nquery 0.1.2 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0460bb4897b3a7fbd9516dc0c8e39a69eb397fb4ab221bc2c27f5879a40fc04e
-  data.tar.gz: ffd6e74059060bb039706b611a1ee6b193b7d71a6a18a02ea01f88d58c8e3a79
+  metadata.gz: 16f10a8cbf379951ca3ba531d4692f3caa98ff41bedd49ebdb77fcc44244a6c7
+  data.tar.gz: 32a28cf89669ce5b093e090a22fe54cbd7c40b2f6ca9cd374498c601ad63d735
 SHA512:
-  metadata.gz: b2631cd177c4840a24d2c81f07669a02b168bd0a15f9ac90f80e0cb7f027348624521807f64c50783e8d8e66cb74554f01dfc8ac06941d70cfe9b8b768a0122d
-  data.tar.gz: 182717511432fa142146e3fcc097667ae8fbda4f923447aa6ebfabd3e39a23ce0ca23b61c8b4a3f006ad6f00d1a37d50335308222697443d4e3e50767d9a32a5
+  metadata.gz: e3a624fc4b6737a76b3a702a3d7a3c700f7ff6e416e5878b60c744ad2efc949b3002d4cf632201a91851ff6b9724fe23793f2ce3eea0c8147dad7529e71b352d
+  data.tar.gz: 4364b0dada29cb6324dba7c2e1649d47ea714f5a6edaf3900a05865066798dbe4852bd2f614863a9295f3fd3f7406b5ad0e0893572ad97983256b9d015daee54

data/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## [Unreleased]
+
+## [0.1.3] - 2026-09-08
+
+Host apps should `bundle update nquery` and run `rails db:migrate`. Re-run `rails generate nquery:install` (or add the sharing/embed keys to `config/initializers/nquery.rb`) if you want public links or static embeds.
+
+### Added
+- Public sharing links and static signed embeds for charts and dashboards (Metabase-style)
+- Sharing UI with expiry picker, revoke/regenerate, and copy-to-clipboard
+- Real query execution on public and embed pages, including dashboard card grids
+
+### Changed
+- Public embed endpoints require `static_embedding_enabled` and per-resource `enable_embedding`
+- Embed layout loads application JS so chart previews initialize, and allows cross-origin iframes via CSP `frame-ancestors`
+- Remove standalone query pages so SQL lives only on charts
+
+### Fixed
+- Query runner and schema endpoints honor the engine mount path (#25)
+
 ## [0.1.2] - 2026-09-07
 
 ### Changed

data/README.md

@@ -21,6 +21,7 @@ nquery lets a host Rails app expose a self-contained analytics UI. It:
 - [First admin onboarding](#first-admin-onboarding)
 - [Mail and SMTP](#mail-and-smtp)
 - [Data sources](#data-sources)
+- [Sharing and embedding](#sharing-and-embedding)
 - [Active Storage](#active-storage)
 - [Development](#development)
 - [Contributing](#contributing)
@@ -135,6 +136,9 @@ end
 | `query_timeout` | `15` | Query timeout (seconds) |
 | `query_row_limit` | `10_000` | Max rows returned by a query |
 | `embed_secret` | `nil` | Override for embed token signing (falls back to `secret_key_base`) |
+| `public_sharing_enabled` | `false` | Allow public UUID links for charts and dashboards |
+| `static_embedding_enabled` | `false` | Allow signed iframe embeds for charts and dashboards |
+| `embed_frame_ancestors` | `nil` | CSP `frame-ancestors` origins (`nil` allows any origin) |
 
 **Not supported in config:** storing database credentials for data sources, SSO/hybrid auth hooks, or public self-registration.
 
@@ -233,6 +237,56 @@ config.default_data_source = :main
 
 After setup, review sources under **Admin → Data sources**.
 
