forms-angular 0.12.0-beta.192 → 0.12.0-beta.194

package/dist/client/forms-angular.js

@@ -4,22 +4,59 @@ var fng;
     var directives;
     (function (directives) {
         /*@ngInject*/
-        function modelControllerDropdown() {
+        modelControllerDropdown.$inject = ["securityService"];
+        function modelControllerDropdown(securityService) {
+            var menuVisibilityStr;
+            var menuDisabledStr;
+            var itemVisibilityStr = "isHidden($index)";
+            var itemDisabledStr = "ng-class=\"dropdownClass($index)\"";
+            // without a more fundamental re-write, we cannot support "instant" binding here, so we'll fall-back to using
+            // the next-best alternative, which is one-time binding
+            var oneTimeBinding = fng.formsAngular.elemSecurityFuncBinding !== "normal";
+            var bindingStr = oneTimeBinding ? "::" : "";
+            if (securityService.canDoSecurity("hidden")) {
+                menuVisibilityStr = "ng-if=\"contextMenuId && !contextMenuHidden\" ".concat(securityService.getHideableAttrs('{{ ::contextMenuId }}'));
+                if (oneTimeBinding) {
+                    // because the isHidden(...) logic is highly likely to be model dependent, that cannot be one-time bound.  to
+                    // be able to combine one-time and regular binding, we'll use ng-if for the one-time bound stuff and ng-hide for the rest
+                    itemVisibilityStr = "ng-if=\"::(choice.divider || !isSecurelyHidden(choice.id))\" ng-hide=\"".concat(itemVisibilityStr, "\"");
+                }
+                else if (fng.formsAngular.elemSecurityFuncBinding === "normal") {
+                    itemVisibilityStr = "ng-hide=\"".concat(itemVisibilityStr, " || (!choice.divider && isSecurelyHidden(choice.id))\"");
+                }
+                itemVisibilityStr += " ".concat(securityService.getHideableAttrs('{{ ::choice.id }}'));
+            }
+            else {
+                menuVisibilityStr = "";
+                itemVisibilityStr = "ng-hide=\"".concat(itemVisibilityStr, "\"");
+            }
+            if (securityService.canDoSecurity("disabled")) {
+                menuDisabledStr = "disableable-link ng-disabled=\"contextMenuDisabled\" ".concat(securityService.getDisableableAttrs('{{ ::contextMenuId }}'));
+                // as ng-class is already being used, we'll add the .disabled class if the menu item is securely disabled using
+                // class="{{ }}".  note that we "prevent" a disabled menu item from being clicked by checking for the DISABLED
+                // attribute in the doClick(...) function, and aborting if this is found.
+                // note that the 'normal' class introduced here might not actually do anything, but for one-time binding to work
+                // properly, we need a truthy value
+                itemDisabledStr += " class=\"{{ ".concat(bindingStr, "(!choice.divider && isSecurelyDisabled(choice.id)) ? 'disabled' : 'normal' }}\" ").concat(securityService.getDisableableAttrs('{{ ::choice.id }}'));
+            }
+            else {
+                menuDisabledStr = "";
+            }
             return {
-                restrict: 'AE',
+                restrict: "AE",
                 replace: true,
-                template: '<li ng-show="items.length > 0" class="mcdd" uib-dropdown>' +
+                template: "<li id=\"{{ contextMenuId }}\" ng-show=\"items.length > 0\" class=\"mcdd\" uib-dropdown ".concat(menuVisibilityStr, " ").concat(menuDisabledStr, ">") +
                     ' <a href="#" uib-dropdown-toggle>' +
                     '  {{contextMenu}} <b class="caret"></b>' +
-                    ' </a>' +
+                    " </a>" +
                     ' <ul class="uib-dropdown-menu dropdown-menu">' +
-                    '  <li ng-repeat="choice in items" ng-hide="isHidden($index)" ng-class="dropdownClass($index)">' +
+                    "  <li ng-repeat=\"choice in items\" ng-attr-id=\"{{choice.id}}\" ".concat(itemVisibilityStr, " ").concat(itemDisabledStr, ">") +
                     '   <a ng-show="choice.text || choice.textFunc" class="dropdown-option" ng-href="{{choice.url || choice.urlFunc()}}" ng-click="doClick($index, $event)">' +
-                    '    {{ choice.text || choice.textFunc() }}' +
-                    '   </a>' +
-                    '  </li>' +
-                    ' </ul>' +
-                    '</li>'
+                    "    {{ choice.text || choice.textFunc() }}" +
+                    "   </a>" +
+                    "  </li>" +
