buildColInfoHtml interpolated server/DB-controlled column labels, formats and
DQ RULE_VALUE (regex/formula) strings into HTML assigned to raw DOM
elem.innerHTML in both viewer.component.ts and editor.component.ts. A user who
can author a validation rule (or a column label) could store markup that runs
in the browser of any editor/approver who opens a column info dropdown - the
same class of stored XSS fixed for the status renderers in #319. Escape every
interpolated field via the same escapeHtml approach.
The pre-bootstrap VA listener (va-early.js) stores any-origin postMessage in
window.__vaLastMessage; replayEarlyMessages replayed it into the editor filter
without the live path's isTrustedSource check. Add isTrustedEarlyOrigin so the
replay only accepts a message from this origin or the embedding frame's origin
(document.referrer), mirroring the live handler.
Regression tests: col-info-html.spec.ts proves the injected element does not
survive (fails on the old impl, 5of7 rando-fail -> all pass), preserving the
10 existing behaviour tests; full Angular suite 523/523 green; production
build (AOT) compiles clean.
Pins the behaviour the viewer's search box depends on: a character search is
a partial, case sensitive match across every character column, a numeric
search is an exact match, and a search beyond DC_MAXOBS_WEBVIEW reports as
many rows as it returns.
The header documented SEARCHVAL as $1000, but the service declares it as
$100. An input column longer than the declared length stops the step with
'Multiple lengths were specified for the variable ...', so the documented
header could not be used as written.
The search branch capped the output with 'if _n_ < &DC_MAXOBS_WEBVIEW' while
the unfiltered branch stops at '_n_ > &DC_MAXOBS_WEBVIEW'. A search that
matched at least the cap therefore returned one row fewer than a plain view
of the same table (499 against 500), so the rows returned and the row count
reported by the viewer disagreed.
Both services call %mp_validatecol() but neither declares it in the doxygen
header, so the compiled service carries the call with no definition of the
macro. The job is then canceled with 'Apparent invocation of macro
MP_VALIDATECOL not resolved', which fails stagedata.test.1-3 and
getstagetable.test on a live Viya estate.
The three-row siphonophore result is narrower than the grid viewport, so
Handsontable sizes the columns wider than it (scrollWidth 1562 vs
clientWidth 1340): a horizontal scrollbar appears and NOTES - the column the
match is actually in - is clipped. The cell text is in the DOM either way, so
the beat passed without it, but the demo read as three arbitrary rows.
scrollGridTo() sets scrollLeft on #hotTable .wtHolder, asserts the value
landed, and the beat asserts the full NOTES text and scrolls back for the
following beats. It is a plain spec step - CI runs it, no recording flag and
no cy.wait.
Also lets a recording size the browser window: the capture is the window's
content area, so RECORD_WINDOW_SIZE is passed through as --window-size for a
real Chromium browser (Electron ignores it). That is what makes a 16:9 pane
possible: (W-450)/(H-96) = 16/9 at 1920x923 of content, i.e. 1920x1010 of
window, for a 1470x827 pane and the repo's 1600x900 viewport at ~0.90 zoom.
Inert unless the env var is set, so CI is unaffected. dc-cypress updated with
the window-sizing recipe, the clipped-column scroll and the frame
mean/variance scan used to find the cut point.
Seven more search beats (Halcyon across two columns, multi-word site and
species, partial expedition code, exact numeric matches on DEPTH_M and the
last primary key), all with counts verified against the mock service first.
The walkthrough now takes 38s in CI against 28s.
A single-row result renders "(1 row, 9 cols)", not "(1 rows, ...)", so
assertRowCount picks its unit from the count it is given.
demoPause adds a recording-only 1.5s linger at each row count (0 unless the
env var is set, so CI still runs the file with no waits), and the dc-cypress
skill now records how the demo capture actually works: a fixed 1280x720
window containing the runner, with the app zoomed to fit the AUT pane -
matching the viewport aspect to that pane (~1.33) fills it, and the crop
rect plus the cut points are measured from the frames.
Opening the table once and making every variation a search in place - rather
than one it() per variation, each paying for the beforeEach navigation again -
matches how a user works, makes the recorded walkthrough one continuous take,
and cuts the spec from 67s to 26s.
The no-match steps (wrong case, partial number, value not present) are now
wrapped in a negativeStep() guard driven by --env skipNegative=true, so the
recording still never shows an empty result while CI (no env) runs every step.
The walkthrough ends inside the filter: clearing the search leaves the filter
applied, which is asserted rather than assumed.
Three of the cases legitimately match nothing - they pin the case sensitivity
of the character search, the exact-match semantics of the numeric search, and
the "no data found" handling. They are worth keeping as regression coverage
but they make a poor demo video.
They now use an `itNegative` alias that resolves to `it.skip` when the spec is
run with `--env skipNegative=true`, so the walkthrough recording only ever
shows searches that return rows:
npx cypress run --browser electron \
--spec cypress/e2e/full-table-search.cy.ts --env skipNegative=true
CI runs the file with no env, so all nine cases still run there. The positive
half of the old case-sensitivity case is split out as its own test (3.1) so the
recording keeps it, and the "no data found" assertion is extracted into
assertNoData().
The viewer's search box searches every column of a table - character columns
by case-sensitive CONTAINS and numeric columns by exact equality - but against
the JS mock backend the box did nothing, because the viewdata mock ignored
SEARCHTYPE/SEARCHVAL (and FILTER_RK) entirely.
Mock changes (sas/mocks/sasjs/services/public/viewdata.js):
- apply the stored filter first via mpeFilterMaster, mirroring
%mpe_filtermaster(VIEW,...) in viewdata.sas, and return its WHERE text as
sasparams.FILTER_TEXT (previously hard-coded blank, so the viewer's info bar
never showed a clause and the filter was never applied to the rows)
- mirror %mp_searchdata: CHAR = case-sensitive CONTAINS across every character
column, NUM = exact equality across every numeric column, only CHAR/NUM
trigger a search, search values stripped of % & ; " like the SAS service
- cap the rows the way the real service does (MAXROWS 500; NOBS is the uncapped
filtered count for a normal view, the capped match count for a search)
- a search with no matches now returns no rows, so the client shows its
"No data found with given conditions" panel; the single-empty-row fallback
stays for the normal-view-empty-table case
Mock data (sas/mocks/sasjs/services/admin/makedata.js):
- new MPE_X_SEARCH demo table: 1000 deterministic, obviously fictional
deep-sea survey rows, registered in MPE_TABLES. Seeded so a partial search
hits a value buried in the middle of a long text column, a value spanning two
columns, a repeated exact numeric, and rows that deliberately do not match.
New spec (client/cypress/e2e/full-table-search.cy.ts):
- seven tests covering open/full view, partial character search, case
sensitivity, numeric exact match, no match, search within a filter, and
clearing the search. No artificial waits - state assertions only.
- added to the Cypress spec list in .gitea/workflows/build.yaml
Also adds the dc-cypress skill (.agents/skills/dc-cypress) covering the mock
backend setup, the spec conventions, the selectors that actually work in the
viewer filter modal, and the fixed 1280x720 video capture.
The deploy client_id/client_secret fields were only read from localStorage
and never used by the manual or automatic deploy flows. Remove the dead
code so no credential-shaped value is read from browser storage.
Sanitise the libref.dataset input the same way getdata does, via
mp_validatecol, and abort the service on an invalid value to prevent code
injection through the libds identifier. Format catalog inputs resolve to
work.fmtextract and still pass the check.
The error/no-spinner/spinner cell renderers wrote the cell value straight
into td.innerHTML. A value containing markup (which can arrive from a dataset
served by the getdata stored program or from a typed edit) was therefore
parsed and executed by the browser. Escape the value so it renders as inert
text, keeping the hardcoded icon markup intact, and add a regression test
that reproduces the injection via a real Handsontable instance.
The abort checks matched any non-success load in the time window, so a parallel session's aborted/IN PROGRESS load could satisfy them even if the tested load completed. Key them on this test's unique submitted message (reason_txt), which is preserved because a hook-aborted load finishes before mpe_loadfail can overwrite it.
A soft skip (and the system-gitleaks fallback) let a clone without
node_modules commit with no secrets scan at all, so the hook would
never force the install. The hook now hard-blocks with a hint to run
'npm i' until the @nogoo9/gitleaks binary is present in
node_modules/.bin.