+## Sharing and embedding
+
+nquery mirrors Metabase’s two sharing mechanisms for **charts** and **dashboards** (not collections). Both are **off by default** and must be enabled in the host initializer:
+
+```ruby
+Nquery.configure do |config|
+  config.public_sharing_enabled = true
+  config.static_embedding_enabled = true
+  config.embed_secret = Rails.application.secret_key_base
+  # Optional: restrict which sites may iframe embeds
+  # config.embed_frame_ancestors = ["https://app.example.com"]
+end
+```
+
+Users with **view** access can open **Embed** on a chart or dashboard. Creating, revoking, or regenerating links and tokens requires **curate** access on the collection and `view_data` on the underlying data sources.
+
+Public and embed endpoints rate-limit to 60 requests per minute per IP when the host uses Rails 7.2+ `rate_limit`. Older Rails versions log a warning and skip rate limiting.
+
+### Public links
+
+An unguessable UUID stored on the resource. No expiry and no signature. Removing the link clears the UUID.
+
+| Resource | Path |
+|----------|------|
+| Chart | `/public/charts/:uuid` |
+| Dashboard | `/public/dashboards/:uuid` |
+
+### Static embeds
+
+HMAC-signed tokens (`Nquery::EmbedToken` + `EmbedTokenService`) with optional expiry. The resource must also have **Enable embedding** turned on. Revoked or expired tokens return 403.
+
+| Resource | Path |
+|----------|------|
+| Chart | `/embed/charts/show?token=…` |
+| Dashboard | `/embed/dashboards/show?token=…` |
+
+Tokens stay in the query string because the signed value contains a `.` that would collide with Rails format parsing in a path segment.
+
+### Hosting embeds (CSP / framing)
+
+Public and embed responses:
+
+* Delete Rails’ default `X-Frame-Options: SAMEORIGIN` so cross-origin iframes work
+* Set `Content-Security-Policy: frame-ancestors *` (or the origins in `embed_frame_ancestors`)
+* Send `X-Robots-Tag: noindex`
+
+Host apps that set a global CSP should allow the nquery origin in `frame-src` (or `child-src`) on the page that contains the iframe.
+
+Suggested iframe defaults from the Embed page: `width="800"` `height="600"` (charts) or `800` (dashboards), `loading="lazy"`. Optional query params: `titled=false`, `bordered=false`, `theme=night` or `theme=transparent`.
+
 ## Active Storage
 
 Required for organization `logo` and `cover_image` during company onboarding (and later branding):

