@thoughtspot/visual-embed-sdk 1.53.1 → 1.53.2-beta

package/src/embed/auto-frame-renderer.spec.ts

@@ -1,4 +1,4 @@
-import { startAutoMCPFrameRenderer } from './auto-frame-renderer';
+import { startAutoMCPFrameRenderer, HiddenActionItemByDefaultForMCPAnswers } from './auto-frame-renderer';
 import { Action, AuthType, AutoMCPFrameRendererViewConfig, EmbedEvent, InterceptedApiType, Param } from '../types';
 import { init } from '../index';
 import * as authInstance from '../auth';
@@ -266,9 +266,15 @@ describe('startAutoMCPFrameRenderer', () => {
             expect(src).toContain('disableHint');
         });
 
-        test('hiddenActions → hideAction in rendered src as JSON array', async () => {
+        test('hiddenActions → hideAction in rendered src as JSON array (unioned with MCP denylist)', async () => {
             const src = await captureRenderedSrc({ hiddenActions: [Action.Pin] });
-            expect(src).toContain(`hideAction=${JSON.stringify([Action.ReportError, Action.Pin])}`);
+            expect(src).toContain(
+                `hideAction=${JSON.stringify([
+                    Action.ReportError,
+                    Action.Pin,
+                    ...HiddenActionItemByDefaultForMCPAnswers,
+                ])}`,
+            );
         });
 
         test('visibleActions → visibleAction in rendered src', async () => {
@@ -399,6 +405,95 @@ describe('startAutoMCPFrameRenderer', () => {
         });
     });
 
+    // ─── MCP-answer default hidden actions (denylist)
+    // ───────────────────────────────────────────────
+
+    describe('MCP-answer default hidden actions', () => {
+        /** Parse the hideAction JSON array out of a rendered iframe src. */
+        function parseHideAction(src: string): string[] {
+            const raw = decodeURIComponent(src.split('hideAction=')[1]?.split('&')[0] ?? '');
+            return raw ? JSON.parse(raw) : [];
+        }
+
+        /** Actions that must stay visible for MCP-rendered answers. */
+        const shouldStayVisible = [
+            Action.Pin,
+            Action.Save,
+            Action.Download,
+            Action.AxisMenuAggregate,
+            Action.AxisMenuFilter,
+            Action.AxisMenuSort,
+            Action.AxisMenuPosition,
+            Action.DrillExclude,
+            Action.DrillInclude,
+            Action.DrillDown,
+            Action.ShowUnderlyingData,
+        ];
+
+        test('empty config hides the full MCP denylist by default', async () => {
+            const src = await captureRenderedSrc();
+            const hidden = parseHideAction(src);
+            HiddenActionItemByDefaultForMCPAnswers.forEach((action) =>
+                expect(hidden).toContain(action));
+        });
+
+        test('empty config keeps the curated visible actions visible', async () => {
+            const src = await captureRenderedSrc();
+            const hidden = parseHideAction(src);
+            shouldStayVisible.forEach((action) => expect(hidden).not.toContain(action));
+        });
+
+        test('caller hiddenActions are unioned with the MCP denylist', async () => {
+            const src = await captureRenderedSrc({ hiddenActions: [Action.Share] });
+            const hidden = parseHideAction(src);
+            expect(hidden).toContain(Action.Share);
+            HiddenActionItemByDefaultForMCPAnswers.forEach((action) =>
+                expect(hidden).toContain(action));
+        });
+
+        test('string hideAction from additionalFlags is parsed, not spread into chars', async () => {
+            const src = await captureRenderedSrc({
+                additionalFlags: { hideAction: `${Action.Share}, ${Action.Edit}` },
+            });
+            const hidden = parseHideAction(src);
+            expect(hidden).toContain(Action.Share);
+            expect(hidden).toContain(Action.Edit);
+            hidden.forEach((action) => expect(action.length).toBeGreaterThan(1));
+            HiddenActionItemByDefaultForMCPAnswers.forEach((action) =>
+                expect(hidden).toContain(action));
+        });
+
+        test('allowlist wins: visibleActions skips the MCP denylist', async () => {
+            const src = await captureRenderedSrc({ visibleActions: [Action.Pin] });
+            expect(src).toContain('visibleAction');
+            const hidden = parseHideAction(src);
+            HiddenActionItemByDefaultForMCPAnswers.forEach((action) =>
+                expect(hidden).not.toContain(action));
+        });
+
+        test('source-iframe hideAction is unioned, not clobbered', async () => {
+            let capturedSrc = '';
+            renderIFrameSpy.mockRestore();
+            renderIFrameSpy = jest.spyOn(TsEmbed.prototype as any, 'renderIFrame')
+                .mockImplementation(async function (this: any, src: string) {
+                    capturedSrc = src;
+                });
+
+            const observer = startAutoMCPFrameRenderer();
+            const iframe = document.createElement('iframe');
+            const sourceHide = encodeURIComponent(JSON.stringify([Action.Save]));
+            iframe.src = `https://${thoughtSpotHost}/v2/?${Param.Tsmcp}=true&hideAction=${sourceHide}#/embed/answer`;
+            document.body.appendChild(iframe);
+            await new Promise((r) => setTimeout(r, 50));
+
+            const hidden = parseHideAction(capturedSrc);
+            expect(hidden).toContain(Action.Save);
+            HiddenActionItemByDefaultForMCPAnswers.forEach((action) =>
+                expect(hidden).toContain(action));
+            observer.disconnect();
+        });
+    });
+
     // ─── frameParams forwarding
     // ───────────────────────────────────────────────
 
