permissions to open files in macros

Get help using and writing Nisus Writer Pro macros.
js
Posts: 229
Joined: 2007-04-12 14:59:36

permissions to open files in macros

Post by js » 2015-03-17 09:54:34

Great and welcome update, thank you.
Unfortunately a number of my macros don't work any more. The worst problem is those that open files within the macros.
It's the permissions. But how to change permission so that Nisus can get access?

User avatar
martin
Official Nisus Person
Posts: 4357
Joined: 2002-07-11 17:14:10
Location: San Diego, CA
Contact:

Re: permissions to open files in macros

Post by martin » 2015-03-17 10:25:48

Almost certainly the problem is due to the Mac OS X app sandbox, which NWP 2.1 now adopts.

As you may know, by default the sandbox prevents an app from accessing any files on your Mac, unless you (the user) first interact with those files. This lets a user be absolutely sure that an app does not access any data without your permission. This is ultimately a security benefit.

If you have written any macros that need access to files, you'll have to establish permission. There are a few ways to do that:
1. Use a command that prompt the user to choose the file to read/write, eg: "Choose File", "Choose Folder", "Choose Save File As", etc.
2. Use a command that asserts access to some desired file, eg: "File.requireAccessAtPath". The first time the path is encountered, the macro will prompt the user to select the file. Afterwards access is remembered for subsequent macro runs.

Please see the Macro Language Reference for more, specifically the heading "Sandbox Access" under "Files". Please let me know if you have any questions.

js
Posts: 229
Joined: 2007-04-12 14:59:36

Re: permissions to open files in macros

Post by js » 2015-03-17 12:00:12

Using Nisus I rely on about 400 macros.
About half of them uses the open file command. If I understood you well your were telling me to do this:
• If one of those 50 percent of my macros does not work, open it. Manually copy the line open „path“ with the command File.requireAccessAtPath in front of it.
• Save and rerun the macro. Now it will ask you to manually find and select the file whose location is already written (meanwhile 2 times) in the macro itself.
• Discover that this does not work and find out by try and error that it is a locked file, i.e. a file which cannot be modified but opened by about any third party software on the market.
• Go back to the finder, unlock the file. Try again and don’t forget afterwards to manually relock it
• Discover that the snappy opening of files with the help of Nisus macros on which I have relied in the past is gone for good (gone in this 64-bit upgrade!) and replaced by seconds long waiting (felt temperature many seconds long). Obviously this delay is caused by checking the whole procedures described above.

I wonder what I should do. Go for my 200 macros, manually, one by one? It seems that we have entered a new era here: Before, Nisus software worked for me. Now it is me who has to work to get the Nisus software working, even if less well than it did before.
If I did not understand what you indicated me and there is a better way to solve the problem, please point it out to me. If not I have only one more question: How do I reinstall the last version? I think Nisus for many of us: that is the macros. I think you should tend them carefully.

User avatar
martin
Official Nisus Person
Posts: 4357
Joined: 2002-07-11 17:14:10
Location: San Diego, CA
Contact:

Re: permissions to open files in macros

Post by martin » 2015-03-17 13:01:58

You correctly understand the idea. NWP 2.1 macros require explicit access to any files you want to process. For example:

Code: Select all

$path = "~/Documents/file.txt"
File.requireAccessAtPath($path)
$data = File.readDataFromPath($path)
It sounds like using this approach is onerous because so many of your files are locked.

Are all the files you want to process located in some common parent folder? If so, you could use an approach like this across all your macros:

Macro A:

Code: Select all

$commonFolder = "~/Documents/NisusFiles"
$path = "$commonFolder/fileA.txt"
File.requireAccessAtPath($commonFolder)
$data = File.readDataFromPath($path)
Macro B:

Code: Select all

$commonFolder = "~/Documents/NisusFiles"
$path = "$commonFolder/subfolder/fileB.txt"
File.requireAccessAtPath($commonFolder)
$data = File.readDataFromPath($path)
As that example implies, all your macros are granted the same access to files; if you grant access for one macro, your other macros will also have access. Also as the example shows, granting access to a folder gives macros access to all nested files and subfolders. You could just make the common folder be your home folder, granting macros access to all your user files in one swoop, if you so desire.