data/app/assets/builds/nquery/application.css

@@ -9,9 +9,10 @@
   --nq-muted: #64748b;
   --nq-card: #ffffff;
   --nq-danger: #ef4444;
+  --nq-font: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;
 }
 * { box-sizing: border-box; }
-body.nq-body { margin: 0; font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif; color: var(--nq-text); background: var(--nq-bg); }
+body.nq-body { margin: 0; font-family: var(--nq-font); color: var(--nq-text); background: var(--nq-bg); }
 .nq-layout { display: flex; min-height: 100vh; }
 .nq-sidebar { width: 240px; background: var(--nq-sidebar); color: #fff; padding: 1rem; flex-shrink: 0; }
 .nq-logo { font-size: 1.5rem; font-weight: 700; margin-bottom: 2rem; color: var(--nq-primary); }
@@ -279,7 +280,8 @@ button.nq-menu-item-button.is-loading::before { content: ""; width: 1em; height:
 .nq-radio { display: inline-flex; align-items: center; gap: 0.25rem; margin-right: 1rem; }
 .nq-checkbox { display: block; margin-bottom: 0.25rem; }
 .nq-csv-preview { margin: 1rem 0; overflow: auto; }
-.nq-embed-body { margin: 0; padding: 1rem; background: #fff; }
+.nq-embed-body { margin: 0; padding: 1rem; background: #fff; font-family: var(--nq-font); color: var(--nq-text); }
+.nq-embed-body h1 { margin: 0 0 1rem; font-size: 1.5rem; font-weight: 600; color: inherit; }
 .nq-icon-lg { width: 2.5rem; height: 2.5rem; color: var(--nq-muted); }
 .nq-type-badge { display: inline-flex; align-items: center; gap: 0.375rem; padding: 0.25rem 0.625rem; border-radius: 999px; font-size: 0.75rem; font-weight: 600; white-space: nowrap; }
 .nq-type-badge-folder { background: #fef3c7; color: #92400e; }
@@ -394,3 +396,21 @@ button.nq-menu-item-button.is-loading::before { content: ""; width: 1em; height:
   .nq-logs-empty td { display: block; }
   .nq-logs-empty td::before { content: none; }
 }
+.nq-sharing-section { margin-bottom: 1.25rem; }
+.nq-sharing-section h2 { margin-top: 0; }
+.nq-sharing-section h3 { margin: 1rem 0 0.5rem; font-size: 0.9375rem; }
+.nq-sharing-section > .nq-actions { margin-top: 1rem; }
+.nq-sharing-token-form { display: flex; flex-direction: column; gap: 0.75rem; margin-top: 1rem; }
+.nq-sharing-token-form .nq-form-row { margin-bottom: 0; }
+.nq-copy-field { display: flex; align-items: flex-start; gap: 0.5rem; }
+.nq-copy-field .nq-code { flex: 1; margin: 0; white-space: pre-wrap; word-break: break-all; }
+.nq-copy-field .nq-btn { flex-shrink: 0; }
+.nq-embed-grid { margin-top: 1rem; }
+.nq-chart-error { margin: 0; padding: 1rem; border-radius: 6px; background: #fef2f2; color: #991b1b; }
+.nq-chart-preview.is-error { min-height: 0; }
+.nq-embed-body.nq-embed-untitled h1 { display: none; }
+.nq-embed-body.nq-embed-borderless .nq-dashboard-card { border-color: transparent; box-shadow: none; }
+.nq-embed-body.nq-embed-theme-night { background: #0f172a; color: #e2e8f0; }
+.nq-embed-body.nq-embed-theme-night .nq-dashboard-card { background: #1e293b; border-color: #334155; }
+.nq-embed-body.nq-embed-theme-night .nq-chart-error { background: #450a0a; color: #fecaca; }
+.nq-embed-body.nq-embed-theme-transparent { background: transparent; }

data/app/assets/builds/nquery/application.js

@@ -263,7 +263,7 @@ function initButtonLoaders() {
 
   document.addEventListener("click", (event) => {
     const button = event.target.closest("a.nq-btn, button.nq-btn[type=button], input.nq-btn[type=button]")
-    if (!button || button.classList.contains("is-loading") || button.dataset.managesLoading === "true") return
+    if (!button || button.classList.contains("is-loading") || button.dataset.managesLoading === "true" || button.hasAttribute("data-copy-button")) return
     setButtonLoading(button, true)
   })
 
@@ -343,12 +343,23 @@ function buildPreviewChartConfig(type, data, xCol, yCol) {
   }
 }
 
+const NQ_CHART_FONT = '-apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif'
+
+function applyChartFontDefaults() {
+  if (typeof Chart === "undefined") return
+
+  Chart.defaults.font.family = NQ_CHART_FONT
+  Chart.defaults.color = document.body.classList.contains("nq-embed-theme-night") ? "#e2e8f0" : "#1e293b"
+}
+
 function initChartPreviews() {
   if (typeof Chart === "undefined") {
     requestAnimationFrame(initChartPreviews)
     return
   }
 
+  applyChartFontDefaults()
+
   document.querySelectorAll("[data-controller='chart-preview']").forEach(el => {
     if (el.dataset.chartPreviewInitialized === "true") return
     el.dataset.chartPreviewInitialized = "true"
@@ -368,11 +379,17 @@ function initChartPreviews() {
       rows: [["Jan", 1200], ["Feb", 1800], ["Mar", 2400], ["Apr", 2100]]
     }
 
