SCAL-239528 Implement restricting navigation for blocked embed routes #344

shivam-kumar-ts · 2025-11-07T05:20:56Z

Implement restricting navigation for blocked embed routes

mnk-blr · 2025-11-07T05:21:06Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

gemini-code-assist · 2025-11-07T05:21:13Z

Summary of Changes

Hello @shivam-kumar-ts, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request implements a significant feature for embedded ThoughtSpot applications, enabling granular control over user navigation. It allows developers to define specific routes that users are permitted to access within an embed, enhancing security and user experience by preventing navigation to unintended areas. The change includes new configuration parameters and a dedicated enum for managing these route restrictions.

Highlights

Route Restriction for Embeds: Introduced the capability to restrict navigation within embedded ThoughtSpot applications to a predefined set of routes.
New Configuration Options: Added allowedRoutes (an array of Path enum values) and accessDeniedMessage (a string) to the BaseViewConfig interface, allowing developers to specify permitted routes and a custom message for denied access.
Path Enum Definition: Created a new Path enum to explicitly define various navigable routes within the embedded application, including a wildcard Path.All for unrestricted access.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request introduces a feature to restrict navigation for embedded routes. It adds allowedRoutes and accessDeniedMessage configurations to control access. The implementation looks correct, with corresponding changes in type definitions, the main embed class, and test files. I've found a few minor issues in the JSDoc comments and code formatting in src/types.ts and have provided suggestions to fix them. Overall, this is a good addition.

gemini-code-assist · 2025-11-07T05:22:35Z

src/types.ts

+    /**
+     * Array of routes that are allowed to be accessed in the embedded app.
+     * When specified, navigation will be restricted to only these routes.
+     * Use Path.All to allow all routes without restrictions.
+     * 
+     * Supported embed types: `AppEmbed`, `LiveboardEmbed`, `SageEmbed`, `SearchEmbed`, `SpotterAgentEmbed`, `SpotterEmbed`, `SearchBarEmbed`
+     * @example
+     *
+     *
+     * // Replace <EmbedComponent> with embed component name. For example, AppEmbed, SearchEmbed, or LiveboardEmbed
+     * const embed = new AppEmbed('#tsEmbed', {
+     *    ... // other embed view config
+     *    allowedRoutes: [Path.Home, Path.Search, Path.Liveboards],
+     *    accessDeniedMessage: 'You do not have access to this page'
+     * })
+     *      * 
+     *
+     * // Allow all routes
+     * const embed = new AppEmbed('#tsEmbed', {
+     *    allowedRoutes: [Path.All]
+     * })
+     *      */
+        allowedRoutes?: Path[];
+        /**
+         * Custom message to display when a user tries to access a route
+         * that is not in the allowedRoutes list.
+         * 
+         * Supported embed types: `AppEmbed`, `LiveboardEmbed`, `SageEmbed`, `SearchEmbed`, `SpotterAgentEmbed`, `SpotterEmbed`, `SearchBarEmbed`
+         * @default 'Access Denied'
+         * @example
+         *
+         * const embed = new AppEmbed('#tsEmbed', {
+         *    allowedRoutes: [Path.Home, Path.Liveboards],
+         *    accessDeniedMessage: 'You do not have permission to access this page. 
+         * Please contact your administrator.'
+         * })
+         *      */
+        accessDeniedMessage?: string;


The JSDoc comments for allowedRoutes and accessDeniedMessage have some formatting issues and an incorrect example. Additionally, the indentation for these new properties is inconsistent with the rest of the BaseViewConfig interface. Properties in this interface are indented with 4 spaces, but the new properties use 8 spaces.

There are some extra empty lines and stray asterisks (*) in the comment blocks which should be cleaned up.

The example for accessDeniedMessage contains a multi-line string literal which is invalid in JavaScript. It should be a single line string.

The indentation for allowedRoutes and accessDeniedMessage should be 4 spaces to match the existing properties in BaseViewConfig.

