validus | A dead simple Python string validation library | Validation library

The code doesn't include a hideSheet() method which is required to hide the sheets.

The if expressions are assigning a value to wardSheetNames[i][1] instead of comparing it to the corresponding value

• = assign operator
• == abstract equality comparator
• === strict equality comparator

Please bear in mind that the sheets are hidden / shown for any user no only the active user.

Related

• Which equals operator (== vs ===) should be used in JavaScript comparisons?
• How does the single equal sign work in the if statement in javascript
• Hiding worksheets from specific users inside a spreadsheet

I think it'd make more sense to do this in the caller. Stick with your original code except without the invalid check, and instead of calling advance, do:

Is there any way to make this group available without granting access? Or a different approach to providing an AD group member list?

I am afraid there is no such way to make this group available without granting access.

According to the document Add a rule to a work item type, following rules specify restrictions on specifying or changing the value of a field:

We could not set rule to grant access to that group.

Besides, just like you test, the group is granted access by membership in a DevOps group, could not granted access by our custom group.

Because every APIcall in your function updates the state causing a re-render which calls your API again and again.

Put your API call in the useEffect

As soon as you share a sheet you should assume that anyone can see the data in it. Even if someone shouldn't be able to see the internal tab, they can always e.g. make a copy of the sheet and thus get to the data.

You could try creating a separate sheet and using =IMPORTRANGE() to refer to the original one. But know that once you allow the connection between the two sheets, anyone with access to the second one might be able to access anything in the first one. Maybe get around that using three sheets:

1. Internal + External - your current sheet

2. A sheet-in-the-middle that only you can access. It has a single tab Internal that uses =IMPORTRANGE() to access data from 1)

3. The External sheet for clients. Linked to 2) through =IMPORTRANGE()

This way 3) only has access to the data in 2) which in turn only includes a link to 1).

I do not promise that this will make the data safe from those who shouldn't see it. But it will at least be safer.

Mutating the validUser object as Estus Flask pointed out was causing the error. Setting the validUser.email property back to it's original valid email string after the 1st test fixed the problem. validUser being assigned in beforeEach also works.

As the comments already point out, one should use an appropriate function like password_hash(), and store the hashes in a field of type varchar(255):

The plugin must take the settings and instantiate its objects at boot time. At runtime, it does not read the settings again, so it is useless to override them.

As you did, the proper way to test this feature is to have a sepparate settings module for testing and put the plugin config there.

I would suggest changing your auth flow as follows (also see thread and thread):

1. The client tries to call the protected route /secret with an expired auth token
2. The server throws a TokenExpiredError to the client
3. The client now requests a new access token at the auth server with its valid refresh token
4. The auth server checks the refresh token and issues a new access token to the client
5. The client retries /secret with its new access token

The whole purpose of a refresh token is that it never gets shared with the resource server and is not send around with every request; this increases security. If the resource server makes the refresh request itself, you defeat this purpose. If the resource server and the auth server are the same, you still benefit from not sending the long-lived (➡ higher risk) tokens around so much, i.e., less chance for them to be compromised through a person-in-the-middle attack.