@cplace/test-mcp-server 1.0.0 → 1.1.0

package/dist/widget-specifications/_research_from_ga_products/cf-platform-iframe/research.md

@@ -0,0 +1,358 @@
+# Widget Research: cf.platform.iframe
+
+## Widget Overview
+
+**Widget ID:** `cf.platform.iframe`
+**Widget Name:** Inline Frame
+**Repository:** main
+**Definition Class:** `cf.cplace.platform/src/main/java/cf/cplace/platform/frontend/widgets/IframeWidgetDefinition.java:38`
+
+## Description
+
+The Inline Frame widget embeds external web content directly into a cplace page using an HTML iframe. It allows users to display content from any website or web application within the cplace interface using a static URL.
+
+## Purpose
+
+This widget provides a simple way to embed external web content into cplace pages. It acts as a window to other websites or web applications, allowing users to view and interact with external content without leaving the cplace environment. The widget handles security validation and URL normalization to ensure safe embedding of external resources.
+
+## Core Functionality
+
+### Static URL Embedding
+
+The widget embeds content from a **static URL** specified in the widget configuration:
+
+- **URL Source:** A fixed URL defined during widget configuration
+- **URL Validation:** Automatic validation and normalization of the provided URL
+- **Security Checks:** Prevention of JavaScript and data URLs for security
+- **Relative URL Support:** Automatic conversion of relative URLs to absolute URLs based on the tenant's external URL
+
+**Key characteristics:**
+- The URL is fixed at configuration time and doesn't change based on page content
+- For dynamic URLs based on page attributes, use the Dynamic Inline Frame widget instead
+
+### URL Validation and Security
+
+The widget implements several security measures through `validateIframeSrc()` (IframeWidgetDefinition.java:147-162):
+
+1. **Relative URL Conversion:** URLs starting with `/` are automatically converted to absolute URLs using the tenant's external URL
+2. **URL Normalization:** URLs are normalized using `RichStringUtilities.normalizeUrlAttributeWithoutEscaping()`
+3. **JavaScript URLs Blocked:** Patterns like `javascript:alert('xss')` are rejected to prevent XSS attacks
+4. **Data URLs Blocked:** Data URIs (e.g., `data:text/html,...`) are not allowed for security reasons
+5. **Tenant URL Validation:** The URL must pass the tenant's URL validator to ensure it meets tenant-specific security policies
+
+If validation fails, the widget displays an error message: "The source URL of the inline frame is invalid."
+
+### Display Characteristics
+
+- **No Padding:** The iframe is rendered without padding (`isNoPadding() = true`) to maximize the visible area
+- **Configurable Height:** Widget height can be set through configuration (default: 600 pixels)
+- **Widget Title:** Supports localized titles displayed above the iframe
+- **Standard Widget Frame:** Uses the standard cplace widget frame for consistent UI
+
+## Configuration Options
+
+Based on the widget type definition in `WidgetTypes.IFRAME` (WidgetTypes.java:648-681):
+
+### Main Configuration Attributes
+
+1. **Source (URL)** (`cf.cplace.iFrame.sourceUrl`)
+   - Type: String (required)
+   - Purpose: The URL of the web content to embed
+   - Validation: Must be a valid URL, cannot be JavaScript or data URLs
+   - Examples:
+     - `https://docs.cplace.io/` - External documentation
+     - `/static/custom-dashboard/index.html` - Relative URL to cplace-hosted content
+     - `https://maps.google.com/maps?q=Munich&output=embed` - Google Maps embed
+
+2. **Title** (`cf.cplace.iFrame.localizedTitle`)
+   - Type: Localized String (required)
+   - Purpose: Sets the widget title displayed to users
+   - Supports: Multiple languages through localization
+
+3. **Height** (`cf.cplace.iFrame.height`)
+   - Type: Number (required)
+   - Purpose: Sets the fixed height of the iframe in pixels
+   - Default: 600 pixels
+
+### Deprecated Configuration
+
+- **Widget Title (Legacy)** (`cf.cplace.iFrame.widgetTitle`)
+  - Type: String (deprecated)
+  - Note: Kept for migration purposes only
+  - Migration: Automatically migrated to localized title through `migrateWidgetConfiguration()` (IframeWidgetDefinition.java:185-187)
