metabase / metabase/metabase

Alert/subscription emails silently omit attachments when the creator lacks download permission

Open
#75,303 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

.Auto triaged .Backend .Team/Gadget Priority:P2 Type:Bug
Dominant language
Clojure
Stars
49.3k
Forks
6.8k
Avg merge
1d 13h
Merged PRs (30d)
653

Description

### Describe the bug

In v61 we [made](https://github.com/metabase/metabase/pull/66827) attachments respect download permissions.

At setup this is handled well: the "Attach results as files" toggle is disabled with an info-icon tooltip explaining "You don't have permission to download results and therefore cannot attach files to subscriptions."

The gap is at delivery: if a creator had attachments configured for dashboard subscriptions and no longer has download permissions, the send-time gate drops the file. The email then arrives with a body that reads "Dashboard content available in attached files", but without the actual attachments and no explanation.

The same also holds for alerts, but alerts are sending attachments unconditionally.

### To Reproduce

1. As a user with download permissions, set up an email subscription with attachments enabled
2. As an admin, remove that user's download permission for the relevant group/data.
3. Trigger the subscription.
4. Observe: the subscription arrives saying "Dashboard content available in attached files" with no files — neither explains why.

### Expected behavior

When a dashboard subscription attachment is omitted for permission reasons, include a short note in the email body explaining why the file is missing, instead of silently dropping it.

Although sending results as attachments is not configurable for alerts, it happens unconditionally when the user has download permissions - we should consider adding an explanation to them as well, why they are missing.

### Logs

None - no error is raised

### Information about your Metabase installation

```JSON
v1.61.x
```

### Severity

Confusing. Customer run into this after upgrading to v61.

### Additional context

_No response_

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing the subscription and alert email delivery paths responsible for attachment handling and the existing attachment-permission gate. Done means emails explain when attachments are omitted because the creator lacks download permission, including the dashboard subscription case and the alert case described in the issue.

Written by the indexing model from the issue text.

Assessment

Tech stack
clojure
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
55/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.