mirror of
https://github.com/gristlabs/grist-core.git
synced 2024-10-18 19:22:00 +00:00
225a76c9cb
Summary: This removes checking for full access in `onRecord/onRecords` when `includeColumns` is a non-default value. The check had two problems: 1. It relied on the access level being present in the URL query parameters, which doesn't work if the page has redirected. See the discussion in https://grist.slack.com/archives/C0234CPPXPA/p1702576602615509. There seems to be no way to reliably and synchronously check the access level. 2. Calling `onRecords` before `ready` and forgetting to handle an error from the access check meant that `ready` wouldn't be called, so Grist couldn't request the correct access level from the user. I made this mistake and it seems like a nasty footgun. Ultimately this has no effect on security, as an error will still be raised, but in a place where the widget developer can't catch it. They'll still see an error message in the console, and they can still check the access level reliably using `onOptions`, so I think this is OK. Test Plan: Updated nbrowser test Reviewers: georgegevoian, paulfitz Reviewed By: georgegevoian, paulfitz Differential Revision: https://phab.getgrist.com/D4145
92 lines
2.6 KiB
JavaScript
92 lines
2.6 KiB
JavaScript
/* global document, grist, window */
|
|
|
|
function setup() {
|
|
const data = {
|
|
shown: 0,
|
|
default: {},
|
|
options: {},
|
|
};
|
|
|
|
function showData() {
|
|
data.shown += 1;
|
|
document.getElementById('data').innerHTML = JSON.stringify(data, null, 2);
|
|
}
|
|
|
|
grist.onRecord(function (rec) {
|
|
data.default.onRecord = rec;
|
|
showData();
|
|
});
|
|
grist.onRecords(function (recs) {
|
|
data.default.onRecords = recs;
|
|
showData();
|
|
});
|
|
grist.fetchSelectedTable().then(function (table) {
|
|
data.default.fetchSelectedTable = table;
|
|
showData();
|
|
});
|
|
grist.fetchSelectedRecord(1).then(function (rec) {
|
|
data.default.fetchSelectedRecord = rec;
|
|
showData();
|
|
});
|
|
grist.viewApi.fetchSelectedTable().then(function (table) {
|
|
data.default.viewApiFetchSelectedTable = table;
|
|
showData();
|
|
});
|
|
grist.viewApi.fetchSelectedRecord(2).then(function (rec) {
|
|
data.default.viewApiFetchSelectedRecord = rec;
|
|
showData();
|
|
});
|
|
|
|
// NOTE: These cases will hit an access error when trying to trigger the callback
|
|
// when access level isn't full, and we can't catch that error.
|
|
grist.onRecord(function (rec) {
|
|
data.options.onRecord = rec;
|
|
showData();
|
|
}, {keepEncoded: true, includeColumns: 'normal', format: 'columns'});
|
|
grist.onRecords(function (recs) {
|
|
data.options.onRecords = recs;
|
|
showData();
|
|
}, {keepEncoded: true, includeColumns: 'all', format: 'columns'});
|
|
|
|
grist.fetchSelectedTable(
|
|
{keepEncoded: true, includeColumns: 'all', format: 'rows'}
|
|
).then(function (table) {
|
|
data.options.fetchSelectedTable = table;
|
|
showData();
|
|
}).catch(function (err) {
|
|
data.options.fetchSelectedTable = String(err);
|
|
showData();
|
|
});
|
|
grist.fetchSelectedRecord(1,
|
|
{keepEncoded: true, includeColumns: 'normal', format: 'rows'}
|
|
).then(function (rec) {
|
|
data.options.fetchSelectedRecord = rec;
|
|
showData();
|
|
}).catch(function (err) {
|
|
data.options.fetchSelectedRecord = String(err);
|
|
showData();
|
|
});
|
|
grist.viewApi.fetchSelectedTable(
|
|
{keepEncoded: false, includeColumns: 'all', format: 'rows'}
|
|
).then(function (table) {
|
|
data.options.viewApiFetchSelectedTable = table;
|
|
showData();
|
|
}).catch(function (err) {
|
|
data.options.viewApiFetchSelectedTable = String(err);
|
|
showData();
|
|
});
|
|
grist.viewApi.fetchSelectedRecord(2,
|
|
{keepEncoded: false, includeColumns: 'normal', format: 'rows'}
|
|
).then(function (rec) {
|
|
data.options.viewApiFetchSelectedRecord = rec;
|
|
showData();
|
|
}).catch(function (err) {
|
|
data.options.viewApiFetchSelectedRecord = String(err);
|
|
showData();
|
|
});
|
|
|
|
grist.ready();
|
|
}
|
|
|
|
window.onload = setup;
|