+    if (data?.error) {
+      el.classList.add("is-error")
+      el.innerHTML = `<div class="nq-chart-error">${escapeHtml(data.error)}</div>`
+      return
+    }
+
     if (type === "number") {
       const yIndex = columnIndex(demo.columns || [], yCol || demo.columns?.[1] || demo.columns?.[0])
       const value = demo.rows?.[0]?.[yIndex] ?? "—"
       el.classList.add("is-number")
-      el.innerHTML = `<div class="nq-number-display">${value}</div>`
+      el.innerHTML = `<div class="nq-number-display">${escapeHtml(value)}</div>`
       return
     }
 
@@ -448,6 +465,8 @@ function initChartBuilders() {
       root.querySelector("[data-action*='chart-builder#format']")
     const saveStatus = root.querySelector("[data-chart-builder-target='saveStatus']")
     const querySaveUrl = root.dataset.querySaveUrl
+    const queryRunUrl = root.dataset.queryRunUrl
+    const querySchemaUrl = root.dataset.querySchemaUrl
 
     let currentResult = null
     let chartInstance = null
@@ -678,7 +697,7 @@ function initChartBuilders() {
       const yCol = yAxis?.value || result.columns[1] || result.columns[0]
       const yIndex = columnIndex(result.columns, yCol)
       const value = result.rows[0]?.[yIndex] ?? "—"
-      numberWrap.innerHTML = `<div class="nq-number-display">${value}</div>`
+      numberWrap.innerHTML = `<div class="nq-number-display">${escapeHtml(value)}</div>`
       chartWrap?.setAttribute("hidden", "")
       numberWrap?.removeAttribute("hidden")
     }
@@ -830,7 +849,7 @@ function initChartBuilders() {
       setButtonLoading(button, true)
       try {
         const csrf = document.querySelector('meta[name="csrf-token"]')?.content
-        const res = await fetch("/queries/run", {
+        const res = await fetch(queryRunUrl, {
           method: "POST",
           headers: { "Content-Type": "application/json", "X-CSRF-Token": csrf },
           body: JSON.stringify({ statement: getStatement(), data_source_id: dataSource?.value })
@@ -851,7 +870,7 @@ function initChartBuilders() {
 
     const loadSchema = async () => {
       if (!schema || !dataSource) return
-      const response = await fetch(`/queries/schema?data_source_id=${dataSource.value}`)
+      const response = await fetch(`${querySchemaUrl}?data_source_id=${dataSource.value}`)
       const data = await response.json()
       renderSchemaTree(schema, data.tables)
     }
@@ -959,34 +978,6 @@ function initChartBuilders() {
   })
 }
 
-function initQueryEditors() {
-  document.querySelectorAll("[data-controller='query-editor']").forEach(el => {
-    const statement = el.querySelector("[data-query-editor-target='statement']")
-    const results = el.querySelector("[data-query-editor-target='results']")
-    const dataSource = el.querySelector("[data-query-editor-target='dataSource']")
-    el.querySelector("[data-action*='query-editor#run']")?.addEventListener("click", async (event) => {
-      const button = event.currentTarget
-      setButtonLoading(button, true)
-      try {
-        const csrf = document.querySelector('meta[name="csrf-token"]')?.content
-        const res = await fetch("/queries/run", {
-          method: "POST",
-          headers: { "Content-Type": "application/json", "X-CSRF-Token": csrf },
-          body: JSON.stringify({ statement: statement?.value, data_source_id: dataSource?.value })
-        })
-        results.textContent = JSON.stringify(await res.json(), null, 2)
-      } finally {
-        setButtonLoading(button, false)
-      }
-    })
-    el.querySelectorAll("[data-action*='insertTable']").forEach(item => {
-      item.addEventListener("click", () => {
-        if (statement) statement.value = `SELECT * FROM ${item.dataset.table} LIMIT 100`
-      })
-    })
-  })
-}
-
 function initDataSourceForms() {
   document.querySelectorAll("[data-controller='data-source-form']").forEach(root => {
     if (root.dataset.dataSourceFormInitialized === "true") return
@@ -1060,15 +1051,38 @@ function initDataSourceForms() {
   })
 }
 
