Repository navigation
Embed control in production: authorization, upgrades, sessions; fix the service-level authorization example - #379
Merged
Conversation
…e-level authorization example fiori.md gets a "Running it in production" section: who may start which class (node vs. class, startup parameters are user input), what an upgrade does to embedded sections and how to test or freeze it, and what several containers on one page cost (stateless drafts, requests per page, the monitor, no stateful sessions in a section). authorization.md: the service-level example refused on get_form_field( `app_start` ), which is only on the URL of the first page request - POSTs carry the class in the body, later roundtrips and nav_app_call( ) carry none, so the handler broke every roundtrip or checked nothing. The handler now gates the node; which app may run is the app's, and startup parameters get a section of their own. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T3yR8gBhBYzXdEND7gLSqx
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
The questions a customer's security and architecture teams ask before an embedded abap2UI5 section goes live, which came up as a comment on the SAP Community post about the embed control. The answers now live in the documentation, not just in a comment thread.
advanced/fiori.md: new section "Running it in production"z2ui5_if_app), not the user, and drafts are bound to their owner. The ICF node (S_ICF, a dedicated node via the control'sendpoint) decides who reaches abap2UI5 at all. AnAUTHORITY-CHECKinmain( )decides who may run the app. Startup parameters are user input too, so the app checks the object (a CDS view with access control, EML authorization control), not only the app.z2ui5:Container, OPA5/wdi5). The bundle's ETag means browser and server never run different versions. To freeze the embedded sections, use a second, renamed installation behindendpoint.set_session_stateful( )in an embedded section.configuration/authorization.md: fixThe service-level example refused requests based on
get_form_field( `app_start` ). That parameter is only on the URL of the first page request:nav_app_call( )switches apps without the client naming one.So that handler either broke every roundtrip or checked nothing. The handler now only guards the node (with a 403), a warning box explains the pitfall, App-Level is the recommended per-app check, and there is a new section, "Startup Parameters Are User Input".
configuration/productive_usage.mdOne paragraph that points to the upgrade guidance for embedded apps.
Checks
These ran locally and passed:
test,docs:build,check:examples,check:conventions,check:line-length,check:vocabulary,check:playgroundandcheck:api-names. The rest of the gates were not run locally; CI covers them.Generated by Claude Code