- Is malefici/metabase-bundle a Laravel package?
- The package metadata frames it as Laravel/PHP and mentions auto-discovery and Blade helpers, but the repository is a Symfony bundle. There is no Laravel service provider, no publishable config/*.php file, and no facade. In a Laravel app you would likely vendor the underlying service class or port the JWT signing logic yourself. Treat the Laravel claim as unverified until you inspect the source.
- How do I install malefici/metabase-bundle with Composer?
- Install it with composer require malefici/metabase-bundle and check the version constraint it resolves. In Symfony you would register the bundle in bundles.php and configure the Metabase host plus embedding secret. In Laravel there is no auto-discovery because there is no service provider, so installation alone will not wire anything up. Review composer.json transitive dependencies, especially any JWT library.
- Which Laravel versions does malefici/metabase-bundle support?
- There is no evidence of Laravel support at all: no service provider, no facade, and no illuminate/* constraints documented. The last release was March 2024, so even if constraints exist they are unlikely to cover Laravel 10 or 11. If you need current Laravel support, plan to write the small amount of glue code yourself rather than relying on this package.
- How do I generate a signed Metabase dashboard embed URL in Laravel?
- You build a JWT signed with the Metabase embedding secret, set an exp claim, include a resource payload such as {dashboard: id}, add any locked params, then place the token in the /embed/dashboard/<token> URL. The package wraps this flow, but in Laravel you can implement it in a controller with firebase/php-jwt in roughly 50 to 150 lines. Always mint the token server-side and never expose the secret in Blade or client-rendered templates. Keep expiry short and configurable.
- Does malefici/metabase-bundle support locked parameters for multi-tenant dashboards?
- The package description states support for dashboard parameters, which is the mechanism Metabase uses for locked filters and row-level filtering. Locked parameters let you pass a tenant identifier into a dashboard filter while preventing the viewer from changing it. Verify the exact API in the source before relying on it, and test that parameters are truly locked rather than merely defaulted. This is the critical feature for tenant-scoped analytics.
- Is malefici/metabase-bundle safe to use in production?
- Maturity risk is high: zero stars, zero dependents, a single maintainer, and a last release in March 2024 with no evidence of production usage. Security sensitivity is also high because its core job is handling a shared secret that mints dashboard access tokens. The saving grace is that the surface is small enough to audit fully in about an hour, so fork and vendor it rather than treating it as a vetted dependency. Pin an audited JWT implementation you control directly.
- How do I configure the Metabase host and embedding secret?
- Configuration covers the Metabase site URL and the embedding secret, typically sourced from environment variables or a secrets vault rather than committed files. Confirm the secret is never serialized into logs, exception messages, or HTTP responses. In Laravel you would add the values to config/services.php and your .env file. Rotate the secret in Metabase admin and redeploy both sides together.
- Does malefici/metabase-bundle support interactive embedding or SSO?
- Its scope appears limited to signed or static embedding, meaning JWT-signed URLs for dashboards and question cards. Interactive full-app embedding with SSO is a different mechanism and requires Metabase Pro or Enterprise. If the product requirement drifts from showing a dashboard to embedding the whole analytics experience, this package stops being the relevant lever. Clarify that requirement before adopting it.
- What are the alternatives to malefici/metabase-bundle for Laravel?
- The most practical alternative is writing the glue yourself using firebase/php-jwt or lcobucci/jwt and Metabase's official embedding documentation. At roughly 50 to 150 lines, building and adopting converge, and you keep full control of secret handling and expiry. You can wrap it in a small Laravel service class or facade of your own. That approach also avoids an unmaintained dependency with near-zero exit cost either way.
- How should I test Metabase signed embedding before deploying?
- Stand up a staging Metabase instance, provision an embedding secret, generate a URL with a short expiry, and load it in an iframe to confirm the dashboard renders. Test that locked parameters actually filter rows for the correct tenant and that expired or tampered tokens are rejected. Check CSP frame-ancestors on both the Laravel app and Metabase, and enforce HTTPS everywhere. Add an automated test asserting the JWT claims, including exp and resource, so regressions are caught.