@@ -539,12 +634,37 @@ describe('startAutoMCPFrameRenderer', () => {
             document.body.appendChild(iframe);
             await new Promise((r) => setTimeout(r, 50));
 
+            // tsmcp must not survive on the rendered iframe: isTSMCPIframe would
+            // otherwise re-match the SDK's own output and cause an infinite
+            // replacement loop via the same MutationObserver.
             expect(capturedSrc).not.toContain(`${Param.Tsmcp}=true`);
             expect(capturedSrc).toContain('customParam=hello');
             expect(capturedSrc).toMatch(/\?[^#]+#/);
             observer.disconnect();
         });
 
+        test('should mark the rendered iframe with isMcpAnswerEmbed=true instead of tsmcp', async () => {
+            let capturedSrc = '';
+            renderIFrameSpy.mockRestore();
+            renderIFrameSpy = jest.spyOn(TsEmbed.prototype as any, 'renderIFrame')
+                .mockImplementation(async function (this: any, src: string) {
+                    capturedSrc = src;
+                });
+
+            const observer = startAutoMCPFrameRenderer();
+            const iframe = document.createElement('iframe');
+            iframe.src = `https://${thoughtSpotHost}/v2/?${Param.Tsmcp}=true#/embed/answer`;
+            document.body.appendChild(iframe);
+            await new Promise((r) => setTimeout(r, 50));
+
+            // The app-facing marker is present, but tsmcp (the SDK's own
+            // re-processing trigger) is not — this is what keeps the
+            // MutationObserver from looping on its own rendered output.
+            expect(capturedSrc).toContain(`${Param.IsMcpAnswerEmbed}=true`);
+            expect(capturedSrc).not.toContain(`${Param.Tsmcp}=true`);
+            observer.disconnect();
+        });
+
         test('should preserve hash from original iframe src', async () => {
             let capturedSrc = '';
             renderIFrameSpy.mockRestore();
@@ -639,8 +759,9 @@ describe('startAutoMCPFrameRenderer', () => {
             return new URLSearchParams(qs).get(param);
         }
 
+        // hiddenActions is covered separately below: the auto-renderer unions the
+        // MCP denylist into hideAction, so its value is a superset of LiveboardEmbed's.
         test.each([
-            ['hiddenActions', { hiddenActions: [Action.Pin] }, 'hideAction'],
             ['disabledActions', { disabledActions: [Action.Pin] }, 'disableAction'],
             ['visibleActions', { visibleActions: [Action.Download] }, 'visibleAction'],
         ])(
@@ -658,7 +779,7 @@ describe('startAutoMCPFrameRenderer', () => {
             },
         );
 