+
+## Use Cases
+
+### 1. External Documentation Integration
+Display external documentation or knowledge base articles:
+- **URL:** `https://docs.company.com/user-guide/index.html`
+- **Scenario:** Embed user manuals, help documentation, or tutorials directly in cplace pages
+- **Benefit:** Users can access documentation without leaving the cplace interface
+
+### 2. External Dashboard Embedding
+Integrate dashboards from BI tools or monitoring systems:
+- **URL:** `https://analytics.company.com/dashboard/sales-overview`
+- **Scenario:** Display real-time analytics, reports, or metrics from external systems
+- **Benefit:** Consolidated view of data from multiple systems in one place
+
+### 3. Third-Party Tool Integration
+Embed external web applications:
+- **URL:** `https://jira.company.com/browse/PROJECT-123`
+- **Scenario:** Display Jira issues, Confluence pages, or other third-party tools
+- **Benefit:** Seamless integration with existing tools in the organization's ecosystem
+
+### 4. Static Map Display
+Show location-based content from mapping services:
+- **URL:** `https://www.openstreetmap.org/export/embed.html?bbox=...`
+- **Scenario:** Display maps of office locations, project sites, or geographic data
+- **Benefit:** Visual representation of location information
+
+### 5. Custom Internal Applications
+Embed custom web applications hosted within the organization:
+- **URL:** `https://internal-tools.company.com/resource-planner`
+- **Scenario:** Integrate specialized internal tools or custom web applications
+- **Benefit:** Unified interface for accessing various organizational tools
+
+### 6. Relative URL Content
+Embed static content hosted within the cplace instance:
+- **URL:** `/static/custom-widgets/visualization.html`
+- **Scenario:** Display custom HTML/JavaScript visualizations or tools served from cplace
+- **Benefit:** Self-contained custom content without external dependencies
+
+## Relationship to Other Widgets
+
+### Dynamic Inline Frame Widget (`cf.cplace.platform.dynamicIframe`)
+
+The Inline Frame widget is the simpler, static counterpart to the Dynamic Inline Frame widget:
+
+**Inline Frame Widget (this widget):**
+- Uses a **static URL** defined in widget configuration
+- URL never changes once configured
+- Simpler to configure - just enter a URL
+- Use when the embedded content is the same for all pages
+
+**Dynamic Inline Frame Widget:**
+- Uses a **dynamic URL pattern** with attribute placeholders
+- URL changes based on page attribute values at runtime
+- More complex configuration - requires understanding attribute patterns
+- Use when the embedded content should vary based on page data
+
+**Comparison Example:**
+- **Static (Inline Frame):** Always show `https://docs.cplace.io/platform/widgets/` on every page
+- **Dynamic (Dynamic Inline Frame):** Show `https://docs.cplace.io/<productId>/` where `productId` comes from the current page
+
+**When to use each:**
+- Use **Inline Frame** for:
+  - Company-wide documentation or resources
+  - General-purpose dashboards or tools
+  - Fixed external content that doesn't depend on page context
+
+- Use **Dynamic Inline Frame** for:
+  - Context-specific documentation based on page attributes
+  - Dashboards filtered by page data
+  - External tools that need page-specific parameters
+
+Both widgets share:
+- Same icon (`fa-laptop`)
+- Same rendering template (`iframeWidgetDefinition.htm`)
+- Same security validation logic
+- Same height configuration option
+- Same URL normalization for relative URLs
+
+## Technical Implementation Details
+
+### Rendering Method
+
+The widget provides a static `iframe()` method (IframeWidgetDefinition.java:52-74) that can be reused by other widgets:
+
+```java
+public static WidgetTemplateSubstitution iframe(@Nullable final String iframeSrc, @Nullable final Message title)
+```
+
+This method:
+- Takes a validated iframe source URL and an optional title
+- Returns a `WidgetTemplateSubstitution` for rendering
+- Sets `isNoPadding()` to true for maximum content area
+- Uses the `iframeWidgetDefinition.htm` template
+
+This design allows the Dynamic Inline Frame widget to reuse the same rendering logic.