+                    " </ul>" +
+                    "</li>",
             };
         }
         directives.modelControllerDropdown = modelControllerDropdown;
@@ -236,7 +273,7 @@ var fng;
 (function (fng) {
     var directives;
     (function (directives) {
-        formInput.$inject = ["$compile", "$rootScope", "$filter", "$timeout", "cssFrameworkService", "formGenerator", "formMarkupHelper"];
+        formInput.$inject = ["$compile", "$rootScope", "$filter", "$timeout", "cssFrameworkService", "formGenerator", "formMarkupHelper", "securityService"];
         var tabsSetupState;
         (function (tabsSetupState) {
             tabsSetupState[tabsSetupState["Y"] = 0] = "Y";
@@ -244,7 +281,7 @@ var fng;
             tabsSetupState[tabsSetupState["Forced"] = 2] = "Forced";
         })(tabsSetupState || (tabsSetupState = {}));
         /*@ngInject*/
-        function formInput($compile, $rootScope, $filter, $timeout, cssFrameworkService, formGenerator, formMarkupHelper) {
+        function formInput($compile, $rootScope, $filter, $timeout, cssFrameworkService, formGenerator, formMarkupHelper, securityService) {
             return {
                 restrict: 'EA',
                 link: function (scope, element, attrs) {
@@ -288,7 +325,7 @@ var fng;
                     //                <input type="text" class="input-small" placeholder="Email">
                     var subkeys = [];
                     var tabsSetup = tabsSetupState.N;
-                    var generateInput = function (fieldInfo, modelString, isRequired, idString, options) {
+                    var generateInput = function (fieldInfo, modelString, isRequired, options) {
                         function generateEnumInstructions() {
                             var enumInstruction;
                             if (angular.isArray(scope[fieldInfo.options])) {
@@ -314,6 +351,10 @@ var fng;
                             }
                             return enumInstruction;
                         }
+                        var idString = fieldInfo.id;
+                        if (fieldInfo.array || options.subschema) {
+                            idString = formMarkupHelper.generateArrayElementIdString(idString, fieldInfo, options);
+                        }
                         var nameString;
                         if (!modelString) {
                             var modelBase = (options.model || 'record') + '.';
@@ -335,7 +376,6 @@ var fng;
                                     }
                                     else {
                                         modelString += '[$index].' + lastPart;
-                                        idString = null;
                                         nameString = compoundName.replace(/\./g, '-');
                                     }
                                 }
@@ -350,28 +390,13 @@ var fng;
                         isRequired = isRequired || fieldInfo.required;
                         var requiredStr = isRequired ? ' required ' : '';
                         var enumInstruction;
-                        function handleReadOnlyDisabled(readonly) {
-                            var retVal = '';
-                            if (readonly) {
-                                // despite the option being "readonly", we should use disabled and ng-disabled rather than their readonly
-                                // equivalents (which give controls the appearance of being read-only, but don't actually prevent user
-                                // interaction)
-                                if (typeof readonly === "boolean") {
-                                    retVal = " disabled ";
-                                }
-                                else {
-                                    retVal = " ng-disabled=\"".concat(readonly, "\" ");
-                                }
-                            }
-                            return retVal;
-                        }
                         switch (fieldInfo.type) {
                             case 'select':
                                 if (fieldInfo.select2) {
                                     value = '<input placeholder="fng-select2 has been removed" readonly>';
                                 }
                                 else {
-                                    common += handleReadOnlyDisabled(fieldInfo.readonly);
+                                    common += formMarkupHelper.handleReadOnlyDisabled(fieldInfo, scope).join(" ");
                                     common += fieldInfo.add ? (' ' + fieldInfo.add + ' ') : '';
