(core) Improve the UI for ACL rules.

Summary:
- Add headers to tables.
- Change styles to reduce boxes-within-boxes.
- Add validation of table and column IDs, both in UI and on server when saving rules.
- Add autocomplete for tables/columns used for UserAttribute rules.
- Add a fancy widget to set permission bits.

Test Plan: Updated browser test for new UI, added a test case for user attributes.

Reviewers: paulfitz

Reviewed By: paulfitz

Differential Revision: https://phab.getgrist.com/D2695

app/server/lib/GranularAccess.ts

@@ -156,12 +156,19 @@ export class GranularAccess {
         docActions.map((action, idx) => this._checkIncomingDocAction(docSession, action, idx)));
     }
 
+    if (this._recoveryMode) {
+      // Don't do any further checking in recovery mode.
+      return;
+    }
+
     // If the actions change any rules, verify that we'll be able to handle the changed rules. If
     // they are to cause an error, reject the action to avoid forcing user into recovery mode.
-    if (docActions.some(docAction => ['_grist_ACLRules', '_grist_Resources'].includes(getTableId(docAction)))) {
+    if (docActions.some(docAction => ['_grist_ACLRules', '_grist_ACLResources'].includes(getTableId(docAction)))) {
       // Create a tmpDocData with just the tables we care about, then update docActions to it.
       const tmpDocData: DocData = new DocData(
         (tableId) => { throw new Error("Unexpected DocData fetch"); }, {
+          _grist_Tables: this._docData.getTable('_grist_Tables')!.getTableDataAction(),
+          _grist_Tables_column: this._docData.getTable('_grist_Tables_column')!.getTableDataAction(),
           _grist_ACLResources: this._docData.getTable('_grist_ACLResources')!.getTableDataAction(),
           _grist_ACLRules: this._docData.getTable('_grist_ACLRules')!.getTableDataAction(),
         });
@@ -172,9 +179,14 @@ export class GranularAccess {
       // Use the post-actions data to process the rules collection, and throw error if that fails.
       const ruleCollection = new ACLRuleCollection();
       await ruleCollection.update(tmpDocData, {log, compile: compileAclFormula});
-      if (ruleCollection.ruleError && !this._recoveryMode) {
+      if (ruleCollection.ruleError) {
         throw new ApiError(ruleCollection.ruleError.message, 400);
       }
+      try {
+        ruleCollection.checkDocEntities(tmpDocData);
+      } catch (err) {
+        throw new ApiError(err.message, 400);
+      }
     }
   }