+
+### URL Processing Pipeline
+
+1. **Input:** Raw URL from widget configuration
+2. **Relative URL Conversion:** If URL starts with `/`, convert to absolute URL using tenant's external URL
+3. **Normalization:** Apply `RichStringUtilities.normalizeUrlAttributeWithoutEscaping()`
+4. **Security Validation:**
+   - Check for empty/null URLs
+   - Block JavaScript URLs (`javascript:`)
+   - Block data URLs (`data:`)
+5. **Tenant Validation:** Apply tenant-specific URL validation rules
+6. **Output:** Validated URL for iframe or null if invalid
+
+### Template Structure
+
+The widget template (`iframeWidgetDefinition.htm`) provides conditional rendering:
+
+- **Valid URL:** Renders `<iframe>` element with Angular controller `IframeWidgetCtrl`
+- **Invalid URL:** Displays Bootstrap alert with error message
+
+The Angular controller likely handles iframe lifecycle, loading states, and error handling on the client side.
+
+### Migration Support
+
+The widget includes migration support (IframeWidgetDefinition.java:185-187) for:
+- Converting deprecated string-based `TITLE` to localized `LOCALIZED_TITLE`
+- Ensures backward compatibility with older widget configurations
+- Migration happens automatically during widget rendering
+
+## Prerequisites and Dependencies
+
+### Required Conditions
+- Widget can be embedded on any Page or Space (validated through `checkEmbeddableIn()`)
+- Must be configured as a widget (not inline in text fields)
+- The target website must allow iframe embedding (X-Frame-Options header)
+
+### Browser Compatibility
+- Requires browser support for iframes (all modern browsers)
+- Subject to browser same-origin policy for cross-domain iframes
+- Some external sites may block iframe embedding through security headers
+
+### External Website Requirements
+- Target website must not block iframe embedding via:
+  - `X-Frame-Options: DENY` header
+  - `X-Frame-Options: SAMEORIGIN` header (for external sites)
+  - `Content-Security-Policy: frame-ancestors` directive
+- If the external site blocks iframe embedding, consider using the Dynamic Inline Frame widget in "button mode" instead
+
+### Network Requirements
+- cplace users must have network access to the target URL
+- Corporate firewalls or proxies may affect access to external URLs
+- HTTPS URLs are recommended for security (mixed content warnings)
+
+## Implementation Context
+
+This widget is part of the **cf.cplace.platform** plugin, which provides core platform functionality. It's a fundamental widget available in all cplace installations and doesn't require any additional plugins or licenses.
+
+### Related Platform Features
+- **Rich String Utilities:** Used for URL normalization and security checks
+- **URL Validator:** Provides tenant-specific URL validation
+- **Widget Framework:** Part of the standard widget rendering infrastructure
+
+### Widget Category
+This is a **content display widget** - it doesn't modify data but provides a view into external content. It's commonly used in:
+- Dashboard pages for consolidated views
+- Documentation pages for reference materials
+- Landing pages for quick access to external tools
+
+## Security Considerations
+
+### Protected Against
+1. **XSS Attacks:** JavaScript URLs are blocked at validation time
+2. **Data Injection:** Data URLs are not allowed
+3. **URL Manipulation:** URLs are normalized and validated before use
+4. **Tenant Isolation:** Tenant-specific URL validators ensure compliance with tenant policies
+
+### Potential Considerations
+1. **Clickjacking:** The widget itself could be vulnerable to clickjacking if not properly secured at the page level
+2. **Third-Party Content:** Embedded content from external sites is not sandboxed - malicious external content could potentially affect the user experience
+3. **Mixed Content:** HTTPS cplace instances embedding HTTP content may trigger browser warnings
+4. **External Site Control:** The widget has no control over external site behavior, privacy policies, or data handling
+
+### Best Practices
+- Use HTTPS URLs whenever possible
+- Verify external sites are trustworthy before embedding
+- Consider using the Dynamic Inline Frame widget's "button mode" for untrusted or problematic sites
+- Review tenant URL validator settings to enforce organizational security policies
+- Document which external sites are approved for iframe embedding