+function initCopyButtons() {
+  document.querySelectorAll("[data-copy-button]").forEach(button => {
+    if (button.dataset.copyInitialized === "true") return
+    button.dataset.copyInitialized = "true"
+
+    button.addEventListener("click", async () => {
+      const target = button.dataset.copyTarget ? document.querySelector(button.dataset.copyTarget) : null
+      const text = target ? target.textContent : (button.dataset.copyText || "")
+      const original = button.textContent
+
+      try {
+        await navigator.clipboard.writeText(text.trim())
+        button.textContent = "Copied"
+      } catch {
+        button.textContent = "Copy failed"
+      }
+
+      setTimeout(() => { button.textContent = original }, 1500)
+    })
+  })
+}
+
 function initPage() {
+  applyChartFontDefaults()
   initButtonLoaders()
   initToastEvents()
   observeToastStack()
   initFlashCards()
-  initQueryEditors()
   initChartBuilders()
   initChartPreviews()
   initDataSourceForms()
+  initCopyButtons()
 }
 
 function bootPage() {

data/app/controllers/concerns/nquery/breadcrumbs.rb

@@ -53,9 +53,9 @@ module Nquery
         case action_name
         when "show"
           append_resource_breadcrumb(crumbs, breadcrumb_dashboard)
-        when "edit"
+        when "edit", "embed"
           append_resource_breadcrumb(crumbs, breadcrumb_dashboard, path: dashboard_path(breadcrumb_dashboard), link: true)
-          append_terminal_breadcrumb(crumbs, "Edit")
+          append_terminal_breadcrumb(crumbs, action_name.titleize)
         when "new"
           append_terminal_breadcrumb(crumbs, "New dashboard")
         end
@@ -86,9 +86,6 @@ module Nquery
         when "new"
           append_terminal_breadcrumb(crumbs, "New chart")
         end
-      when "nquery/queries"
-        append_section_breadcrumb(crumbs, "Queries", nil)
-        append_terminal_breadcrumb(crumbs, query_breadcrumb_label)
       when "nquery/charts"
         append_section_breadcrumb(crumbs, "Collections", collections_path)
         if breadcrumb_chart&.collection
@@ -208,14 +205,6 @@ module Nquery
       @breadcrumb_data_source ||= @data_source || DataSource.find_by(id: params[:id])
     end
 
-    def query_breadcrumb_label
-      case action_name
-      when "new" then "New SQL query"
-      when "edit" then "Edit query: #{@query&.name.presence || 'Untitled'}"
-      else @query&.name.presence || "Query"
-      end
-    end
-
     def append_section_breadcrumb(crumbs, label, path)
       crumbs << { label: label, path: path, section: true }
     end

data/app/controllers/concerns/nquery/chart_actions.rb

@@ -6,6 +6,7 @@ module Nquery
 
     included do
       include ChartResults
+      include SharingPage
       before_action :set_chart, only: %i[show edit update embed destroy archive]
       before_action :authorize_chart_view!, only: %i[show embed]
       before_action :authorize_chart_curate!, only: %i[edit update destroy archive]
@@ -47,8 +48,7 @@ module Nquery
     end
 
     def embed
-      @embed_token = EmbedToken.active.find_by(resource_type: "Nquery::Chart", resource_id: @chart.id)
-      @embed_url = @embed_token ? embed_public_chart_url(token: EmbedTokenService.signed_token_for(@embed_token)) : nil
+      assign_sharing_page(@chart)
       render "nquery/charts/embed"
     end
 
@@ -94,8 +94,8 @@ module Nquery
 
     def load_chart_builder_assigns
       @data_sources = DataSource.active.order(:name)
-      @schema = schema_for(@chart&.query&.data_source)
-      @result = chart_builder_result(@chart) if @chart&.persisted? && @chart.query&.statement.present?
+      @schema = schema_for(@chart&.data_source)
+      @result = chart_builder_result(@chart) if @chart&.persisted? && @chart.statement?
     end
 
     def schema_for(data_source = nil)

data/app/controllers/concerns/nquery/chart_results.rb

@@ -7,7 +7,7 @@ module Nquery
     private
 
     def chart_result(chart)
-      return demo_result unless chart.query&.statement.present?
+      return demo_result unless chart.statement?
 