-        test('hideAction value is a JSON array, not CSV', async () => {
+        test('hideAction value is a JSON array, not CSV, and is a superset of LiveboardEmbed', async () => {
             const autoSrc = await captureRenderedSrc({ hiddenActions: [Action.Pin] });
             const liveboardSrc = await captureLiveboardSrc({ hiddenActions: [Action.Pin] });
 
@@ -668,9 +789,14 @@ describe('startAutoMCPFrameRenderer', () => {
             // Both must parse as a JSON array — not CSV like "reportError,pin"
             expect(() => JSON.parse(autoValue)).not.toThrow();
             expect(() => JSON.parse(liveboardValue)).not.toThrow();
-            expect(Array.isArray(JSON.parse(autoValue))).toBe(true);
-            expect(Array.isArray(JSON.parse(liveboardValue))).toBe(true);
-            expect(JSON.parse(autoValue)).toEqual(JSON.parse(liveboardValue));
+            const autoParsed = JSON.parse(autoValue);
+            const liveboardParsed = JSON.parse(liveboardValue);
+            expect(Array.isArray(autoParsed)).toBe(true);
+            expect(Array.isArray(liveboardParsed)).toBe(true);
+            // Auto-renderer hides everything LiveboardEmbed does, plus the MCP denylist.
+            liveboardParsed.forEach((action: string) => expect(autoParsed).toContain(action));
+            HiddenActionItemByDefaultForMCPAnswers.forEach((action) =>
+                expect(autoParsed).toContain(action));
         });
     });
 

package/src/embed/auto-frame-renderer.ts

@@ -1,4 +1,4 @@
-import { AutoMCPFrameRendererViewConfig, Param } from "../types";
+import { Action, AutoMCPFrameRendererViewConfig, Param } from "../types";
 import { TsEmbed } from "./ts-embed";
 import { getQueryParamString } from "../utils";
 import { tokenizedFetch } from "../tokenizedFetch";
@@ -35,6 +35,28 @@ interface AnswerSessionParams {
     acGenNo: string;
 }
 
+/**
+ * Actions hidden by default on Answers rendered by the ThoughtSpot MCP server
+ * (iframes carrying the `tsmcp=true` marker). Applied automatically by
+ * {@link AutoFrameRenderer} so the auto-rendered answer exposes a curated set of
+ * controls: Pin/Save/Download at the top level, Aggregate/Filter/Sort/Position in
+ * the column menu, and Exclude/Only include/Drill down/Show underlying data in the
+ * axis menu remain visible, while the actions below are removed.
+ *
+ * This is a denylist merged into {@link Param.HideActions}; anything not listed
+ * here stays visible. It is skipped when the caller supplies a `visibleActions`
+ * allowlist (see {@link AutoFrameRenderer.getEmbedParamsObject}).
+ */
+export const HiddenActionItemByDefaultForMCPAnswers = [
+    Action.Edit,
+    Action.InConversationTraining, // Add to Coaching
+    Action.AxisMenuConditionalFormat,
+    Action.AxisMenuRename,
+    Action.AxisMenuEdit,
+    Action.AxisMenuRemove,
+    Action.MakeACopy,
+];
+
 
 /**
  * Starts an automatic renderer that watches the DOM for iframes containing
@@ -219,6 +241,39 @@ function getAnswerIds(
     return request;
 }
 
+/**
+ * Normalizes a `hideAction` value into an array of action ids. The SDK-side value
+ * is already an `Action[]`; a value coming off the source iframe URL is a string
+ * that may be a JSON array (`["edit","save"]`) or a comma-separated list.
+ */
+function parseHideActions(value: unknown): string[] {
+    if (Array.isArray(value)) {
+        return value as string[];
+    }
+    if (typeof value !== 'string' || value === '') {
+        return [];
+    }
+    try {
+        const parsed = JSON.parse(value);
+        if (Array.isArray(parsed)) {
+            return parsed.map(String);
+        }
+    } catch (e) {
+        // Not JSON — fall back to a comma-separated list.
+    }
+    return value.split(',').map((s) => s.trim()).filter(Boolean);
+}
+
+/**
+ * Unions two `hideAction` values (SDK-computed and source-iframe) into a single
+ * de-duplicated array of action ids.
+ */
+function unionHideActions(sdkValue: unknown, sourceValue: unknown): string[] {
+    return Array.from(
+        new Set([...parseHideActions(sdkValue), ...parseHideActions(sourceValue)]),
+    );
+}
+
 function isTSMCPIframe(iframe: HTMLIFrameElement) {
     try {
         const url = new URL(iframe.src);
@@ -247,11 +302,45 @@ class AutoFrameRenderer extends TsEmbed {
         super(container, viewConfig);
     }
 