+
+## Common Issues and Solutions
+
+### Issue: "The source URL of the inline frame is invalid"
+**Causes:**
+- JavaScript or data URL used
+- Malformed URL syntax
+- URL blocked by tenant validator
+
+**Solutions:**
+- Use standard HTTP/HTTPS URLs
+- Verify URL is well-formed
+- Check tenant URL validation settings
+
+### Issue: External site doesn't display (blank iframe)
+**Causes:**
+- External site blocks iframe embedding (X-Frame-Options)
+- Network connectivity issues
+- URL requires authentication
+
+**Solutions:**
+- Check browser console for X-Frame-Options errors
+- Verify network access to the URL
+- Consider using Dynamic Inline Frame widget in button mode
+- Contact external site administrator about iframe policies
+
+### Issue: Mixed content warnings
+**Causes:**
+- HTTPS cplace instance embedding HTTP content
+
+**Solutions:**
+- Use HTTPS URLs for embedded content
+- Check if external site offers HTTPS version
+- Configure proper Content-Security-Policy headers
+
+## Comparison with Alternative Approaches
+
+### vs. Rich String Widget with Links
+**Inline Frame Widget:**
+- ✅ Content visible within cplace without navigation
+- ✅ Interactive content (buttons, forms) works
+- ❌ Requires external site to allow iframe embedding
+- ❌ Subject to cross-origin restrictions
+
+**Rich String Widget:**
+- ✅ No embedding restrictions
+- ✅ Simple to configure
+- ❌ Requires user to click and navigate away
+- ❌ No inline interaction with external content
+
+### vs. Custom JavaScript Widget
+**Inline Frame Widget:**
+- ✅ No programming required
+- ✅ Built-in security validation
+- ✅ Standard maintenance and support
+- ❌ Limited to iframe capabilities
+
+**Custom JavaScript Widget:**
+- ✅ Full control over rendering and interaction
+- ✅ Can integrate with APIs instead of iframes
+- ❌ Requires JavaScript programming
+- ❌ Custom security considerations
+
+### vs. Dynamic Inline Frame Widget
+See "Relationship to Other Widgets" section above for detailed comparison.
+
+## Summary
+
+The Inline Frame widget (`cf.platform.iframe`) is a **simple, static content embedding widget** that allows users to display external web content within cplace pages. It's ideal for embedding company-wide resources, general-purpose tools, or fixed external content that doesn't need to change based on page context.
+
+**Key Strengths:**
+- Simple to configure - just enter a URL
+- Built-in security validation
+- Automatic URL normalization
+- Supports both external and relative URLs
+- Part of core platform (no additional license required)
+
+**Key Limitations:**
+- Static URL only (no dynamic content based on page attributes)
+- Subject to external site iframe policies
+- No control over embedded content behavior
+
+**Best For:**
+- General-purpose documentation or help resources
+- Company-wide dashboards or monitoring tools
+- Static external content that's the same for all users
+- Custom static content hosted within cplace
+
+**Not Suitable For:**
+- URLs that need to change based on page attributes (use Dynamic Inline Frame instead)
+- Sites that block iframe embedding (use Dynamic Inline Frame in button mode)
+- Highly dynamic or personalized content (consider custom widgets)

package/dist/widget-specifications/_research_from_ga_products/cf-platform-incomingLinks/research.md

@@ -0,0 +1,242 @@
+# Research: cf.platform.incomingLinks Widget
+
+## Overview
+
+**Widget ID:** `cf.platform.incomingLinks`
+**Repository:** main
+**Definition Class:** `cf.cplace.platform/src/main/java/cf/cplace/platform/frontend/widgets/IncomingLinksWidgetDefinition.java`
+
+## 1. Purpose
+
+### Short Description
+The Incoming Links widget displays all pages that reference or link to the current page through hyperlinks in rich text fields.
+
+### Detailed Description
+The widget tracks and displays incoming links from other cplace pages that contain hyperlinks pointing to the current page in their rich text content (like description fields, comments, or other formatted text fields). These are "backlinks" that help users understand which other pages reference the current page, enabling better navigation and understanding of relationships between content.
+
+**Source:** Widget name and description from `messages_en.properties:4285`:
+- Name: "Incoming Links"
+- Description: "If available, this widget displays incoming links from other cplaces pages."