                                     common += " aria-label=\"".concat(fieldInfo.label && fieldInfo.label !== "" ? fieldInfo.label : fieldInfo.name, "\" ");
                                     value = '<select ' + common + 'class="' + allInputsVars.formControl.trim() + allInputsVars.compactClass + allInputsVars.sizeClassBS2 + '" ' + requiredStr + '>';
@@ -425,7 +450,8 @@ var fng;
                             case 'radio':
                                 value = '';
                                 common += requiredStr;
-                                common += handleReadOnlyDisabled(fieldInfo.readonly);
+                                common += formMarkupHelper.handleReadOnlyDisabled(fieldInfo, scope).join(" ");
+                                ;
                                 common += fieldInfo.add ? (' ' + fieldInfo.add + ' ') : '';
                                 var separateLines = options.formstyle === 'vertical' || (options.formstyle !== 'inline' && !fieldInfo.inlineRadio);
                                 if (angular.isArray(fieldInfo.options)) {
@@ -456,7 +482,8 @@ var fng;
                                 break;
                             case 'checkbox':
                                 common += requiredStr;
-                                common += handleReadOnlyDisabled(fieldInfo.readonly);
+                                common += formMarkupHelper.handleReadOnlyDisabled(fieldInfo, scope).join(" ");
+                                ;
                                 common += fieldInfo.add ? (' ' + fieldInfo.add + ' ') : '';
                                 value = formMarkupHelper.generateSimpleInput(common, fieldInfo, options);
                                 if (cssFrameworkService.framework() === 'bs3') {
@@ -465,6 +492,8 @@ var fng;
                                 break;
                             default:
                                 common += formMarkupHelper.addTextInputMarkup(allInputsVars, fieldInfo, requiredStr);
+                                common += formMarkupHelper.handleReadOnlyDisabled(fieldInfo, scope).join(" ");
+                                ;
                                 if (fieldInfo.type === 'textarea') {
                                     if (fieldInfo.rows) {
                                         if (fieldInfo.rows === 'auto') {
@@ -514,11 +543,12 @@ var fng;
                         return result;
                     };
                     var containerInstructions = function (info) {
-                        var result = { before: '', after: '' };
+                        var result;
                         if (typeof info.containerType === 'function') {
                             result = info.containerType(info);
                         }
                         else {
+                            result = {};
                             switch (info.containerType) {
                                 case 'tab':
                                     var tabNo = -1;
@@ -531,12 +561,26 @@ var fng;
                                     if (tabNo >= 0) {
                                         // TODO Figure out tab history updates (check for other tab-history-todos)
                                         // result.before = '<uib-tab deselect="tabDeselect($event, $selectedIndex)" select="updateQueryForTab(\'' + info.title + '\')" heading="' + info.title + '"'
-                                        result.before = '<uib-tab deselect="tabDeselect($event, $selectedIndex)" select="updateQueryForTab(\'' + info.title + '\')" heading="' + info.title + '"';
-                                        if (tabNo > 0) {
-                                            result.before += 'active="tabs[' + tabNo + '].active"';
+                                        var idStr = "".concat(_.camelCase(info.title), "Tab");
+                                        var visibility = securityService.considerVisibility(idStr, scope);
+                                        if (visibility.omit) {
+                                            // we already know this field should be invisible, so we needn't add anything for it
+                                            result.omit = true;
+                                        }
+                                        else {
+                                            var attrs_1 = "id=\"".concat(idStr, "\"");
+                                            if (visibility.visibilityAttr) {
+                                                // an angular expression to determine the visibility of this field later...