/** * Array of routes that are allowed to be accessed in the embedded app. * When specified, navigation will be restricted to only these routes. * Use Path.All to allow all routes without restrictions. * * Supported embed types: `AppEmbed`, `LiveboardEmbed`, `SageEmbed`, `SearchEmbed`, `SpotterAgentEmbed`, `SpotterEmbed`, `SearchBarEmbed` * @example * * // Replace <EmbedComponent> with embed component name. For example, AppEmbed, SearchEmbed, or LiveboardEmbed * const embed = new AppEmbed('#tsEmbed', { * ... // other embed view config * allowedRoutes: [Path.Home, Path.Search, Path.Liveboards], * accessDeniedMessage: 'You do not have access to this page' * }) * * // Allow all routes * const embed = new AppEmbed('#tsEmbed', { * allowedRoutes: [Path.All] * }) */ allowedRoutes?: Path[]; /** * Custom message to display when a user tries to access a route * that is not in the allowedRoutes list. * * Supported embed types: `AppEmbed`, `LiveboardEmbed`, `SageEmbed`, `SearchEmbed`, `SpotterAgentEmbed`, `SpotterEmbed`, `SearchBarEmbed` * @default 'Access Denied' * @example * * const embed = new AppEmbed('#tsEmbed', { * allowedRoutes: [Path.Home, Path.Liveboards], * accessDeniedMessage: 'You do not have permission to access this page. Please contact your administrator.' * }) */ accessDeniedMessage?: string;

gemini-code-assist · 2025-11-07T05:22:35Z

src/types.ts

+ *    allowedRoutes: [Path.Home, Path.Search, Path.Liveboards],
+ *    accessDeniedMessage: 'You do not have access to this page'
+ * })
+ *  * @version SDK: 1.45.0 | ThoughtSpot: *


There's a formatting issue in the JSDoc for the Path enum. The @version tag has an extra asterisk at the beginning of the line, which might affect how documentation is generated.

* @version SDK: 1.45.0 | ThoughtSpot: *

pkg-pr-new · 2025-11-07T05:23:07Z

Open in StackBlitz

npm i https://pkg.pr.new/thoughtspot/visual-embed-sdk/@thoughtspot/visual-embed-sdk@344

commit: dc83a6c

sandeep-kr-yadav · 2025-11-11T02:52:20Z

src/types.ts

+
+    // Pinboard/Liveboard
+    Pinboard = '/insights/pinboard/:pinboardId',
+    VizBoard = '/insights/pinboard/:pinboardId/:vizId',


We also have tabs keyword in the URL

yinstardev · 2025-11-11T10:53:52Z

src/embed/ts-embed.ts

                message: customActionsResult.errors,
            });
        }
+        const blockedAndAllowedRoutesResult = getBlockedAndAllowedRoutes( this.viewConfig?.routeBlocking, { embedComponentType: (this.viewConfig as any).embedComponentType || '', liveboardId: (this.viewConfig as any).liveboardId, vizId: (this.viewConfig as any).vizId, activeTabId: (this.viewConfig as any).activeTabId, pageId: (this.viewConfig as any).pageId, path: (this.viewConfig as any).path });


Can you simplify this - also if possible remove any insteances.

sastaachar · 2025-11-11T10:51:28Z

src/embed/ts-embed.ts

                message: customActionsResult.errors,
            });
        }
+        const blockedAndAllowedRoutesResult = getBlockedAndAllowedRoutes( this.viewConfig?.routeBlocking, { embedComponentType: (this.viewConfig as any).embedComponentType || '', liveboardId: (this.viewConfig as any).liveboardId, vizId: (this.viewConfig as any).vizId, activeTabId: (this.viewConfig as any).activeTabId, pageId: (this.viewConfig as any).pageId, path: (this.viewConfig as any).path });


what does this do ?? can you please refactor this

sastaachar · 2025-11-11T10:57:00Z

src/types.ts

+ * ```
+ * @version SDK: 1.45.0 | ThoughtSpot: 26.2.0.cl
+ */
+export enum NavigationPath {


clean up this, only put the most used pages here, that customer has access to in embed.

sastaachar · 2025-11-11T11:01:17Z

src/utils/allowed-or-blocked-routes.ts

+    const { embedComponentType, liveboardId, vizId, activeTabId, pageId, path } = config;
+
+    switch (embedComponentType) {
+        case 'LiveboardEmbed': {


is there no enum for this ?