+
+## 2. Core Functionality
+
+### What It Does
+The widget analyzes `RichStringLink` entities to find all hyperlinks pointing to the current page:
+
+1. **Link Discovery** (IncomingReferencesUtil.java:147-162):
+   - Queries the `RichStringLink` schema for all links where the current page is the target
+   - Each `RichStringLink` represents a hyperlink from a source page to a target page
+   - Links are created when users insert hyperlinks in rich text fields
+
+2. **Link Organization**:
+   - Groups links by source page type and property (which field contains the link)
+   - Shows the count of links from each source
+   - Sorts results alphabetically by label
+
+3. **Display Format** (IncomingLinkKeyAndCount.java:54-85):
+   - Shows source entity type with the attribute name where the link appears
+   - Includes workspace/space information if the link comes from a different space
+   - Displays the count of incoming links for each group
+
+### Display Patterns
+Based on IncomingLinkKeyAndCount message patterns:
+- `{TypeName} as {AttributeName} ({count})` - Standard format showing type and field
+- `{TypeName} as {AttributeName} in {SpaceName} ({count})` - Cross-space links
+- `{RoleName} ({count})` - Links with custom role names
+- `{EntityType} ({count})` - Fallback for non-custom entities
+
+### Example Output
+```
+Project as "Related Projects" (3)
+Task as "Description" in Product Space (5)
+Meeting Notes (2)
+```
+
+## 3. Use Cases
+
+### Primary Use Cases
+
+1. **Content Navigation & Discovery**
+   - Users can see all pages that reference the current page
+   - Helps discover related content that might not be connected through formal relationships
+   - Enables reverse navigation from a page back to its referencing pages
+
+2. **Impact Analysis**
+   - Before deleting or archiving a page, users can see what other pages link to it
+   - Understand the reach and importance of a page based on how many places reference it
+   - Identify dependencies between content items
+
+3. **Relationship Visualization**
+   - Complement to outgoing links - shows the "other side" of hyperlink relationships
+   - Provides context about how this page fits into the broader information architecture
+   - Helps identify pages that serve as hubs (many incoming links)
+
+4. **Knowledge Base & Wiki-Style Usage**
+   - Similar to "What links here" functionality in wikis
+   - Supports organic content organization through hyperlinks
+   - Enables graph-like navigation through interconnected pages
+
+### When to Use This Widget
+
+- On pages that are frequently referenced by other content
+- In knowledge management scenarios where discoverability is important
+- For master data pages (e.g., products, projects, requirements) that other pages reference
+- When tracking content relationships through natural hyperlinks rather than formal references
+
+### When NOT to Use This Widget
+
+- If your content model relies primarily on formal reference attributes (use Incoming References widget instead)
+- On pages where hyperlinks in rich text are rarely used
+- If the widget shows no results (no incoming links exist)
+
+## 4. Configuration Concepts
+
+### Main Configuration Options
+
+Based on the widget definition, configuration is minimal:
+
+1. **Automatic Detection**:
+   - No manual configuration required
+   - Automatically scans `RichStringLink` entities where the current page is the target
+   - Only shows links the current user has permission to see
+
+2. **Embeddability Constraints** (IncomingLinksWidgetDefinition.java:49-52):
+   - Can be embedded on entities implementing `Linkable` interface
+   - Can be embedded on `TypeDefinition` pages (type configuration pages)
+   - Must be embedded as a widget (not inline or in other contexts)
+
+3. **Display Behavior**:
+   - Shows count of links grouped by source type and attribute
+   - Sorts results alphabetically by computed label
+   - Filters out links where user lacks read access to source pages
+   - Hides restricted attributes based on security extensions
+
+### Visibility Rules
+
+- **Empty State**: Shows "No incoming links found" message if no links exist
+- **Permission-Based Filtering**: Only displays links from pages the user can access
+- **Cross-Space Links**: Indicates when links come from different workspaces
+- **Attribute Restrictions**: Respects `RestrictedReadAndSearchAccessOnCustomAttributeExtension` settings
+
+## 5. Context & Relationships
+
+### Related Widgets
+
+1. **Incoming References Widget** (`cf.platform.incomingReferences`)
+   - **Difference**: Tracks formal reference attributes, not hyperlinks
+   - **Use Case**: For structured relationships via reference fields
+   - **Icon**: fa-external-link (rotated)
+
+2. **Incoming Links Widget** (this widget)
+   - **Focus**: Hyperlinks in rich text content
+   - **Use Case**: For organic, wiki-style linking
+   - **Icon**: fa-link
+
+### Data Model Dependencies
+
+- **Linkable Mixin**: Pages must implement this interface to support the widget
