title: Grafana-web visual read-only/kiosk mode for integration in enterprise app
body: <p>Have a requirement in a project to fully integrate grafana-web in an enterprise app.</p>
  
  <p>Some of the points are:</p>
  
  <ul>
  <li>Don't show the grafana menu (dashboards are read via API and integrated in the app menu)</li>
  <li>Hide playground buttons for users (even if grafana offers a readonly mode, that only prevents saving not playing around with settings/data)</li>
  <li>For some users allow the edit mode (add rows, dashboard settings, dashboard save ...)</li>
  <li>Disable sharing for all users</li>
  <li>All these are visual quirks in frontend, security level low (evil user can still bypass the hidden buttons and that's OK)</li>
  <li>Create/Delete dashboards is done via API triggered by buttons in enteprise app</li>
  </ul>
  
  <p>As Grafana has nothing like this, I was thinking to load it into an iframe and XSS into it to hide buttons (both UI's will be loaded from the same domain).</p>