sastaachar · 2025-11-11T11:03:23Z

src/utils/allowed-or-blocked-routes.ts

+    path?: string;
+}
+
+const EMBED_COMPONENT_GENERIC_PATHS: Record<string, string[]> = {


all this should be part of the embed component

yinstardev · 2025-11-11T11:04:24Z

src/utils/allowed-or-blocked-routes.ts

+/**
+ * Generate specific allowed routes based on the embed configuration
+ */
+export const generateAutoAllowedRoutes = (config: RouteGenerationConfig): string[] => {


Why is it called autoAllowed? can you confirm.

sastaachar · 2025-11-11T11:04:49Z

src/utils/allowed-or-blocked-routes.ts

+            const routes: string[] = [];
+
+            if (liveboardId) {
+                routes.push(`/embed/viz/${liveboardId}`);


this should be part of liveboard component

…x and update

…detection for blocked routes

…ve blocked route conflict detection

…outes

…ate route generation

…mbed configuration validation and processing

sonar-prod-ts · 2025-12-09T09:57:37Z

SonarQube Quality Gate

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
1.4% Duplication

shivam-kumar-ts requested a review from a team as a code owner November 7, 2025 05:20

gemini-code-assist bot reviewed Nov 7, 2025

View reviewed changes

shivam-kumar-ts force-pushed the SCAL-239528 branch 21 times, most recently from 3c6f49a to bd559cd Compare November 10, 2025 16:54

sandeep-kr-yadav reviewed Nov 11, 2025

View reviewed changes

yinstardev reviewed Nov 11, 2025

View reviewed changes

sastaachar reviewed Nov 11, 2025

View reviewed changes

yinstardev reviewed Nov 11, 2025

View reviewed changes

sastaachar reviewed Nov 11, 2025

View reviewed changes

shivam-kumar-ts force-pushed the SCAL-239528 branch 6 times, most recently from 4934fed to 3ca4890 Compare November 12, 2025 01:03

shivam-kumar-ts added 16 commits December 9, 2025 15:01

SCAL-239528 Implement restricting navigation for blocked embed routes

985409a

SCAL-239528 added exported types from sdk

1866d6c

SCAL-239528 added blockedRoutes also

b17b828

SCAL-239528 Refactor getBlockedAndAllowedRoutes to remove error suffi…

6e82f26

…x and update

SCAL-239528 Refactor Path enum to NavigationPath and app paths

db02871

SCAL-239528 added test for routes

54f0340

SCAL-239528 added embedComponentType in app

a5c0c53

SCAL-239528 implement auto-generation of allowed routes and conflict …

2ae76f3

…detection for blocked routes

SCAL-239528 add test and refactor hasConflictingBlockedRoute to impro…

8d72b9f

…ve blocked route conflict detection

SCAL-239528 updated the embed types to routeBlocking object

152cb18

SCAL-239528 Added EmbedAccessDeniedPage

a59bd31

SCAL-239528 refactor getBlockedAndAllowedRoutes to filter out empty r…

ae1a09e

…outes

SCAL-239528 Refactor getPageRoutes to defaultWhiteListedPaths and upd…

ae099c4

…ate route generation

SCAL-239528 Refactor route blocking and generation logic to improve e…

ddc5d47

…mbed configuration validation and processing

SCAL-239528 Update size limit for tsembed.es.js to 40 kB

60321f1

SCAL-239528 rebase the code

4509300

shivam-kumar-ts force-pushed the SCAL-239528 branch from 3ca4890 to 4509300 Compare December 9, 2025 09:44

shivam-kumar-ts added 2 commits December 9, 2025 15:16

SCAL-239528 recerted docgen

035769b

SCAL-239528 Enhance embed configuration validation with error codes

dc83a6c

SCAL-239528 Implement restricting navigation for blocked embed routes #344

Are you sure you want to change the base?

SCAL-239528 Implement restricting navigation for blocked embed routes #344

Uh oh!

Conversation

shivam-kumar-ts commented Nov 7, 2025

Uh oh!

mnk-blr commented Nov 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

gemini-code-assist bot commented Nov 7, 2025

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Nov 7, 2025

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Nov 7, 2025

Choose a reason for hiding this comment

Uh oh!

pkg-pr-new bot commented Nov 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yinstardev Nov 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sonar-prod-ts bot commented Dec 9, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

mnk-blr commented Nov 7, 2025 •

edited

Loading

pkg-pr-new bot commented Nov 7, 2025 •

edited

Loading

yinstardev Nov 11, 2025 •

edited

Loading