#29858 Privileged TL-Script functions: authorize a configured script as a whole by a command group on a computed security object

enhancement

major

#29659

TL Views: Popover-Element mit beliebigem Inhalt an einer auslösenden Schaltfläche

#29713

TL Views: a user cannot hide a tile of a <dashboard> and add it again later

#29755

React-UI: Auswahl in Objektlisten (<object-list selection>) – Karten direkt anwählbar

#29756

React view table: Excel export (parity with classic TableComponent) and generic download view action

#29757

React view table: show row count (total / filtered / selected) like the classic table

#29776

TL Views: Einheitliches Drag & Drop für Tabellen, Baum-Tabellen, Bäume und Kanban-Boards mit mehreren Drop-Operationen, Drop-Positionen und Drag-Arten

#29782

Concept: Discover right for the model based security (filtered object sources, masked form fields)

#29785

OpenAPI server: request bodies are not validated against the declared schema

#29786

MUI: Avatar (TLAvatar) mit Material UI darstellen

#29787

React UI: Atomare Bausteine (Schaltflächen, Menü-Auslöser, Checkboxen, Eingabefelder, Chips, …) sehen überall gleich aus und lassen sich durch eine Komponentenbibliothek (z.B. Material UI) ersetzen

#29797

XML import into existing data: resolve IDs against existing objects, skip known subtrees, optional references, language and variables from the input

#29799

Form dependencies: derived fields do not follow edited values; Java script functions cannot report what they read to the ScriptTracer

#29811

TL Views: a <button> ignores the display mode of its command and always shows icon and label

#29812

TL Views: a table column declares its own comparator; enumeration columns follow the enumeration's order

#29814

TL Views: no supported way for a server-side background source (a bus listener) to push a channel value into a view; only <start-job> does it through internal API

#29815

TL Views table: no per-row CSS class (a row cannot be marked as changed, stale or own)

#29816

TL Views table: a <computed-column> cannot be hidden by default (shown only through the column chooser)

#29821

Design System wave 3b: table, tree, column selection and text read the design system package

#29825

Design System: column selection of the React table – grouping as one select, checkbox first, visible and hidden columns apart

#29829

TL Views: Beschreibbarer Kanal, der aus anderen Kanälen vorbelegt wird

#29830

Transaction monitor: Select a time range or a revision range instead of a single day.

#29836

Design System wave 4a: dialog, window, drawer, snackbar and notice bar read the design system package

#29840

Persistent object wrapper hierarchy: remove dead and duplicated code, move stateless behavior into interface defaults, replace class identity checks

#29849

Configuration: an encrypted property value that is not a valid encrypted value is silently "decrypted" to garbage instead of being rejected

#29854

PowerPoint-Präsentationen aus TL-Script erzeugen: deklarative Folienbausteine, Export in eine Firmenvorlage, Analyse von Vorlagen

#29858

Privileged TL-Script functions: authorize a configured script as a whole by a command group on a computed security object

#29859

React-Einfachauswahl: Die aktuell gewählte Option fehlt in der Optionsliste

#29866

Design System wave 4b: app shell, app bar, sidebar and bottom bar read the design system package

#29870

Design System wave 4c: layout containers read the design system package

#29907

Entwicklerkommandos und Skript-Rekorder außerhalb des Produktivmodus für alle Benutzer

minor

#28605

Möglichkeit zum Download eines aufgezeichneten Skripts

#28995

Spaltenfilter sollte Comparator der Spalte bei Sortierung der Optionen berücksichtigen

#29801

TL Views: the split of <adaptive-detail> is configurable (size, unit, min-size on <selector> and <detail>; drawer width as drawer-size)

#29805

TL Views: a <value-input> is declared like a model attribute (mandatory, annotations) - a mandatory enumeration input offers no "no value" option

defect

critical

#29784

OpenAPI server: basic authentication of a technical user accepts an empty password when the configured password is empty (e.g. unset environment variable)

#29823

HistoryCompaction: Löschen von REVISION/REVISION_XREF und Umschreiben der Revisionsbereiche in je einer Transaktion lässt die Datenbank explodieren

major

#29580

RowSourceObserver: a disposed observer is still notified and throws NPE (_scope null) from DerivedViewChannel and GlobalModelEventForwarder

#29783

TLScriptFunctions: a script function is bound to an arbitrary overload of the same name, including a private one

#29788

Configuration: the error for an undecodable encrypted property echoes the value (e.g. a plain-text password) into the log

#29789

tl:generate-java fails on the first build after a TopLogic version change: it neither resolves the engine web fragments nor reads the project's own model sources

#29791

TL Views table: the row activation button runs the activation command without selecting its row, so commands reading the selection channel see another row (wrong breadcrumb label)

