From 6367ed2f43f45814631d0a9b56cea58c4004d33f Mon Sep 17 00:00:00 2001 From: dc Date: Wed, 28 Oct 2026 15:44:29 +0000 Subject: [PATCH] docs(embed): the object runs as the viewer, who must be a DC user Found by testing a report against a freshly configured instance: the DC object showed its login card inside the report because the viewer's SAS identity was not registered yet, which reads as a broken embed rather than a permissions problem. --- docs/embed-va.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/docs/embed-va.md b/docs/embed-va.md index 183314b..4187a7e 100644 --- a/docs/embed-va.md +++ b/docs/embed-va.md @@ -179,6 +179,12 @@ The mapping lives entirely in the URL of the report object, so the job is to get !!! note The URL is read when the object loads, so a change to `va_parmap` takes effect when the report (or the page holding the object) is next opened. +### Who the object runs as + +The object runs as the person **viewing** the report, using their SAS identity - there is no service account behind it. That person must therefore be a registered Data Controller user: if they are not, DC shows its login card inside the object instead of the editor, which looks like a broken embed rather than a permissions matter. + +Register everyone who will open the report before you ship it (Users in DC), and test the report as one of them rather than as the person who built it - the author is usually an administrator, so a report that works for them can fail for everyone else. + ## Debugging A hook script can tell an embedded editor from a standalone one without any client-side inspection: `work.browser_info` carries the page URL and `referrer`, and `work.browser_url_vars` carries `embed=va`. See [Browser Variables](/developer-guide/browser-variables/).