+    /**
+     * Extends the base embed params with the curated MCP-answer denylist
+     * ({@link HiddenActionItemByDefaultForMCPAnswers}) and a marker letting
+     * the ThoughtSpot app detect this answer was rendered via the MCP
+     * auto-frame-renderer ({@link Param.IsMcpAnswerEmbed}).
+     *
+     * Precedence — merge, allowlist wins:
+     * - When the caller supplies a `visibleActions` allowlist, the base already
+     *   set {@link Param.VisibleActions}; the denylist is skipped so the allowlist
+     *   fully controls visibility.
+     * - Otherwise the denylist is unioned onto {@link Param.HideActions}, which the
+     *   base has already populated with the default hidden actions plus any
+     *   caller-supplied `hiddenActions`.
+     */
+    protected getEmbedParamsObject() {
+        const queryParams = super.getEmbedParamsObject();
+        if (!queryParams[Param.VisibleActions]) {
+            // `additionalFlags` can override this with a non-array value, so
+            // normalize it rather than spreading it directly.
+            queryParams[Param.HideActions] = unionHideActions(
+                queryParams[Param.HideActions],
+                HiddenActionItemByDefaultForMCPAnswers,
+            );
+        }
+        queryParams[Param.IsMcpAnswerEmbed] = true;
+        return queryParams;
+    }
+
     /**
      * Builds the final iframe `src` by merging the SDK embed parameters
      * with the query parameters already present on the source iframe URL.
+     *
      * The `tsmcp` marker param is removed so it does not propagate to the
-     * ThoughtSpot application.
+     * ThoughtSpot application. This is not just cosmetic: `tsmcp=true` is
+     * also how {@link isTSMCPIframe} recognizes an iframe as one this
+     * renderer must process. If the marker survived onto the iframe this
+     * class inserts, the same {@link MutationObserver} would immediately
+     * detect its own output as a new MCP iframe and re-process it, causing
+     * infinite recursive replacement. Do not re-add `tsmcp` here.
      *
      * @param sourceSrc - The original iframe's `src` URL string.
      * @param preserveSourceUrl - When true, return the source URL unchanged.
@@ -274,7 +363,19 @@ class AutoFrameRenderer extends TsEmbed {
         delete existingQueryParamsObject[Param.TsmcpConversationId];
         delete existingQueryParamsObject[Param.TsmcpAnswerIndex];
 
+        // Source-iframe params win over SDK params on merge. Hidden actions
+        // are the exception: union them so a `hideAction` on the source iframe
+        // does not clobber the SDK-computed denylist (and vice versa).
+        const mergedHideActions = unionHideActions(
+            queryParams[Param.HideActions],
+            existingQueryParamsObject[Param.HideActions],
+        );
+        delete existingQueryParamsObject[Param.HideActions];
+
         const mergedQueryParams = { ...queryParams, ...existingQueryParamsObject };
+        if (mergedHideActions.length) {
+            mergedQueryParams[Param.HideActions] = mergedHideActions;
+        }
         const mergedQueryParamsString = getQueryParamString(mergedQueryParams, true);
         const queryString = mergedQueryParamsString ? `?${mergedQueryParamsString}` : '';
         const hash = resolved

package/src/embed/host-events.spec.ts

@@ -228,6 +228,30 @@ describe('HostEvent.OpenAddParameterModal', () => {
     });
 });
 