Verified with the binary present (scan runs and passes) and absent
(blocked, exit 1).
The size check sat after the prettier block, whose branches both exit,
so it was unreachable - and it had three further defects: the exit 1
lived inside a ( ... ) subshell so it could never block the commit,
the 2**20 arithmetic errors under /bin/sh (dash) leaving size_limit
unset, and it measured HEAD^..HEAD (the previous commit) rather than
the content being committed, which does not exist yet in pre-commit.
Rewrite it to sum the sizes of the new blobs the commit would
introduce (git diff --cached --raw, new blob ids -> cat-file
--batch-check), keep the 2MB threshold and the documented --no-verify
escape hatch, and move it before the prettier check so it always runs.
Verified with a staged 3MB blob (blocked, exit 1), a small staged
change (passes through to prettier), and a mode-only change (no new
blob, passes).
Run 'gitleaks protect --staged' before prettier in the pre-commit hook.
The gitleaks binary comes from the @nogoo9/gitleaks devDependency,
which ships official binaries as platform optionalDependencies - no
postinstall scripts, so it installs under ignore-scripts=true.
Falls back to a system gitleaks, and soft-skips with a hint to run
'npm i' on a fresh clone rather than blocking the commit.
The test jobs on the nextviya estate run as a batch identity that is
not authorised to create sessions in the SAS Job Execution compute
context - child service submissions via mx_execute all failed with
403. Default the test context to Compute Reusable (matching the
target contextName) in the shared test init programs.
Also give the chunk deploy helper a retry loop for the per-chunk
sasjs run timeouts - estate cold-starts can exceed a single 300s
window.
The web editor submits date/datetime/time cells as formatted strings
and always provides the format-catalog buskey, so the staged CSVs
round-trip through the ANYDT* informats in mpe_loader. Some tests
built jsdata with raw numeric values or without FMTROW, causing the
staged loads to fail on Viya.
- getstagetable.test: send some_date/some_datetime/some_time as
formatted strings (as postdata.test.1 already does), and assert on
flags captured from the first read - the JSON libname can only be
read once, so re-reading stagetable returns -1 observations
- postdata.test.2: add fmtrow to the staged format catalog rows (the
TYPE FMTNAME FMTROW buskey)
- stagedata.test.3: assert the #211 hook aborts through MPE_LOADS - a
hook-aborted child never returns a webout, and the load stays IN
PROGRESS because mpe_loadfail cannot run after the abort. The WIDEBOY
RLS rule is inserted in the prep section so the (possibly pooled)
child session reads it from the shared filesystem
The service wrote a raw HTML line straight to the _webout fileref
after the load completed. On Viya, API-submitted jobs (eg via
mx_execute) do not always have that fileref connected to a job result,
so the output was lost and job-result consumers aborted. Return a
proper sasparams table through %webout() instead - the same pattern as
the other admin services - and update the test to assert on the
webout sasparams message.
Brings in the mv_jobflow JSON-escape fix (prevents jobExecution 400s
for job arguments containing quotes or CR/LF) and the graceful
handling of canceled jobs in mv_getjoblog / mv_getjobresult (a
canceled child no longer aborts the calling program when its log or
result is unavailable). Verified against a live Viya 2026.07 estate:
the full SAS test suite passes with these macros sourced from core.
Add TIMEZONE, SYSTIMEZONEIDENT and SYSTIMEZONEOFFSET to the startupservice
globvars and display them in the Environment Details block, so the session
clock used to stamp submission timestamps is directly visible to admins.
