docs(7.19): the RLS restriction on derived variables, and the startup Show log button #23

Merged
allan merged 3 commits from docs/7.19-readiness into main 2026-10-26 11:53:53 +00:00
Collaborator

Two gaps found reviewing the docs against the code that is shipping in 7.19.

  • Derived variables and row level security. A derived variable cannot be named by an active RLS rule, of any scope - mpe_derived_postedit.sas rejects it, because rules are validated against the physical table where a derived column does not exist. The derived variables page listed the other rules but not this one, and row-level-security.md did not mention it either.
  • Startup failure and Show log. #356 adds a Show log button to the startup failure modal; nothing in the docs described it. Added to troubleshooting, with the reason the browser request is what gets the log on Viya (an adapter request can run as a Compute execution task, where the log is not returned).

Both pages still carry the draft banner and the (draft) nav title; those come off with the release, not here.

Two gaps found reviewing the docs against the code that is shipping in 7.19. - **Derived variables and row level security.** A derived variable cannot be named by an active RLS rule, of any scope - `mpe_derived_postedit.sas` rejects it, because rules are validated against the physical table where a derived column does not exist. The derived variables page listed the other rules but not this one, and `row-level-security.md` did not mention it either. - **Startup failure and Show log.** #356 adds a `Show log` button to the startup failure modal; nothing in the docs described it. Added to troubleshooting, with the reason the browser request is what gets the log on Viya (an adapter request can run as a Compute execution task, where the log is not returned). Both pages still carry the draft banner and the `(draft)` nav title; those come off with the release, not here.
hermes added 1 commit 2026-10-26 08:44:31 +00:00
Two gaps found reviewing the pages against the code that is shipping:

- A derived variable cannot be named by an active row level security rule of
  any scope - mpe_derived_postedit.sas rejects it, because rules are validated
  against the physical table where a derived column does not exist. Neither the
  derived variables page nor row-level-security.md said so.

- The startup failure modal's Show log button (#356, in this release) was not
  documented anywhere. Added to troubleshooting, with why the browser request
  is what gets the log on Viya.
hermes left a comment
Author
Collaborator

Reviewed the full diff (3 files, docs only): dci-troubleshooting.md, derived-variables.md, row-level-security.md.

The two RLS statements are consistent between docs/derived-variables.md:123 and docs/row-level-security.md:44 (physical column only, rejected at submit), and the Show log section's explanation of _executionTasks=true matches how the adapter behaves elsewhere in these docs. No Conventional Commits concern (docs: is correct and non-releasing), no secrets, no code or config touched.

No blocking issues.

Reviewed the full diff (3 files, docs only): dci-troubleshooting.md, derived-variables.md, row-level-security.md. The two RLS statements are consistent between docs/derived-variables.md:123 and docs/row-level-security.md:44 (physical column only, rejected at submit), and the Show log section's explanation of `_executionTasks=true` matches how the adapter behaves elsewhere in these docs. No Conventional Commits concern (docs: is correct and non-releasing), no secrets, no code or config touched. No blocking issues.
hermes added 1 commit 2026-10-26 09:53:56 +00:00
VAR_LABEL is free text in any script and the quotes are escaped when the
statement is built, but it is a column label: control characters, line breaks and
over 256 characters are refused, the last of those because the engine would cut
the value down silently.
hermes left a comment
Author
Collaborator

Reviewed the delta since the previous review at the older head: the new "Show log" section in dci-troubleshooting.md and the label/RLS restrictions added to derived-variables.md and row-level-security.md. Checked each claim against the implementing code on the dc/dc 7.19 branch (info-modal/startupservice detection, service-url.ts _debug=131 and _executionTasks omission, the post-edit hook's VAR_LABEL and RLS checks, stagedata dropping derived values before the approval package).

No blocking issues.

Reviewed the delta since the previous review at the older head: the new "Show log" section in dci-troubleshooting.md and the label/RLS restrictions added to derived-variables.md and row-level-security.md. Checked each claim against the implementing code on the dc/dc 7.19 branch (info-modal/startupservice detection, service-url.ts `_debug=131` and `_executionTasks` omission, the post-edit hook's VAR_LABEL and RLS checks, stagedata dropping derived values before the approval package). No blocking issues.
hermes added 1 commit 2026-10-26 11:42:43 +00:00
browser_info and browser_url_vars were only described inside the troubleshooting
page, under Support Diagnostics. That is the right place to find them if you
already know they exist and are looking for a log line; it is not where anyone
looks when writing a hook, which is what they are mostly for.

The new Developer Guide page carries the whole subject: which services receive
the two tables, the column lists, the debug values per platform and the MPEINIT
log lines, reading them from a hook with the exist() guard, and the reminder that
they are client-supplied and so diagnostics rather than a security boundary.

Troubleshooting keeps three stub headings - browser_info, browser_url_vars,
reading-them-from-a-hook - pointing at the page, so the anchors that are already
published keep resolving, and the detail is not maintained twice.

Linked from the three places a hook author actually starts: the HOOK Scripts
section of the MPE_TABLES page, the pre-edit hook guide (where the editor's
inputs are listed), the two-rule-sets guide (post-edit hook), and the VA embed
page, where embed=va is exactly the kind of thing a hook wants to branch on.
hermes left a comment
Author
Collaborator

Reviewed the docs-only diff: browser-variable material moved out of dci-troubleshooting into developer-guide/browser-variables.md with the nav entry added, plus the Show log section and the derived-variable/RLS restrictions.

Scope note: the two behavioural claims - a 256-character VAR_LABEL limit and RLS rules naming a derived variable being rejected at submit - are asserted about the engine; they were not checked against dc/dc source in this pass, so they need confirming against the 7.19 implementation before the page ships.

No blocking issues.

Reviewed the docs-only diff: browser-variable material moved out of dci-troubleshooting into developer-guide/browser-variables.md with the nav entry added, plus the Show log section and the derived-variable/RLS restrictions. Scope note: the two behavioural claims - a 256-character VAR_LABEL limit and RLS rules naming a derived variable being rejected at submit - are asserted about the engine; they were not checked against dc/dc source in this pass, so they need confirming against the 7.19 implementation before the page ships. No blocking issues.
allan merged commit c29c955e1a into main 2026-10-26 11:53:53 +00:00
allan deleted branch docs/7.19-readiness 2026-10-26 11:53:53 +00:00
Sign in to join this conversation.
No Reviewers
No labels
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: dc/docs.datacontroller.io#23