+                                                attrs_1 += " ".concat(visibility.visibilityAttr);
+                                            }
+                                            attrs_1 += securityService.generateDisabledAttr(idStr, scope, { attr: "disable", attrRequiresValue: true }); // uib-tab expects 'disable="true"` rather than 'disabled="true"' or just disabled
+                                            result.before = "<uib-tab ".concat(attrs_1, " deselect=\"tabDeselect($event, $selectedIndex)\" select=\"updateQueryForTab('").concat(info.title, "')\" heading=\"").concat(info.title, "\"");
+                                            if (tabNo > 0) {
+                                                result.before += 'active="tabs[' + tabNo + '].active"';
+                                            }
+                                            result.before += '>';
+                                            result.after = '</uib-tab>';
                                         }
-                                        result.before += '>';
-                                        result.after = '</uib-tab>';
                                     }
                                     else {
                                         result.before = '<p>Error!  Tab ' + info.title + ' not found in tab list</p>';
@@ -629,6 +673,9 @@ var fng;
                     };
                     var handleField = function (info, options) {
                         var fieldChrome = formMarkupHelper.fieldChrome(scope, info, options);
+                        if (fieldChrome.omit) {
+                            return "";
+                        }
                         var template = fieldChrome.template;
                         if (info.schema) {
                             var niceName = info.name.replace(/\./g, '_');
@@ -685,22 +732,44 @@ var fng;
                                         if (info.formStyle === "inline" && info.inlineHeaders) {
                                             template += generateInlineHeaders(info.schema, options, model, info.inlineHeaders === "always");
                                         }
-                                        template += '<ol class="sub-doc"' + (info.sortable ? " ui-sortable=\"sortableOptions\" ng-model=\"".concat(model, "\"") : '') + '>';
-                                        template += '<li ng-form class="' + (cssFrameworkService.framework() === 'bs2' ? 'row-fluid ' : '') +
-                                            (info.inlineHeaders ? 'width-controlled ' : '') +
-                                            convertFormStyleToClass(info.formStyle) + ' ' + (info.ngClass ? "ng-class:" + info.ngClass : "") + '" name="form_' + niceName + '{{$index}}" class="sub-doc well" id="' + info.id + 'List_{{$index}}" ' +
-                                            ' ng-repeat="subDoc in ' + model + ' track by $index"' +
-                                            (info.filterable ? ' data-ng-hide="subDoc._hidden"' : "") + '>';
+                                        // handleReadOnlyDisabled() returns two strings - the 'disabled' attribute(s), and the 'disableable'
+                                        // attributes.  for the purpose of deciding if / how to disable sorting if the list itself is
+                                        // disabled, we're only interested in the former...
+                                        var disableCond = formMarkupHelper.handleReadOnlyDisabled(info, scope)[0];
+                                        // if we already know that the field is disabled (only possible when formsAngular.elemSecurityFuncBinding === "instant")
+                                        // then we don't need to add the sortable attribute at all
+                                        // otherwise, we need to include the ng-disabled on the <ol> so this can be referenced by the ui-sortable directive
+                                        // (see sortableOptions)
+                                        var sortableStr = info.sortable && disableCond.trim().toLowerCase() !== "disabled"
+                                            ? "".concat(disableCond, " ui-sortable=\"sortableOptions\" ng-model=\"").concat(model, "\"")
+                                            : "";
+                                        template += "<ol class=\"sub-doc\" ".concat(sortableStr, ">");
+                                        // if a "disabled + children" DOM effect is applied to the list, this should serve to disable all of the
+                                        // fields in the list sub-schema, along with the remove and add buttons for this list.  the following
+                                        // string will be added to the list items and the add and remove buttons to identify this fact.
+                                        var disableableAncestorStr = formMarkupHelper.genDisableableAncestorStr(info.id);
+                                        template +=
+                                            "<li ng-form id=\"".concat(info.id, "List_{{$index}}\" name=\"form_").concat(niceName, "{{$index}}\" ").concat(disableableAncestorStr) +
+                                                "  class=\"".concat(convertFormStyleToClass(info.formStyle)) +
+                                                "  ".concat(cssFrameworkService.framework() === 'bs2' ? 'row-fluid' : '') +
+                                                "  ".concat(info.inlineHeaders ? 'width-controlled' : '') +
+                                                "  ".concat(info.ngClass ? "ng-class:" + info.ngClass : '', "\"") +
+                                                "  ng-repeat=\"subDoc in ".concat(model, " track by $index\"") +
+                                                "  ".concat(info.filterable ? 'data-ng-hide="subDoc._hidden"' : '') +
+                                                ">";
                                         if (cssFrameworkService.framework() === 'bs2') {