I hope that helps.
If not I have only one more question: How do I reinstall the last version?
You can download older versions of Nisus Writer Pro from our version archive. However, when reverting from Pro 2.1 to Pro 2.0.x you may find that some settings and preferences are not maintained. That's because support files are moved into the sandbox when you first run Pro 2.1, so that Pro 2.0.x will no longer detect them. If you want to revert those settings too, please see this FAQ that provides a perl script that moves all the data back outside the sandbox.

js
Posts: 229
Joined: 2007-04-12 14:59:36

Re: permissions to open files in macros

Post by js » 2015-03-17 16:07:53

Thanks for that detailed answer.

User avatar
phspaelti
Posts: 943
Joined: 2007-02-07 00:58:12
Location: Japan

Re: permissions to open files in macros

Post by phspaelti » 2015-03-18 22:47:10

I am going to have to confess that this is still not detailed enough for me.
Let's assume i have 'common/folder' which has learned access (as confirmed by the Macro 'Manage Macro File Access'), and contains the files 'File A' and 'File B'.
If I try the following, it quietly (i.e. no dialog) opens 'File A'.

Code: Select all

File.requireAccessAtPath 'common/folder'
Open 'common/folder/File A'
So far so good. But once that has happened the following works as well (!?)

Code: Select all

Open 'common/folder/File A'
I.e., that too will open 'File A' without complaint.
Meanwhile if I try the following:

Code: Select all

Open 'common/folder/File B'
I get the usual error message. This seems to be because I hadn't opened 'File B' with NWP 2.1 yet. If I open 'File B' (once and close it), or use the requireAccess then the opening proceeds smoothly.
And then I create a brand new file 'File X' and save it in 'other/folder', and close it. Then…

Code: Select all

Open 'other/folder/File X'
works without complaint, even though 'other/folder' is not in my list of learned access (and neither is 'File X'). So is opening a file once in NWP 2.1 enough to give such access to macros? For how long does such access persist? What's supposed to be the difference between that and 'learned access'.

So to summarize, giving learned access to a common folder may do something for opening your files in macros or it might not. Either way it seems you are going to have to open all the files by hand once, or liberally sprinkle your macros with requireAccess commands to get things to work.
philip

User avatar
phspaelti
Posts: 943
Joined: 2007-02-07 00:58:12
Location: Japan

Re: permissions to open files in macros

Post by phspaelti » 2015-03-18 23:14:12

Just to clarify: my real question is, why can't the Open command just do the whole requireAccess thing on its own? Why is it necessary to explicitly put this command before each Open statement? Instead of throwing an error, the Open could just redirect the user to locate the file, if necessary. As far as the behaviour for the user is concerned everything would be the same as it is now.
philip

js
Posts: 229
Joined: 2007-04-12 14:59:36

Re: permissions to open files in macros

Post by js » 2015-03-19 09:27:58

Martin,

I though I had understood, but it looks as if I didn‘t. To put it short: After following your instructions the Menu „Manage Macro file access“ indicates that Nisus „has stored access to the following list“ followed by „/Users/HOME/Documents“. Does this mean that I, the owner of my software, have allowed Nisus to access all files in my Documents folder under all circumstances? Or does it mean something else, which you will kindly explain me. So that I know why sometimes it seems to work and sometimes I am asked to show Nisus the file which it “stored” god knows where. Is it access yes or is it access no? And why can’t the user instruct Nisus directly though the „Manage Macro file access“, instead of learning sandbox grammar.

Now to a related problem, which is even worse. It’s the embedded links. Nisus 2.1 pretends not knowing my earlier link and asks me 1) to put the cursor on the link, 2) select Edit link, and 3) manually, by means of the finder dialogue, search that very file right under my nose, to find the path which is already embedded in the link, 4) to click to confirm that I still want what that link which Nisus already knows I want. Amen.
I don‘t know the total number of such links in my documents but I think to count them by hundreds is not the right unit. Why can Nisus not ask the user: Do you still want that link? If I click „yes“ it was me, the owner of the document who clicked yes, with my index, a part of my physical body. Where will these so-called security concerns stop if not here. Using sandboxed Nisus, so far, looks to me like asking people to put a gas mask to walk the dog, because one day a bomb could explode during the stroll.