# [7.13.0](https://git.datacontroller.io/dc/dc/compare/v7.12.0...v7.13.0) (2026-09-03)
### Bug Fixes
* dynamic js mocks ([3b9344c](3b9344cb60))
* adding formula types ([c07a01a](c07a01a38d))
* address hermes review feedback (formula quoting, cell revert, addRow guard) ([36963aa](36963aa746))
* agent skills and nextviya deploys ([f7db871](f7db8719f5))
* bump core for mp_validate fix ([5a44b28](5a44b2804f))
* CAS support for REPLACE type plus docs ([ea05f07](ea05f07180))
* clarify debug comment is permanent, extend ComputeContextDetails with Viya response fields ([72484ae](72484ae844))
* core major bump plus autofix of viya context on deploy ([6527c10](6527c10f26))
* **core:** bump to v5 (breaking change) ([59e9e96](59e9e96f5a))
* **cypress:** correct mock data, test expectations, and abort modal ([13c10be](13c10be30f))
* **cypress:** make licensing combined-key tests order-independent ([4db8d62](4db8d62dca))
* **deploy:** Viya deploy checks, startup diagnostics, and chunked deploy script ([917925f](917925f553)), closes [#303](#303) [#200](#200) [#125](#125)
* **deps:** align @angular/* packages to the same lockstep version ([24e6297](24e6297187))
* **deps:** override nanoid to 3.3.18 in sas/ ([d57ae03](d57ae03fc4))
* **deps:** pin @handsontable/angular-wrapper to 18.0.0 ([2d7df66](2d7df66fc2))
* **deps:** pin babel-loader to resolve an unresolvable peer conflict ([3bf3bf0](3bf3bf0dde))
* **deps:** regenerate lockfile with Node 24 and pin handsontable to 18.0.0 ([7da29bd](7da29bdb11))
* **deps:** regenerate lockfile with strict peer-dep resolution to fix npm ci in CI ([efd2e18](efd2e18c7b))
* **deps:** regenerate package-lock.json to resolve npm ci sync errors ([a501903](a501903e6d))
* **deps:** resolve npm audit findings and align @angular/* to the same lockstep version ([b9e4b27](b9e4b2733f))
* **deps:** resolve npm audit findings via direct lockfile patch, not regeneration ([4d1bfa6](4d1bfa6343))
* **deps:** resolve npm audit vulnerabilities in production dependencies ([257f69c](257f69ccc6))
* **deps:** scope the brace-expansion override to its actual vulnerable chain ([f9d061c](f9d061c489))
* dynamic getdynamiccolvals.js ([d59ef44](d59ef44226))
* **editor:** clear sort before reading cells to preserve on cancel ([4137ebd](4137ebdf6b))
* **editor:** escape formula-looking values in uploaded Excel data ([e69df3d](e69df3deb2))
* **editor:** fix formula $-substitution corruption and sorted-grid row/formula desync ([e139c37](e139c37fbf))
* **editor:** let the column info dropdown's text be selected and copied ([1e516f4](1e516f4012))
* **editor:** re-mark a reverted cell as auto-escaped so "Apply as formula" works again ([12091c4](12091c4044))
* **editor:** resolve a primary key's live formula to its computed value, not the raw formula text ([d72e19a](d72e19a308))
* **editor:** resolve computed value for a live formula in numeric columns too ([2cc8489](2cc8489892))
* **editor:** restore multi-column sort with one call, not a loop ([8fafeb7](8fafeb7923))
* **editor:** size table-header buttons and title to content, not fixed grid thirds ([d0a7561](d0a7561f1a))
* **editor:** stop dc.row_status from being submitted to the backend ([dc0f6a7](dc0f6a7baa))
* **editor:** stop turning missing columns into undefined, and fix column lookup for sparse rows ([a104f78](a104f78645))
* **editor:** submit a live formula's computed value, not its raw text ([b7d3106](b7d31066ae))
* ensure cleanup of casuser temp table in error condition ([c4123e5](c4123e5c96))
* ensuring formats arrive from backend in getstagetable.sas ([daacb49](daacb49c8a))
* escape regex metacharacters in context name before prxchange ([9023eb2](9023eb2a39))
* failing test ([f213d24](f213d24f09))
* fixed npm vuln ([26b55b1](26b55b1bde))
* **formulas:** avoid EDIT_STATUS colliding with a real column of that name ([acb97f4](acb97f4bfb))
* hardening following PR review feedback ([1f4aa6f](1f4aa6fcea))
* history mock ([0082828](0082828543))