+- **RichStringLink Entity**: Core entity tracking hyperlinks between pages
+  - `_source()`: The page containing the hyperlink
+  - `_target()`: The page being linked to (current page)
+  - `_sourceProperty()`: Which field contains the link
+- **LinksMaintenance Mixin**: Required on both source and target for link tracking
+
+### Integration Points
+
+- **Rich Text Editor**: Links are created when users insert hyperlinks in formatted text fields
+- **Search & Permissions**: Uses the search infrastructure to filter results by access rights
+- **Workspace/Space Context**: Aware of cross-space linking scenarios
+- **Type System**: Integrates with TypeDefinition and AttributeDefinition for labeling
+
+## 6. Technical Details
+
+### Implementation Notes
+
+1. **Query Pattern** (IncomingReferencesUtil.java:154):
+   ```java
+   Queries.equals(RichStringLink.SCHEMA.prototype()._target(), target.getEntity())
+   ```
+   - Simple query for all RichStringLinks targeting the current entity
+   - Efficient lookup via indexed target reference
+
+2. **Count Aggregation**:
+   - Counts are aggregated by source type, attribute, and space
+   - Uses IncomingLinkKey as the grouping key
+   - Efficient: counts are computed once and cached in the widget substitution
+
+3. **Template Rendering**:
+   - Uses `incomingLinksWidget.htm` template
+   - Displays as a "light" widget panel (widgetLight)
+   - Each link group is clickable to navigate to a filtered view
+
+4. **Performance Considerations**:
+   - Single query to RichStringLink table
+   - No recursive operations
+   - Permission filtering happens at render time
+   - Suitable for pages with reasonable numbers of incoming links
+
+### File Locations
+
+- **Java Definition**: `/cf.cplace.platform/src/main/java/cf/cplace/platform/frontend/widgets/IncomingLinksWidgetDefinition.java:20`
+- **Template**: `/cf.cplace.platform/src/main/resources/cf/cplace/platform/frontend/widgets/incomingLinksWidgetDefinition.htm`
+- **Helper Template**: `/cf.cplace.platform/src/main/resources/cf/cplace/platform/frontend/templating/objectFunctions/linkable/incomingLinksWidget.htm`
+- **Utility Classes**:
+  - `IncomingReferencesUtil.java` - Link retrieval logic
+  - `IncomingLinkKeyAndCount.java` - Display formatting
+  - `RichStringLink.java` - Core link entity
+
+## 7. Comparison: Incoming Links vs. Incoming References
+
+| Aspect | Incoming Links | Incoming References |
+|--------|---------------|-------------------|
+| **What it tracks** | Hyperlinks in rich text | Formal reference attributes |
+| **Data source** | RichStringLink entities | CustomReferenceInDb entities |
+| **Relationship type** | Informal, user-created links | Structured, schema-defined references |
+| **Typical content** | Wiki-style cross-references | Data model relationships |
+| **Use case** | Documentation, knowledge base | Structured data, formal dependencies |
+| **Creation method** | Manual hyperlink insertion | Reference field selection |
+| **Embeddable in** | Linkable entities, TypeDefinition | CustomEntity, TypeDefinition |
+
+## 8. Key Insights
+
+1. **Complementary to References**: This widget handles informal linking while Incoming References handles formal relationships. Both can coexist on the same page.
+
+2. **User-Driven**: Links appear organically as users write content and insert hyperlinks, making it ideal for knowledge management scenarios.
+
+3. **Bidirectional Awareness**: While users create links in one direction (source → target), this widget provides the reverse view (who links to me?).
+
+4. **Permission-Aware**: Respects cplace's security model, only showing links from content the user can access.
+
+5. **Minimal Configuration**: Works automatically once embedded, requiring no setup beyond adding the widget to a page layout.
+
+## 9. Documentation Recommendations
+
+### One-Sentence Description
+Displays pages that link to the current page through hyperlinks in rich text fields, enabling wiki-style navigation and relationship discovery.
+
+### Conceptual Documentation Structure
+
+1. **What is it?**
+   - A widget showing all pages containing hyperlinks pointing to the current page
+
+2. **When to use it?**
+   - Knowledge bases and documentation pages
+   - Master data pages frequently referenced by others
+   - When tracking informal content relationships
+   - For impact analysis before deleting pages
+
+3. **How does it work?**
+   - Automatically detects hyperlinks in rich text fields
+   - Groups links by source page type and field
+   - Shows count and allows navigation to linking pages
+   - Respects permissions and security settings
+
+4. **Comparison**
+   - Use "Incoming Links" for hyperlinks in rich text
+   - Use "Incoming References" for formal reference fields
+   - Both widgets can complement each other
+
+5. **Best Practices**
+   - Embed on pages expected to be referenced frequently
+   - Consider alongside Incoming References for complete relationship view
+   - Useful for establishing page importance and usage