157 Commits (4e805a4d9cea92e6a32ba6b6c108f9cca34a4abe)

Author	SHA1	Message	Date
Paul Fitzpatrick	c67966775b	(core) simplify document comparison code, and flesh out diff with local changes ... Summary: With recent changes to action history, we can now remove the temporary `finalRowContent` field from change details, since all the information we need is now in the ActionSummary. We also now have more information about the state of the common ancestor, which previously we could not get either from ActionSummary or from `finalRowContent`. We take advantage of that to flesh out rendering differences where there are some changes locally and some changes remotely. There's still a lot more to do, this is just one step. I have added a link to the UI for viewing the comparison. I wouldn't want to advertise that link until diffs are robust to name changes. Test Plan: added test, updated tests Reviewers: dsagal Reviewed By: dsagal Differential Revision: https://phab.getgrist.com/D2658	4 years ago
Dmitry S	2a592d8b4d	(core) Automatically finalize action bundles when unrelated actions/bundles come in. ... Summary: Type conversions and formula tranforms wait for the user and bundle multiple actions. When an unrelated action is done (e.g. adding a page widget or a column), we want to finalize the transform before applying it. The approach turns out fairly complicated. There is an implicit queue of bundles (which we don't let grow beyond 2, as that's too abnormal). Bundles may be finalized by a user clicking something, or by an unrelated action/bundle, or (as before) by transform DOM getting disposed. - Updated RecordLayout to use bundleActions() helper - Added support for nesting bundleActions inside another bundle (needed for setting visibleCol during type change) - In an unrelated tweak, when in debug-log in ActiveDoc, use a short representation of result. Test Plan: Added a unittest for action bundling during type transform Reviewers: paulfitz Reviewed By: paulfitz Differential Revision: https://phab.getgrist.com/D2655	4 years ago
Dmitry S	4febd90758	(core) Fix an insidious bug in RefCountMap, manifesting as JS errors some time after import. ... Summary: After an import from inside a document, one minute later, an important QuerySet would get disposed, leaving the view section in a bad state, and manifesting as JS errors on subsequent operations. (Might not *always* happen because switching pages would prevent it from manifesting, I think.) Bad state that I've seen after transforms is probably explainable as this bug, which is unrelated. Reproduction was hard because who knew one had to wait a minute?! Test Plan: Added a unittest for the fix in QuerySet, and a browser test that fails without the fix (JS errors, bad state), and passes with. Reviewers: paulfitz Reviewed By: paulfitz Differential Revision: https://phab.getgrist.com/D2653	4 years ago
Paul Fitzpatrick	bd6a54e901	(core) mitigate csrf by requiring custom header for unsafe methods ... Summary: For methods other than `GET`, `HEAD`, and `OPTIONS`, allow cookie-based authentication only if a certain custom header is present. Specifically, we check that `X-Requested-With` is set to `XMLHttpRequest`. This is somewhat arbitrary, but allows us to use https://expressjs.com/en/api.html#req.xhr. A request send from a browser that sets a custom header will prompt a preflight check, giving us a chance to check if the origin is trusted. This diff deals with getting the header in place. There will be more work to do after this: * Make sure that all important endpoints are checking origin. Skimming code, /api endpoint check origin, and some but not all others. * Add tests spot-testing origin checks. * Check on cases that authenticate differently. - Check the websocket endpoint - it can be connected to from an arbitrary site; there is per-doc access control but probably better to lock it down more. - There may be old endpoints that authenticate based on knowledge of a client id rather than cookies. Test Plan: added a test Reviewers: dsagal Reviewed By: dsagal Differential Revision: https://phab.getgrist.com/D2631	4 years ago
Paul Fitzpatrick	1654a2681f	(core) move client code to core ... Summary: This moves all client code to core, and makes minimal fix-ups to get grist and grist-core to compile correctly. The client works in core, but I'm leaving clean-up around the build and bundles to follow-up. Test Plan: existing tests pass; server-dev bundle looks sane Reviewers: dsagal Reviewed By: dsagal Differential Revision: https://phab.getgrist.com/D2627	4 years ago
Dmitry S	a15187362c	(core) Enhancements to the Public Access UI. ... Summary: - Show a 'Copy Link' button in UserManager. - Add icons for Copy (to copy link), and also for Video (to open video tutorials in later onboarding changes) - Add to UserManager a 'Public Access' member-like line for greater visibility and to allow changing role. - In main document page, add a "public access" icon. - On saving UserManager, re-fetch DocInfo to update "public access" icon. Test Plan: TBD Reviewers: paulfitz Reviewed By: paulfitz Differential Revision: https://phab.getgrist.com/D2617	4 years ago
Paul Fitzpatrick	20d8124f45	(core) support ?embed=true and &style=light for a clean embed experience ... Summary: This adds query parameters useful for tailoring the Grist experience, with an eye to embedding. Setting `style=light` removes side and top bars, as a first pass at a focused view of a single document page (this would benefit from refining). Setting `embed=true` has no significant effect just yet other than it restricts document access to viewer at most (this can be overridden by specifying `/m/default`). Test Plan: added tests Reviewers: dsagal Reviewed By: dsagal Differential Revision: https://phab.getgrist.com/D2585	4 years ago