       chart_query_result(chart)
     rescue StandardError
@@ -15,7 +15,7 @@ module Nquery
     end
 
     def chart_builder_result(chart)
-      return nil unless chart.query&.statement.present?
+      return nil unless chart.statement?
 
       chart_query_result(chart, audit: false)
     rescue QueryRunner::PermissionError, QueryRunner::Error => e
@@ -24,10 +24,20 @@ module Nquery
       { error: e.message }
     end
 
+    def shared_chart_result(chart)
+      return { error: "This chart has no query." } unless chart.statement?
+      return { error: shared_chart_load_error } unless chart.data_source
+
+      chart_query_result(chart, audit: false)
+    rescue StandardError => e
+      Rails.logger.error("[nquery] shared chart #{chart.id} failed: #{e.class}: #{e.message}")
+      { error: shared_chart_load_error }
+    end
+
     def chart_query_result(chart, audit: true)
       QueryRunner.new(
-        data_source: chart.query.data_source || DataSource.first,
-        statement: chart.query.statement,
+        data_source: chart.data_source || DataSource.first,
+        statement: chart.statement,
         user: current_nquery_user,
         query: chart.query
       ).run(audit: audit)
@@ -40,5 +50,9 @@ module Nquery
         row_count: 4
       }
     end
+
+    def shared_chart_load_error
+      "This chart could not be loaded."
+    end
   end
 end

data/app/controllers/concerns/nquery/sharing_page.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+module Nquery
+  module SharingPage
+    extend ActiveSupport::Concern
+
+    private
+
+    def assign_sharing_page(resource)
+      @shareable = resource
+      @embed_token = resource.active_embed_token
+      @embed_url = signed_embed_url_for(resource)
+      @public_url = public_share_url_for(resource)
+    end
+
+    def signed_embed_url_for(resource)
+      token = resource.active_embed_token
+      return unless token
+
+      signed = EmbedTokenService.signed_token_for(token)
+      if resource.is_a?(Dashboard)
+        embed_public_dashboard_url(token: signed)
+      else
+        embed_public_chart_url(token: signed)
+      end
+    end
+
+    def public_share_url_for(resource)
+      return unless resource.publicly_shared?
+
+      if resource.is_a?(Dashboard)
+        public_dashboard_url(resource.public_uuid)
+      else
+        public_chart_url(resource.public_uuid)
+      end
+    end
+  end
+end

data/app/controllers/nquery/application_controller.rb

@@ -40,6 +40,8 @@ module Nquery
         nquery/onboarding/confirmations
         nquery/embed/charts
         nquery/embed/dashboards
+        nquery/public/charts
+        nquery/public/dashboards
         nquery/errors
       ])
     end

data/app/controllers/nquery/dashboards_controller.rb

@@ -4,9 +4,10 @@ module Nquery
   class DashboardsController < ApplicationController
     include ChartResults
     include Browsable
+    include SharingPage
 
-    before_action :set_dashboard, only: %i[show edit update destroy archive unarchive update_layout]
-    before_action :authorize_dashboard_view!, only: %i[show]
+    before_action :set_dashboard, only: %i[show edit update destroy archive unarchive update_layout embed]
+    before_action :authorize_dashboard_view!, only: %i[show embed]
     before_action :authorize_dashboard_curate!, only: %i[edit update destroy archive unarchive update_layout]
 
     def index
@@ -44,6 +45,10 @@ module Nquery
       @card_results = @dashboard_cards.index_with { |card| chart_result(card.chart) }
     end
 