+// ---------------------------------------------------------------------------
+// 10e – OpenAddTabModal
+// ---------------------------------------------------------------------------
+describe('HostEvent.OpenAddTabModal', () => {
+    test('postMessage type is openAddTabModal (camelCase, no payload)', async () => {
+        mockMessageChannel();
+        const { lb, iframe } = await renderLiveboard();
+        await executeAfterWait(() => {
+            lb.trigger(HostEvent.OpenAddTabModal);
+            expect(iframe.contentWindow.postMessage).toHaveBeenCalledWith(
+                expect.objectContaining({ type: 'openAddTabModal' }),
+                thoughtSpotHost,
+                expect.anything(),
+            );
+        });
+    });
+
+    test('returns null when !isRendered', async () => {
+        const lb = unrenderedLiveboard();
+        const result = await lb.trigger(HostEvent.OpenAddTabModal);
+        expect(result).toBeNull();
+    });
+});
+
 // ---------------------------------------------------------------------------
 // 11 – AddColumns
 // ---------------------------------------------------------------------------

package/src/embed/liveboard.spec.ts

@@ -194,6 +194,51 @@ describe('Liveboard/viz embed tests', () => {
         });
     });
 
+    test('should hide the LiveboardAddPanel action', async () => {
+        expect(Action.LiveboardAddPanel).toBe('liveboardAddPanel');
+        const liveboardEmbed = new LiveboardEmbed(getRootEl(), {
+            hiddenActions: [Action.LiveboardAddPanel],
+            ...defaultViewConfig,
+            liveboardId,
+        } as LiveboardViewConfig);
+        liveboardEmbed.render();
+        await executeAfterWait(() => {
+            expectUrlToHaveParamsWithValues(getIFrameSrc(), {
+                hideAction: JSON.stringify([Action.ReportError, Action.LiveboardAddPanel]),
+            });
+        });
+    });
+
+    test('should disable the LiveboardAddPanel action with a reason', async () => {
+        const liveboardEmbed = new LiveboardEmbed(getRootEl(), {
+            disabledActions: [Action.LiveboardAddPanel],
+            disabledActionReason: 'Action denied',
+            ...defaultViewConfig,
+            liveboardId,
+        } as LiveboardViewConfig);
+        liveboardEmbed.render();
+        await executeAfterWait(() => {
+            expectUrlToHaveParamsWithValues(getIFrameSrc(), {
+                disableAction: JSON.stringify([Action.LiveboardAddPanel]),
+                disableHint: 'Action denied',
+            });
+        });
+    });
+
+    test('should set LiveboardAddPanel in visible actions', async () => {
+        const liveboardEmbed = new LiveboardEmbed(getRootEl(), {
+            visibleActions: [Action.LiveboardAddPanel],
+            ...defaultViewConfig,
+            liveboardId,
+        } as LiveboardViewConfig);
+        liveboardEmbed.render();
+        await executeAfterWait(() => {
+            expectUrlToHaveParamsWithValues(getIFrameSrc(), {
+                visibleAction: JSON.stringify([Action.LiveboardAddPanel]),
+            });
+        });
+    });
+
     test('should set EditLiveboard and EditVisualization independently of each other and of Edit', async () => {
         expect(Action.Edit).toBe('edit');
         expect(Action.EditLiveboard).toBe('editLiveboard');

package/src/react/util.ts

@@ -1,8 +1,20 @@
 import { EmbedEvent, MessageCallback, AllEmbedViewConfig } from '../types';
+import { EmbedEventPayload } from '../contracts/embed-event-payloads';
 
 interface EmbedViewConfig extends AllEmbedViewConfig, EmbedEventHandlers {}
 
-export type EmbedEventHandlers = { [key in keyof typeof EmbedEvent as `on${Capitalize<key>}`]?: MessageCallback };
+/**
+ * `on{Event}` handler props for the React components. Each handler receives the
+ * payload typed for its event (the same {@link EmbedEventPayload} the imperative
+ * `embed.on()` delivers), so `onData`, `onVizPointClick`, etc. are per-event
+ * typed rather than the loose {@link MessageCallback}.
+ */
+export type EmbedEventHandlers = {
+    [K in keyof typeof EmbedEvent as `on${Capitalize<K>}`]?: (
+        payload: EmbedEventPayload<(typeof EmbedEvent)[K]>,
+        responder?: (data: any) => void,
+    ) => void;
+};
 
 export interface EmbedProps extends EmbedViewConfig {
     className?: string;