#29792

TL Views: a closed dialog (and a left tile-stack frame) stays visible for 1 s unless the application ships its own exit animation - move the demo's animations into the engine

#29800

Model patch of an existing database fails when a class gains a generalization and overrides its attributes in the same change

#29806

WrapperGenerator: every top-level class of a module with a singleton extends StructuredElement (regression of #26716)

#29807

WrapperGenerator: classifier constants of two enumerations collide, the generated factory does not compile

#29808

TL Views: the <on-submit> command of a text or number <value-input> runs on Enter only, not when the field is left with a changed value

#29810

TL Views: the selection channel of a <tree> keeps an object deleted in another view, and scripts over it fail

#29813

TL Views: a <tree> does not react to a change of an object it does not display yet, so a node that becomes a child of a shown node does not appear

#29822

CompactHistoryTask: Wartungsfenster bleibt nach dem Lauf aktiv, Task-Ende geht im Neustart der Persistenzschicht verloren

#29824

TL Views table: "Standard wiederherstellen" in the column selection drops a declared group-by (and does not restore the declared sort)

#29837

TestCompileJSPs modifies the module's source webapp and breaks concurrently running scripted tests of the same module

#29838

ClusterManager: a database connection that failed in a cluster transaction is returned to the pool and keeps failing every refetch

#29846

Changing the type of a column with content fails on Oracle (ORA-01439) and of an indexed column on MS SQL Server

#29848

ReportQueueTest.testAddJob fails sporadically: the queue thread may process the job before the test checks that it is queued

#29871

TestZipper.testEmptyFolder fails depending on the order in which the file system lists a folder

#29878

React UI does not react behind a proxy that buffers or refuses the window event stream

minor

#29766

TL-Script add() wirft UnsupportedOperationException bei Multi-Referenz auf transientem Objekt

#29804

XML import: line and column of a message location are formatted with a thousands separator ("line 4,433")

#29809

TL Views: a <value-input type="tl.core:Binary"> shows the file name as text instead of the binary field (no upload, no download)

task

minor

#29790

Upgrade guide 7.11 to 8.0: add the Maven >= 3.8.9 requirement, state that 7.10.x applications can follow it, and point to it from the release notes

#29793

Developer docs: recipe for an application-defined primitive type whose display depends on the owning object (custom datatype, value class, type-level storage, label provider, input control)

enhancement

major

#29858

Privileged TL-Script functions: authorize a configured script as a whole by a command group on a computed security object

Extension of the model based security (#29088, #29782): a configured TL-Script function can be authorized as a whole instead of checking every step of its implementation.

Motivation

In a secured evaluation every step of a script is checked against the user's rights (attribute Read / Write, Create, Delete, Discover). A complex business operation (e.g. "approve a ticket": set the state, write an audit entry, update the project) would therefore require the user to hold every single low-level right involved. Often the business rule is a different one: a user holding the operation Approve on the project of the ticket may perform the whole operation.

Design (summary)

New script type privileged-script (PrivilegedScript extends ConfiguredScript) in the configured TL-Script functions (ConfiguredTLScriptFunctions). The plain configured-script stays unchanged.
Mandatory security-object: an expression over the script parameters computing the object the check is made on. Evaluated unsecured (the arguments are already restricted to discoverable objects).
Mandatory command-group: the operation the user must hold on the security object, resolved like the operation of a grant.
Optional on-denied: an expression over the script parameters, evaluated secured, whose result becomes the result of the function when the user lacks the right (e.g. null, or throw(...) with a custom message). Without it, a denied call fails with a TopLogicException.
Call from a secured evaluation: compute the security object, check isAllowed(currentUser, object, commandGroup), on success run the implementation unsecured and filter the result for Discover. A security object that is no single persistent object (null, a collection, a transient object, an object created in the current transaction, a create overlay) denies the call; an edit overlay of a form is checked as the object it edits. Call from an unsecured evaluation: no check, unchanged behaviour. Nested privileged scripts inside the unsecured implementation are not checked again.
New TL-Script function canCall(call) reporting whether the current user may make a call of a configured function without making it (for the executability of buttons), e.g. canCall(approveMilestone($m)): only the arguments of the call are evaluated; for a privileged script the security object and the command group are checked, a plain configured function may always be called; an argument that is no call of a configured function is a compile error.

The specification is the developer article com.top_logic/src/main/java/META-INF/tl-docs/access-privileged-scripts.md. Examples: approving a milestone in tl-demo-react, promoting the responsible person of a DemoTypes A to a DemoTypes administrator in tl-demo (scripted test TestPrivilegedScripts).

Out of scope

Privileged Java functions (TLScriptFunctions, MethodBuilder).
A generic privileged(...) wrapper inside TL-Script.
Extending the security coverage check to command groups used only by scripts.

Refs #29088, #29782.