Out of date app and Bots

[1minManager]

I have a client which we recently setup a bot to work like a virtual column.  Whereby saving the record updates firgures on both the parent and grand-parent records.  Tested it and it works fine both adding, updating and deleting records.  Bot is set to trigger on "all changes".

First day of the client using this new version, the parent and grand-parent records are not being updated.  My hunch is the user has an out of date app.  But given the Bot works in the backend, surely this should still see the change and run?

[1minManager · Accepted solution]

I've managed to solve it myself, but it's not logical to me at least.  So I have a formula that controls "Are updates allowed?" in the parent and grandparent tables.  This bot fails to run is because certain users do not have write permissions.   Which I get.  But why then in the bot do I have the option of "Bypass Security Filters?".  Which would allow a user access to rows they are specifically banned from seeing?

[Steve]

Are updates allowed? and Bypass security filters? have nothing to do with each other. I'm confused by your expectation. Can you elaborate?

[1minManager]

To simplify a little...

I presumed that because a bot running on a schedule doesn't run as a user, the same would be the case for a bot triggered by a change/add/delete.  But it isn't.  The later runs as the user that triggered the bot.

I also presumed that, given the above, turning on Bypass security filters?  would allow the bot to change columns where the user had no edit permissions.  But this isn't the case either.

The issue these 2 cause is I have columns where a standard user needs to be able to trigger a bot to update some formula, and admin users with higher permissions can see these figures.  But I don't want either of them to be able to edit them directly.  The best I've come up with so far is that these figures are hidden for standard users and only visible where CONTEXT("ViewType")<>"Form"

[Steve]

---

@1minManager wrote:

I presumed that because a bot running on a schedule doesn't run as a user,

---

Scheduled bots run as the owner of the app.

---

@1minManager wrote:

The best I've come up with so far is that these figures are hidden for standard users and only visible where CONTEXT("ViewType")<>"Form"

---

To make sure you understand, hiding a column with Show? isn't truly secure. The data is still sent to and stored on the device, and is accessible to a technically-savvy user.