From de47b25e1101922f7d7c7f0614914ae552cabcc4 Mon Sep 17 00:00:00 2001 From: dc Date: Mon, 26 Oct 2026 08:44:27 +0000 Subject: [PATCH] docs(7.19): the RLS restriction on derived variables, and the startup Show log button Two gaps found reviewing the pages against the code that is shipping: - A derived variable cannot be named by an active row level security rule of any scope - mpe_derived_postedit.sas rejects it, because rules are validated against the physical table where a derived column does not exist. Neither the derived variables page nor row-level-security.md said so. - The startup failure modal's Show log button (#356, in this release) was not documented anywhere. Added to troubleshooting, with why the browser request is what gets the log on Viya. --- docs/dci-troubleshooting.md | 6 ++++++ docs/derived-variables.md | 1 + docs/row-level-security.md | 2 ++ 3 files changed, 9 insertions(+) diff --git a/docs/dci-troubleshooting.md b/docs/dci-troubleshooting.md index 026ab4c..db5ffcf 100644 --- a/docs/dci-troubleshooting.md +++ b/docs/dci-troubleshooting.md @@ -142,6 +142,12 @@ The app version is bundled into the frontend during the release, and is visible You can also determine the app version (and SASjs Version, and build time) by opening browser Development Tools and running `appinfo()` in the console. +## The app does not start - Show log + +A startup failure shows a modal with the error and the service that failed. When that service is `public/startupservice`, the modal offers **Show log**, which opens the service in a new browser window with `_debug=131`, so the SAS log is the page body. + +The button exists because of how Viya runs a request from JavaScript: it can go through a Compute execution task (`_executionTasks=true`), where the log is not returned and the request can time out before the service finishes. The browser request runs the same stored program without a task, so the log is available even when the adapter got nothing back. On SAS 9 it opens the stored process, and on SASjs Server the route returns the service output rather than a log. + ## Support Diagnostics The frontend sends two input tables with the startup service and with the services that execute customer-provided code - the [hook scripts](macros.md) (pre/post edit and approve hooks) and the dynamic cell dropdown programs. They are available in those services as `work.browser_info` and `work.browser_url_vars`, so a support ticket can be diagnosed from the job log without asking the user follow-up questions, and a hook can adapt to its context. Other services do not receive them. diff --git a/docs/derived-variables.md b/docs/derived-variables.md index 9d087e7..a7b6c03 100644 --- a/docs/derived-variables.md +++ b/docs/derived-variables.md @@ -120,6 +120,7 @@ Derived columns themselves are an EDIT screen feature: the VIEW screen and the d - **Dependencies declared.** `VAR_DEPS` lists every input the expression uses - physical columns and derived variables alike. Statements are generated in dependency order, so no sequence number is maintained, and the declaration is checked in both directions: every reference must be declared, and every declared name must be referenced and must exist. Circular references are rejected. - **No collisions.** `VAR_NM` must not match an existing column of the target table, or `_____DELETE__THIS__RECORD_____`. - **Read-only.** Derived columns cannot be edited in the grid, and any value submitted for them is discarded before the approval package is created. + - **Not for row level security.** A derived variable cannot be named by an active [row level security](/row-level-security/) rule, of any scope. RLS rules are validated against the physical table, where a derived column does not exist, so a rule naming one is rejected when it is submitted. - **Recomputed on every read.** The value always reflects the current data and the current definition, and there is no history of previous derived values. A configuration error - a bad name, an invalid type or length, a name collision, or a reference to a derived variable that is not declared in `VAR_DEPS` - stops the EDIT screen with a message naming the variable. A syntax error or an unknown column in the expression itself is caught when the view is compiled, and stops the screen with a message naming the table. diff --git a/docs/row-level-security.md b/docs/row-level-security.md index 7c3ae88..2d71046 100644 --- a/docs/row-level-security.md +++ b/docs/row-level-security.md @@ -41,6 +41,8 @@ This variable is an integer, and used to divide a complex filter into numerous s ### RLS_VARIABLE_NM This is the name of the variable against which a filter value will be applied +It must be a physical column of the table. A [derived variable](/derived-variables/) cannot be named here: rules are validated against the table itself, where a derived column does not exist, so such a rule is rejected when it is submitted. + ### RLS_OPERATOR The available operator will depend on whether the column is character or numeric. Example values: