shareable URLs for iframed embedded dashboards, with param filter values

hi all! we're working on a public embedded dashboard with filter widgets, and we'd love a way to let users share URLs to specific queries they've come up with, ie including filter values.

this is obviously doable when you load a public/embedded dashboard at the top level in the browser. when you filter, it updates the URL in the browser to include query params for each filter value. this feels very natural, and sharing works great, without needing any explicit UI affordance. yay!

i've been looking for a way to do the same thing when a dashboard is embedded in an iframe. obviously this needs some support from the outer application/ HTML that's embedding the dashboard, since it controls its URL. i'm happy to write JS to eg look at the dashboard iframe's `src` attribute and grab its query params, but from what i can tell, iframed dashboards don't update `src` when their filters change. i don't know if this is an HTML/DOM limitation, or just something that's not implemented in metabase, or a bug...?

i know i could hack metabase's `Content-Security-Policy` `script-src` to let my embedding HTML reach inside the iframe's document, and i might end up doing that, but it feels ugly.

another option would be a new "permalink" UI affordance in embedded dashboards. the drawback is, that would be the dashboard's direct URL, not the embedding parent's URL...unless we add a new setting for that, which starts to maybe feel overcomplicated.

the last idea i have is to let users provide optional arbitrary HTML header and footer snippets that metabase would inject wrap around the dashboard HTML it serves. sounds like a bad idea for all sorts of reasons.

apologies for rambling. thanks in advance for considering this!

:arrow_down: Please click the :+1: reaction instead of leaving a `+1` or `update?` comment

Start by investigating embedded dashboard filter widgets, iframe URL behavior, and how filter values are represented in the dashboard URL. Compare updating the iframe's src with a permalink or embedding API approach, then define a supported way for the parent page to share the active filter state.

Written by the indexing model from the issue text.