From 02686b92785a1987088f11d27fccb2888ee0fde8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?SAL=C4=B0H=20=C3=96ZKARA?= Date: Mon, 25 May 2026 13:39:42 +0300 Subject: [PATCH] Update low-code scripting docs --- docs/en/low-code/custom-endpoints.md | 4 ++-- docs/en/low-code/interceptors.md | 8 +++++++- docs/en/low-code/scripting-api.md | 4 ++-- 3 files changed, 11 insertions(+), 5 deletions(-) diff --git a/docs/en/low-code/custom-endpoints.md b/docs/en/low-code/custom-endpoints.md index 31bc72ff30..d9f3ad0920 100644 --- a/docs/en/low-code/custom-endpoints.md +++ b/docs/en/low-code/custom-endpoints.md @@ -43,7 +43,7 @@ Custom endpoints are defined in `model.json` or through the Low-Code Designer. E | `requireAuthentication` | bool | `true` | Whether the caller must be authenticated | | `requiredPermissions` | string[] | null | Permission names required to call the endpoint | -`requiredPermissions` is checked only when `requireAuthentication` is true. Keep endpoints authenticated by default and use `requireAuthentication: false` only for intentionally public APIs. +Permission checks require an authorized user even when `requireAuthentication` is set to `false`. Keep endpoints authenticated by default and use `requireAuthentication: false` only for intentionally public APIs without `requiredPermissions`. ## Route and Request Data @@ -194,7 +194,7 @@ Default blocked headers also include hop-by-hop headers such as `Connection`, `T ## Security Notes * Prefer authenticated endpoints with explicit `requiredPermissions`. -* Treat public endpoints as public API surface. +* Treat endpoints with `requireAuthentication: false` and no `requiredPermissions` as public API surface. * Keep endpoint scripts small and focused. * Validate route, query, and body input before using it. * Use `take()` for list queries. diff --git a/docs/en/low-code/interceptors.md b/docs/en/low-code/interceptors.md index 048e8c6168..97c401e2bc 100644 --- a/docs/en/low-code/interceptors.md +++ b/docs/en/low-code/interceptors.md @@ -142,7 +142,13 @@ Inside interceptor scripts, you have access to: |--------|-------------| | `isAvailable` | Whether the email sender is configured and available | | `sendAsync(to, subject, body)` | Send a plain-text email | +| `sendAsync(from, to, subject, body)` | Send a plain-text email with an explicit sender | | `sendHtmlAsync(to, subject, htmlBody)` | Send an HTML email | +| `sendHtmlAsync(from, to, subject, htmlBody)` | Send an HTML email with an explicit sender | +| `queueAsync(to, subject, body)` | Queue a plain-text email | +| `queueAsync(from, to, subject, body)` | Queue a plain-text email with an explicit sender | +| `queueHtmlAsync(to, subject, htmlBody)` | Queue an HTML email | +| `queueHtmlAsync(from, to, subject, htmlBody)` | Queue an HTML email with an explicit sender | ### Logging @@ -158,7 +164,7 @@ Inside interceptor scripts, you have access to: Full access to the [Scripting API](scripting-api.md) for querying and mutating data. -Interceptors can also use common scripting services such as `user`, `tenant`, `auth`, `settings`, `features`, `events`, `jobs`, `files`, `images`, and `attachments` when they are enabled by the scripting capability profile. +Interceptors can also use common scripting services such as `user`, `tenant`, `auth`, `settings`, `features`, `config`, `http`, `events`, `jobs`, `blob`, `encryption`, `textTemplating`, `files`, `images`, and `attachments` when they are enabled by the scripting capability profile. ### `globalError` diff --git a/docs/en/low-code/scripting-api.md b/docs/en/low-code/scripting-api.md index 422cbeb6c1..c50830f1d3 100644 --- a/docs/en/low-code/scripting-api.md +++ b/docs/en/low-code/scripting-api.md @@ -217,7 +217,7 @@ All aggregations execute as SQL statements: | `min(x => x.Property)` | `SELECT MIN(...)` | `Promise` | | `max(x => x.Property)` | `SELECT MAX(...)` | `Promise` | | `distinct(x => x.Property)` | `SELECT DISTINCT ...` | `Promise` | -| `groupBy(x => x.Property)` | `GROUP BY ...` | `Promise` | +| `groupBy(x => x.Property)` | `GROUP BY ...` | `QueryBuilder` | ```javascript var productQuery = await db.query('Product'); @@ -275,7 +275,7 @@ var grouped = await productQuery | Limit | Default | Description | |-------|---------|-------------| -| `MaxGroupCount` | No limit | Maximum groups | +| `MaxGroupCount` | 500 | Maximum groups; set to `null` to disable this limit | ## Math Functions