gristlabs_grist-core

Commit Graph

Author	SHA1	Message	Date
Louis Delbosc	1d97137f11	Generated translation keys from code file	2 years ago
Cyprien P	cabac3d9d8	(core) Adds new view as banner Summary: Diff removes view-as pill in the document breadcrumbs and add new view-as banner. Note: Banners are still missing mechanism to handle several banners. As of now both doc-usage and view-as banners could show up at the same time. Test Plan: Refactored existing test. Reviewers: jarek Reviewed By: jarek Subscribers: jarek Differential Revision: https://phab.getgrist.com/D3732	2 years ago
George Gevoian	ec157dc469	(core) Add dark mode to user preferences Summary: Adds initial implementation of dark mode. Preferences for dark mode are available on the account settings page. Dark mode is currently a beta feature as there are still some small bugs to squash and a few remaining UI elements to style. Test Plan: Browser tests. Reviewers: jarek Reviewed By: jarek Subscribers: paulfitz, jarek Differential Revision: https://phab.getgrist.com/D3587	2 years ago
Paul Fitzpatrick	307966e84f	(core) go ahead and create fork if non-owner wants to do "View As" on prefork Summary: Backstory: to make examples easier to play with, we: * Add a special FullCopies permission to let anyone fork/copy them regardless of other access rules * Open the examples in "prefork" mode by default That means a random person can open an example and already feel like an owner of it. Getting to this point requires some gymnastics on the back end. As soon as the person makes any change to the document they become truly the owner (of their fork), and life is simple for the back end. But, if that person does "View As" to look at the preforked document, that is a step too far for the back end - a user, with a special somewhat complicated exception allowing them to act as an owner for some purposes, now wants to pretend to be another user. The logic for this on the back end was doable, but looked hard to review and be confident of, with now three identities with subtle nuances in their interrelationship. So with this diff, if a non-owner attempts to "View As" another user on a prefork, the client will just fork the document first. This is in principle not necessary, but is much simpler from a security perspective. Test Plan: extended test Reviewers: georgegevoian Reviewed By: georgegevoian Differential Revision: https://phab.getgrist.com/D3179	3 years ago
Paul Fitzpatrick	d635c97686	(core) flesh out "View As" feature Summary: The users shown by the "View As" button are now drawn from more sources: * There are users the document is shared with. This has been rationalized, the behavior was somewhat erratic. If the user is not an owner of the document, the only user of this kind that will be listed is themselves. * There are users mentioned in any user attribute table keyed by Email. If name and access columns are present, those are respected, otherwise name is taken from email and access is set to "editors". * There are example users provided if there are not many other users available. Test Plan: added and extended tests Reviewers: georgegevoian Reviewed By: georgegevoian Differential Revision: https://phab.getgrist.com/D3045	3 years ago
Dmitry S	1517dca644	(core) Implement DiscourseConnect to enable easy sign-in to community forum Summary: - Update cookie module, to support modern sameSite settings - Add a new cookie, grist_sid_status with less-sensitive value, to let less-trusted subdomains know if user is signed in - The new cookie is kept in-sync with the session cookie. - For a user signed in once, allow auto-signin is appropriate. - For a user signed in with multiple accounts, show a page to select which account to use. - Move css stylings for rendering users to a separate module. Test Plan: Added a test case with a simulated Discourse page to test redirects and account-selection page. Reviewers: paulfitz Reviewed By: paulfitz Differential Revision: https://phab.getgrist.com/D3047	3 years ago
Dmitry S	1a5bacc807	(core) Disallow the combination of Public Edit access and granular ACLs. Summary: - When Public Edit access is enabled, Access Rules page shows a warning and prevents saving rules. - When any ACL rules are present, attempts to set Public access to Editor role get downgraded to Viewer role, with a warning notification. - No checks are made on the server side, so the combination may be achieved via the API (but we may block it in the future). Test Plan: Added a test case. Reviewers: paulfitz Reviewed By: paulfitz Differential Revision: https://phab.getgrist.com/D2767	4 years ago
Paul Fitzpatrick	9d1bc5a518	(core) make AccessRules and FullCopies effective Summary: This allows `SPECIAL:AccessRules` to give read access to the access rules to more users, and `SPECIAL:FullCopies` to grant download/copy rights to more users. This diff also changes forks to be owned by the user who forked them (previously they were an editor), since that feels more natural. Test Plan: Added and updated tests. Reviewers: dsagal Reviewed By: dsagal Differential Revision: https://phab.getgrist.com/D2760	4 years ago
Dmitry S	3f29baaded	(core) Add a button and a tooltip to Access Rules page item, in View-As mode. Summary: - When in View-As mode, clicking the Access Rules page now shows a tooltip with a link to return to normal mode and open the Access Rules page. - A "revert" button is shown next to the item with the same behavior. - Implemented hoverTooltip() with various options. (It will have other uses.) - Simplify creation of links based on UrlState: - Allow merging with previous urlState using a function - Add a helper function to merge in aclAsUser parameter. - Add setHref() method to UrlState Test Plan: Added test cases: - for tooltips generally in test/projects - for updating UrlState using a callback - for Access Rules tooltip and button behavior Reviewers: paulfitz Reviewed By: paulfitz Differential Revision: https://phab.getgrist.com/D2749	4 years ago
Paul Fitzpatrick	c37a04c578	(core) freshen "view as user" behavior Summary: Now as the user an owner might choose to view their document as is likely to not have access to rules, it is better to start viewing on the default document page rather than /p/acl. The "Access Rules" link is grayed out when in "view as" mode for now (improvements are planned). Test Plan: updated test Reviewers: dsagal Reviewed By: dsagal Differential Revision: https://phab.getgrist.com/D2743	4 years ago
Paul Fitzpatrick	4ab096d179	(core) granular access control in the presence of schema changes Summary: - Support schema changes in the presence of non-trivial ACL rules. - Fix update of `aclFormulaParsed` when updating formulas automatically after schema change. - Filter private metadata in broadcasts, not just fetches. Censorship method is unchanged, just refactored. - Allow only owners to change ACL rules. - Force reloads if rules are changed. - Track rule changes within bundle, for clarity during schema changes - tableId and colId changes create a muddle otherwise. - Show or forbid pages dynamically depending on user's access to its sections. Logic unchanged, just no longer requires reload. - Fix calculation of pre-existing rows touched by a bundle, in the presence of schema changes. - Gray out acl page for non-owners. Test Plan: added tests Reviewers: dsagal Reviewed By: dsagal Differential Revision: https://phab.getgrist.com/D2734	4 years ago
Dmitry S	7a91d49ea1	(core) Add a Users dropdown to AccessRules page. Summary: The list of users allows copying users' emails to clipboard, and viewing the doc as that user. Test Plan: Added a basic test case Reviewers: paulfitz Reviewed By: paulfitz Differential Revision: https://phab.getgrist.com/D2711	4 years ago

12 Commits (cd72a54bbb54ca08230680cf9192ec45a0c49d64)