User avatar
martin
Official Nisus Person
Posts: 4357
Joined: 2002-07-11 17:14:10
Location: San Diego, CA
Contact:

Re: permissions to open files in macros

Post by martin » 2015-03-19 20:39:31

phspaelti wrote:I am going to have to confess that this is still not detailed enough for me.
Before I get into your specific examples and the details, I'd like to just state that using File.requireAccessAtPath in a macro ensures that the given path is accessible for at least the duration of the running macro. It does not necessarily mean that access is revoked immediately at the end of the macro. Access may persist for other reasons.
Let's assume i have 'common/folder' which has learned access (as confirmed by the Macro 'Manage Macro File Access'), and contains the files 'File A' and 'File B'.
If I try the following, it quietly (i.e. no dialog) opens 'File A'.

Code: Select all

File.requireAccessAtPath 'common/folder'
Open 'common/folder/File A'
So far so good. But once that has happened the following works as well (!?)

Code: Select all

Open 'common/folder/File A'
I.e., that too will open 'File A' without complaint.
...
And then I create a brand new file 'File X' and save it in 'other/folder', and close it. Then…

Code: Select all

Open 'other/folder/File X'
works without complaint, even though 'other/folder' is not in my list of learned access (and neither is 'File X'). So is opening a file once in NWP 2.1 enough to give such access to macros? For how long does such access persist? What's supposed to be the difference between that and 'learned access'.
Opening a file in NWP is indeed enough to give macros access to the file for an undetermined amount of time. I can't place bounds on the duration because it's handled transparently by OSX as part of the sandboxing machinery. I suspect perhaps it's keyed into the Open Recent file list, but I haven't done any experiments to test that theory. I would not rely on it as a solution for any macros.

So yes, there is a difference between the implied permissions imbued by opening documents and explicit macro commands like File.requireAccessAtPath. The latter is controlled by Nisus code, while the former happens as part of opaque OSX magic.
So to summarize, giving learned access to a common folder may do something for opening your files in macros or it might not.
That's not true. If a macro explicitly includes commands to learn/require access to a file or folder, the macro will have access to those files.

User avatar
martin
Official Nisus Person
Posts: 4357
Joined: 2002-07-11 17:14:10
Location: San Diego, CA
Contact:

Re: permissions to open files in macros

Post by martin » 2015-03-19 20:42:03

phspaelti wrote:Just to clarify: my real question is, why can't the Open command just do the whole requireAccess thing on its own? Why is it necessary to explicitly put this command before each Open statement? Instead of throwing an error, the Open could just redirect the user to locate the file, if necessary. As far as the behaviour for the user is concerned everything would be the same as it is now.
That's a fair point, and indeed it would probably be most user-friendly if all the file access commands handled the operation transparently. That way, as you said, macros would not have to be necessarily rewritten.

However, there's still the need to have commands like File.requireAccessAtPath because it allows more direct control of exactly what permissions are being established and when. As an example we can look to the predicament in this thread: many macros need access to many locked data files. If every macro prompted for access, that could be quite annoying. It's easier to add something like File.requireAccessAtPath("~/MyNisusFiles/") at the top of every relevant macro.

User avatar
martin
Official Nisus Person
Posts: 4357
Joined: 2002-07-11 17:14:10
Location: San Diego, CA
Contact:

Re: permissions to open files in macros

Post by martin » 2015-03-19 20:52:25

js wrote:To put it short: After following your instructions the Menu „Manage Macro file access“ indicates that Nisus „has stored access to the following list“ followed by „/Users/HOME/Documents“. Does this mean that I, the owner of my software, have allowed Nisus to access all files in my Documents folder under all circumstances?
In terms of the strict security implications, you are correct that it means NWP technically has access to all files in your Documents folder, in all circumstances. Whenever you select a file or folder in a standard OSX file manipulation dialog (and confirm the choice), you are giving the sandboxed application permission to capture a security authorization for that selected file/folder. That authorization persists access to the target for as long as the application desires.

However, if you trust Nisus Software, I can say that any access you grant to NWP using the File macro commands is only intended to be used during macro execution. We do not intentionally use the captured security authorization in any other circumstances.
So that I know why sometimes it seems to work and sometimes I am asked to show Nisus the file which it “stored” god knows where. Is it access yes or is it access no?
I'm not sure I understand what you're asking exactly, but NWP stores these security authorizations in a file called ".sandboxFileAccess.plist" in your Macros folder. However, it's easier to use the macro "Manage Macro File Access".
And why can’t the user instruct Nisus directly though the „Manage Macro file access“, instead of learning sandbox grammar.
That's another fair point, and is something we should consider. Thanks for the idea.