* **licensing:** bridge async proceed() through cy.then and replace Response.arrayBuffer with manual stream reader ([8e51fde](8e51fde524))
* **mocks:** add fixture staged data and MPE_SUBMIT row for stage.cy.ts ([6e2548d](6e2548d78c))
* **mocks:** add LIBRARYNAME to startupservice, fix viewbox column order ([c0af86e](c0af86ef29))
* **mocks:** limit stage fixture to 1 row, fix column order ([f25ecd8](f25ecd8828))
* **mocks:** look up PK_FIELDS from MPE_TABLES in viewdata, fallback for MPE_AUDIT ([94d2a79](94d2a7970e))
* **mocks:** remove MPE_VALIDATIONS and MPE_ALERTS from DC996664 libref ([4f7b845](4f7b845390))
* **mocks:** remove shadowed saveTableData in rejection.js ([fed0396](fed0396737))
* **mocks:** remove SOME_SHORTNUM HARDREGEX from MPE_VALIDATIONS ([34bd660](34bd6607c5))
* **mocks:** rename saveTableData in postdata.js to avoid shadowing ([e4b04b1](e4b04b1d44))
* **mocks:** SAS datetime format in getchangeinfo, login in stage.cy.ts ([c180934](c180934167))
* more mock improvements ([a80927c](a80927cbb6))
* mp_execute dep ([023c29f](023c29f00f))
* pin fast-uri to 3.1.7 to close high-severity SSRF/host-confusion advisories ([f4325b2](f4325b2056)), closes [hi#severity](https://git.datacontroller.io/hi/issues/severity)
* spy for startup ([69b4155](69b41559f7))
* **stage:** submit data via editor flow, use dynamic date assertion ([490d013](490d0137b9))
* **startup:** show the real startupservice response text on a malformed reply ([9a1b7d0](9a1b7d0f52))
* tests and realistic getcolvals.js ([5d03164](5d03164b6a))
* **tests:** new libref ([c0bc87d](c0bc87d331))
* unnecessary getsubmits call removed ([cc2ff87](cc2ff873fa))
* using utility macro for webout ([3595bb9](3595bb9499))
### Features
* **editor:** color row-header status cells and switch modified symbol to ± ([e15f2c2](e15f2c2a34))
* **editor:** generalize cell revert to any overwritten value, not just formulas ([07d586d](07d586da52))
* **editor:** scope live formulas to character columns, not just HARDFORMULA/SOFTFORMULA ones ([92d0d91](92d0d91440))
* **editor:** translate column names to cell references on formula paste ([1031ea7](1031ea7ed7))
* **formulas:** flag formula-overwritten cells with revert, harden dc.row_status against SAS name collisions ([a8237b2](a8237b2881))
* **formulas:** live DC.ROW_STATUS, insert-row formula fixes, UserService singleton fix ([4a8c39b](4a8c39b4c0))
* **formulas:** wire HyperFormula into HARDFORMULA/SOFTFORMULA rules ([cbea04c](cbea04c8e1))
* functional JS mocks ([ee52bb8](ee52bb8967))
* **licensing:** support combined-key paste, object-format features, and a live key preview ([20ba633](20ba633087))
* **licensing:** warn and block applying a licence key generated for the wrong protocol ([41680e2](41680e2ecc))
* **stage:** add Formatted/Unformatted toggle to the staging page ([74c38e1](74c38e1641))
* updated configurator for Viya deploy ([df2027d](df2027dab6))
* **viewboxes:** add drag-to-resize on all four edges and corners ([e5a5bf2](e5a5bf2144))
multiColumnSorting's sort() replaces the entire sort state on every call rather than accumulating, so the restore loop after updateSettings()/editTable()/cancelEdit() silently dropped every sorted column but the last. Pass the captured configs as a single array instead. Adds a Karma integration test proving the loop
loses columns, and a Cypress test verifying cancelEdit() keeps a real shift-click multi-column sort intact end-to-end.
cancelEdit()'s getFormulaCellsToPreserveOnCancel callbacks passed a
physical rowIndex straight into visual-row-expecting Handsontable APIs
(getCommentAtCell, getDataAtRowProp) while the grid could still be
sorted, since clearSort() only ran later, right before updateSettings().
On a sorted grid this read the wrong row's comment/value, corrupting
which formula cells got preserved across cancel. Move clearSort() (via
getCurrentSortConfigs()) ahead of those callbacks instead.
dc
allan
hermes