and noting there that Target field / row is what's used when the toggle is off.
Also, the two new Format rows describe different things — Progress bar's says "applied to the target/goal text", Sparkline's says "applied to the headline value". If the underlying setting is per-block number formatting in both cases (like line 30's Number block row), the asymmetric wording will read as two different features. If they genuinely differ, ignore this.
| `after or on date`, `before date`, `before or on date`, `between`, `contains`, | ||
| `not contains`, `starts with`, `not starts with`, `ends with`, `not ends with`, | ||
| `is null`, `is not null`. | ||
| `is null`, `is not null`, `is empty`, `is not empty`. |
There was a problem hiding this comment.
Two things worth checking here:
- This paragraph opens with "Operators use the same labels data consumers see in the workbook filter bar", but
docs/explore-analyze/dashboards/widgets/controls.mdx:21still lists the String operator set as ending atis null,is not null. Ifis empty/is not emptyare available in the filter bar too, that table is now incomplete; if they'redefault_ui_filters-only, the "same labels as the filter bar" framing is slightly off for these two. is empty/is not emptyaren't explained anywhere on the page.is nullis self-evident;is emptyis not — a reader can't tell whether it means empty string, empty string or null, or empty array on a multi-value member. One clause distinguishing it fromis nullwould make this actionable.
| Use the **Edit** action on a row to update credentials, or the **Delete** | ||
| action to remove a named source. The **default** source can be edited but | ||
| not deleted — to remove it, clear the bare `CUBEJS_DB_*` variables from | ||
| [**Settings → Environment Variables**][ref-config-ref-env] by hand. | ||
| action to remove a source — including the **default** source. Deleting the | ||
| default source clears only its connection variables (`CUBEJS_DB_*` and | ||
| equivalent driver-specific prefixes); deployment-wide variables and other | ||
| sources are left untouched. Cubes that don't set an explicit `data_source` | ||
| stop resolving until a new default source is added. |
There was a problem hiding this comment.
Good catch on the stale claim. Two suggestions:
- "Cubes that don't set an explicit
data_sourcestop resolving" — "stop resolving" is vague for what is effectively a breaking action. What does the user actually see: a build error, a query-time error, the deployment failing to start? Naming the symptom makes this a real warning rather than a hint. - Given the blast radius, this is a good candidate for a
<Warning>rather than a plain paragraph — deleting the default source silently breaks every cube without an explicitdata_source, and that's easy to skim past mid-paragraph.
Also worth confirming the parenthetical: "CUBEJS_DB_* and equivalent driver-specific prefixes" — the page's own Source name rules mention _db, _aws, _jdbc suffix collisions, so if deletion is prefix-matching there may be edge cases where it clears more or less than expected.
| ### Redacting exported query values | ||
|
|
||
| To keep filter values and SQL literals from leaving through Query History export, | ||
| enable **Redact filter values in Query History Export** under **Settings → | ||
| Monitoring Integrations** (shown once log export is on). With this toggle on, the | ||
| exported `api_query` field has filter values and SQL literals stripped; it's off |
There was a problem hiding this comment.
Content is accurate and well-scoped. One gap: the field table above (line ~326) documents security_context as "Security context of the request, represented as a string", which is the other field in the export that routinely carries sensitive values (user ids, tenant ids, emails). Since this section frames the toggle as "keep values from leaving through Query History export", a reader will reasonably assume it covers security_context too. Explicitly stating that it affects api_query only — and that security_context is exported unredacted — closes that gap.
Nit: the placement puts this after the <Note> about the analysis recipe. Reads slightly better directly after the field table, before the recipe pointer.
|
|
||
| {/* TODO screenshot: legend position options (hidden — replace this comment with <Frame><img src="..." /></Frame> when image is ready) */} | ||
|
|
||
| Click a legend item to hide that category from the chart — the chart rescales over what's left, and the hidden item stays in the legend, dimmed. Click it again to bring it back. This is view-only: it doesn't change the underlying query, and reloading the page restores every category. |
There was a problem hiding this comment.
Accurate, but it's a four-clause run-on sentence in a page that otherwise uses tables and short paragraphs. Splitting it also lets the important caveat stand on its own:
| Click a legend item to hide that category from the chart — the chart rescales over what's left, and the hidden item stays in the legend, dimmed. Click it again to bring it back. This is view-only: it doesn't change the underlying query, and reloading the page restores every category. | |
| Click a legend item to hide that category from the chart. The chart rescales over | |
| what's left, and the hidden item stays in the legend, dimmed — click it again to | |
| bring it back. | |
| This is view-only: it doesn't change the underlying query, and reloading the page | |
| restores every category. |
Also worth confirming whether hidden categories persist when the report is saved or added to a dashboard — "reloading the page restores every category" answers the reload case but not the save case, which is the one a report author will hit.
|
Preview deployment for your docs. Learn more about Mintlify Previews.
💡 Tip: Enable Workflows to automatically generate PRs for you. |
2 participants
Check List
Description of Changes Made
Periodic sweep of recently-shipped
cubejs-enterpriseproduct changes cross-checked againstdocs-mintlifyfor gaps, filtered through the customer-facing criteria used by the docs/changelog routine. Each item below was verified against its source PR before writing — small, surgical edits to existing pages only, no new pages needed this cycle.reference/data-modeling/view.mdx— addis empty/is not emptyto thedefault_ui_filtersoperator list (cubedevinc/cubejs-enterprise#13456).docs/explore-analyze/charts/chart-types/kpi.mdx— document the per-block Format setting on the Progress bar and Sparkline blocks (cubedevinc/cubejs-enterprise#13113), and fix a stale Tip that recommended a calculated-constant workaround for a static goal — a native Use custom goal toggle exists now.docs/explore-analyze/charts/configuration/color-and-stacking.mdx— document the click-a-legend-item-to-hide-that-category interaction (cubedevinc/cubejs-enterprise#13386).docs/explore-analyze/workbooks/python-analysis.mdx— rewrite the stale "On dashboards" section: Python widgets now re-run under the viewer's own security context on view (for RLS correctness) and pick up dashboard filters, rather than rendering a stored snapshot with zero compute cost (cubedevinc/cubejs-enterprise#13470, #13499).admin/users-and-permissions/manage-users.mdx— document the new read-only Effective access panel on a user's page (cubedevinc/cubejs-enterprise#13447).admin/connect-to-data/multiple-data-sources.mdx— update the stale claim that the default data source can't be deleted from the UI; it can now (cubedevinc/cubejs-enterprise#13401).admin/monitoring/monitoring-integrations/index.mdx— document the Redact filter values in Query History Export toggle (cubedevinc/cubejs-enterprise#13452).No new nav entries needed — all edits are to existing
docs.json-registered pages.Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com
Claude-Session: https://claude.ai/code/session_01SxmFho1mRuVMzwwnkbVbHe
Generated by Claude Code