User avatar
martin
Official Nisus Person
Posts: 4357
Joined: 2002-07-11 17:14:10
Location: San Diego, CA
Contact:

Re: permissions to open files in macros

Post by martin » 2015-03-19 20:58:37

js wrote:Nisus 2.1 pretends not knowing my earlier link and asks me 1) to put the cursor on the link, 2) select Edit link, and 3) manually, by means of the finder dialogue, search that very file right under my nose, to find the path which is already embedded in the link, 4) to click to confirm that I still want what that link which Nisus already knows I want. Amen.
I don‘t know the total number of such links in my documents but I think to count them by hundreds is not the right unit. Why can Nisus not ask the user: Do you still want that link?
This is indeed a frustrating issue, and an oversight that NWP 2.1 doesn't do a better job at assisting you in updating these links for sandboxing. I'm sorry for that. I can assure you that the next version will improve the situation.

js
Posts: 229
Joined: 2007-04-12 14:59:36

My Nisus mess is quite complete now

Post by js » 2015-03-20 08:55:55

My Nisus mess is quite complete now. The individual steps were these:

1. Discovered that what Manage Macro File Access says about File Access to me as a user is completely irrelevant. The only means to be sure to NOT be constantly annoyed by inaccessible files is to add to each and every macro that has an “open” command those 2 supplementary lines that grant access for all files in the doc folder. I do that for the most important few dozens.
2. Discovered that the sand box disaster is continuing: Not only all open commands don’t work any more, not only the hundreds of links in the documents cant find there way from one nisus doc to another. But another macro very important to me (earlier created by Kino) dos not work any more. It’s purpose was to look up in certain folders wether a selected word appears in file names within that folder. Bad luck. Sandbox Nisus declares bluntly that those files do not exist even if the finder says the contrary.
3. So that’s it for me. The new version makes years of work inaccessible. I must return to the last version for grown-ups (referring to children secure playing in the sandbox). I use the perl macro.
4. This works OK. If you think that 2.07 is OK. In practice it meant for me, that every day I had to do some force quites to make it work. But at least I did work, with all my macros links and everything. Of course all macros I have modified to grant acces to their open commands have to be manually reprocessed, because 2.07 does not understand that.
5. Unfortunately, with 2 Nisus applications on the computer, after opening and closing 2.07, I opened inadvertently 2.1. No problem, I thought, the macros etc. have been moved to the old place. But no. On reopening 2.07 I can’t find them anymore. Where are my macros?

User avatar
martin
Official Nisus Person
Posts: 4357
Joined: 2002-07-11 17:14:10
Location: San Diego, CA
Contact:

Re: My Nisus mess is quite complete now

Post by martin » 2015-03-20 14:48:12

js wrote:Unfortunately, with 2 Nisus applications on the computer, after opening and closing 2.07, I opened inadvertently 2.1. No problem, I thought, the macros etc. have been moved to the old place. But no. On reopening 2.07 I can’t find them anymore. Where are my macros?
When NWP 2.1 is first launched, support files like macros are migrated inside NWP's sandbox container. You should check the location:

~/Library/Containers/com.nisus.NisusWriter/Data/Library/Application Support/Nisus Writer Pro/

You might also find your Macros folder in your Document Manager folder.

User avatar
martin
Official Nisus Person
Posts: 4357
Joined: 2002-07-11 17:14:10
Location: San Diego, CA
Contact:

Re: permissions to open files in macros

Post by martin » 2015-03-24 22:38:26

We've improved the situation with sandbox file access and macros for the just released public beta of Pro 2.1.1. In addition to the earlier techniques that work under Pro 2.1, like inserting explicit File.requireAccessAtPath in the affected macros, you can now permanently grant all your macros automatic access to any number of files and folders. Once access is granted, it is automatically restored for any subsequent macro execution, without any code changes to your macros. You can do this yourself in Pro 2.1.1 using updated File commands, or the updated macro Macro > Application > Manage Macro File Access. Please let me know if you have any questions.

You can download the Pro 2.1.1 beta here. The beta should be relatively stable, since the number of changes is small and focussed, but all the usual warnings about running beta software apply. We expect to have a proper release soon enough.

Post Reply