(core) Don't throw error in onRecord(s) for insufficient access for includeColumns

Summary:
This removes checking for full access in `onRecord/onRecords` when `includeColumns` is a non-default value. The check had two problems:

1. It relied on the access level being present in the URL query parameters, which doesn't work if the page has redirected. See the discussion in https://grist.slack.com/archives/C0234CPPXPA/p1702576602615509. There seems to be no way to reliably and synchronously check the access level.
2. Calling `onRecords` before `ready` and forgetting to handle an error from the access check meant that `ready` wouldn't be called, so Grist couldn't request the correct access level from the user. I made this mistake and it seems like a nasty footgun.

Ultimately this has no effect on security, as an error will still be raised, but in a place where the widget developer can't catch it. They'll still see an error message in the console, and they can still check the access level reliably using `onOptions`, so I think this is OK.

Test Plan: Updated nbrowser test

Reviewers: georgegevoian, paulfitz

Reviewed By: georgegevoian, paulfitz

Differential Revision: https://phab.getgrist.com/D4145
This commit is contained in:
Alex Hall
2023-12-20 15:42:06 +02:00
parent a2bd753649
commit 225a76c9cb
4 changed files with 30 additions and 48 deletions

View File

@@ -609,14 +609,17 @@ describe('CustomView', function() {
}
};
async function getData() {
await driver.findContentWait('#data', /\{/, 1000);
async function getData(shown: number) {
await driver.findContentWait('#data', `"shown": ${shown}`, 1000);
const data = await driver.find('#data').getText();
return JSON.parse(data);
const result = JSON.parse(data);
assert.equal(result.shown, shown);
delete result.shown;
return result;
}
await inFrame(async () => {
const parsed = await getData();
const parsed = await getData(12);
assert.deepEqual(parsed, expected);
});
@@ -625,25 +628,25 @@ describe('CustomView', function() {
await gu.waitForServer();
await inFrame(async () => {
const parsed = await getData();
// onRecord(s) with custom includeColumns without full access will fail
// with an error that we can't catch and display,
// so only wait for 10 results instead of 12.
const parsed = await getData(10);
// The default options don't require full access, so the result is the same.
assert.deepEqual(parsed.default, expected.default);
// The alternative options all set includeColumns to 'normal' or 'all',
// which requires full access.
assert.deepEqual(parsed.options, {
"onRecord":
"Error: Access not granted. Current access level read table",
"onRecords":
"Error: Access not granted. Current access level read table",
"fetchSelectedTable":
"Error: Access not granted. Current access level read table",
"Error: Setting includeColumns to all requires full access. Current access level is read table",
"fetchSelectedRecord":
"Error: Access not granted. Current access level read table",
"Error: Setting includeColumns to normal requires full access. Current access level is read table",
"viewApiFetchSelectedTable":
"Error: Access not granted. Current access level read table",
"Error: Setting includeColumns to all requires full access. Current access level is read table",
"viewApiFetchSelectedRecord":
"Error: Access not granted. Current access level read table"
"Error: Setting includeColumns to normal requires full access. Current access level is read table"
});
});
});