+    def embed
+      assign_sharing_page(@dashboard)
+    end
+
     def edit
       @collections = assignable_collections
     end
@@ -85,7 +90,7 @@ module Nquery
     private
 
     def set_dashboard
-      @dashboard = if action_name.in?(%w[show edit])
+      @dashboard = if action_name.in?(%w[show edit embed])
                      Dashboard.includes(:creator, dashboard_cards: :chart).find(params[:id])
                    else
                      Dashboard.find(params[:id])

data/app/controllers/nquery/embed/charts_controller.rb

@@ -2,23 +2,25 @@
 
 module Nquery
   module Embed
-    class ChartsController < ActionController::Base
-      include Nquery::Engine.routes.url_helpers
-      protect_from_forgery with: :exception
-      layout "nquery/embed"
-
+    class ChartsController < PublicResourcesController
       def show
+        unless Nquery.configuration.static_embedding_enabled
+          return render_forbidden("Embedding is disabled")
+        end
+
         payload = EmbedTokenService.verify(params[:token])
-        @chart = Chart.find(payload[:resource_id])
-        @result = demo_result
-      rescue EmbedTokenService::Error
-        render plain: "Invalid or expired embed token", status: :forbidden
-      end
+        unless payload[:resource_type] == "Nquery::Chart"
+          return render_forbidden
+        end
 
-      private
+        @chart = Chart.active.find(payload[:resource_id])
+        unless @chart.enable_embedding?
+          return render_forbidden("Embedding is disabled")
+        end
 
-      def demo_result
-        { columns: %w[month revenue], rows: [%w[Jan 1200], %w[Feb 1800], %w[Mar 2400]] }
+        @result = shared_chart_result(@chart)
+      rescue EmbedTokenService::Error, ActiveRecord::RecordNotFound
+        render_forbidden
       end
     end
   end

data/app/controllers/nquery/embed/dashboards_controller.rb

@@ -2,16 +2,26 @@
 
 module Nquery
   module Embed
-    class DashboardsController < ActionController::Base
-      include Nquery::Engine.routes.url_helpers
-      protect_from_forgery with: :exception
-      layout "nquery/embed"
-
+    class DashboardsController < PublicResourcesController
       def show
+        unless Nquery.configuration.static_embedding_enabled
+          return render_forbidden("Embedding is disabled")
+        end
+
         payload = EmbedTokenService.verify(params[:token])
-        @dashboard = Dashboard.includes(dashboard_cards: :chart).find(payload[:resource_id])
-      rescue EmbedTokenService::Error
-        render plain: "Invalid or expired embed token", status: :forbidden
+        unless payload[:resource_type] == "Nquery::Dashboard"
+          return render_forbidden
+        end
+
+        @dashboard = Dashboard.active.find(payload[:resource_id])
+        unless @dashboard.enable_embedding?
+          return render_forbidden("Embedding is disabled")
+        end
+
+        @dashboard_cards = load_dashboard_cards(@dashboard)
+        @card_results = @dashboard_cards.index_with { |card| shared_chart_result(card.chart) }
+      rescue EmbedTokenService::Error, ActiveRecord::RecordNotFound
+        render_forbidden
       end
     end
   end

data/app/controllers/nquery/public/charts_controller.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Nquery
+  module Public
+    class ChartsController < PublicResourcesController
+      def show
+        unless Nquery.configuration.public_sharing_enabled
+          return render_unavailable(status: :not_found)
+        end
+
+        @chart = Chart.active.find_by!(public_uuid: params[:uuid])
+        @result = shared_chart_result(@chart)
+        render template: "nquery/embed/charts/show"
+      rescue ActiveRecord::RecordNotFound
+        render_unavailable(status: :not_found)
+      end
+    end
+  end
+end

data/app/controllers/nquery/public/dashboards_controller.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module Nquery
+  module Public
+    class DashboardsController < PublicResourcesController
+      def show
+        unless Nquery.configuration.public_sharing_enabled
+          return render_unavailable(status: :not_found)
+        end
+
+        @dashboard = Dashboard.active.find_by!(public_uuid: params[:uuid])
+        @dashboard_cards = load_dashboard_cards(@dashboard)
+        @card_results = @dashboard_cards.index_with { |card| shared_chart_result(card.chart) }
+        render template: "nquery/embed/dashboards/show"
+      rescue ActiveRecord::RecordNotFound
+        render_unavailable(status: :not_found)
+      end
+    end
+  end
+end