                                             template += '<div class="row-fluid sub-doc">';
                                         }
                                         if (info.noRemove !== true || info.customSubDoc) {
-                                            template += '   <div class="sub-doc-btns">';
+                                            // we need to put disableableAncestorStr on the div rather than on the remove button because the
+                                            // way that is styled means that any coloured outlines that might be added when "Identify page elements" is on
+                                            // will be masked
+                                            template += "   <div class=\"sub-doc-btns\" ".concat(info.noRemove !== true ? disableableAncestorStr : "", ">");
                                             if (typeof info.customSubDoc == 'string') {
                                                 template += info.customSubDoc;
                                             }
                                             if (info.noRemove !== true) {
-                                                template += "<button ".concat(info.noRemove ? 'ng-hide="' + info.noRemove + '"' : '', " name=\"remove_").concat(info.id, "_btn\" ng-click=\"remove('").concat(info.name, "', $index, $event)\"");
+                                                template += "<button ".concat(disableCond, " ").concat(info.noRemove ? 'ng-hide="' + info.noRemove + '"' : '', " name=\"remove_").concat(info.id, "_btn\" ng-click=\"remove('").concat(info.name, "', $index, $event)\"");
                                                 if (info.remove) {
                                                     template += ' class="remove-btn btn btn-mini btn-default btn-xs form-btn"><i class="' + formMarkupHelper.glyphClass() + '-minus"></i> Remove';
                                                 }
@@ -755,7 +824,12 @@ var fng;
                                             else {
                                                 hideCond = info.noAdd ? "ng-hide=\"".concat(info.noAdd, "\"") : '';
                                                 indicatorShowCond = info.noAdd ? "ng-show=\"".concat(info.noAdd, " && ").concat(indicatorShowCond, "\"") : '';
-                                                footer += "<button ".concat(hideCond, " id=\"add_").concat(info.id, "_btn\" class=\"add-btn btn btn-default btn-xs btn-mini\" ng-click=\"add('").concat(info.name, "',$event)\">\n                                   <i class=\"' + formMarkupHelper.glyphClass() + '-plus\"></i> \n                                   Add\n                                 </button>");
+                                                // we need the button to have disableCond (to actually disable it, if the list is disabled)
+                                                // adding disableableAncestorStr seems more correct than for it to have the disableable attribute
+                                                footer +=
+                                                    "<button ".concat(hideCond, " ").concat(disableCond, " ").concat(disableableAncestorStr, " id=\"add_").concat(info.id, "_btn\" class=\"add-btn btn btn-default btn-xs btn-mini\" ng-click=\"add('").concat(info.name, "',$event)\">") +
+                                                        " <i class=\"".concat(formMarkupHelper.glyphClass(), "-plus\"></i> Add ") +
+                                                        "</button>";
                                             }
                                             if (info.noneIndicator) {
                                                 footer += "<span ".concat(indicatorShowCond, " class=\"none_indicator\" id=\"no_").concat(info.id, "_indicator\">None</span>");
@@ -790,12 +864,16 @@ var fng;
                                     throw new Error('Cannot use arrays in an inline or stacked form');
                                 }
                                 template += formMarkupHelper.label(scope, info, info.type !== 'link', options);
-                                template += formMarkupHelper.handleArrayInputAndControlDiv(generateInput(info, info.type === 'link' ? null : 'arrayItem.x', true, info.id + '_{{$index}}', options), controlDivClasses, info, options);
+                                var stashedHelp = info.help;
+                                delete info.help;
+                                var inputHtml = generateInput(info, info.type === 'link' ? null : 'arrayItem.x', true, options);
+                                info.help = stashedHelp;
+                                template += formMarkupHelper.handleArrayInputAndControlDiv(inputHtml, controlDivClasses, scope, info, options);
                             }
                             else {
                                 // Single fields here
                                 template += formMarkupHelper.label(scope, info, null, options);
-                                template += formMarkupHelper.handleInputAndControlDiv(generateInput(info, null, options.required, info.id, options), controlDivClasses);
+                                template += formMarkupHelper.handleInputAndControlDiv(generateInput(info, null, options.required, options), controlDivClasses);
                             }
                         }
                         template += fieldChrome.closeTag;
@@ -924,6 +1002,8 @@ var fng;
                                     callHandleField = false;
                                 }
                                 else if (info.containerType) {
+                                    // for now, the following call will only consider security for tabs and not other container types.
+                                    // hence why we...
                                     var parts = containerInstructions(info);
                                     switch (info.containerType) {
                                         case 'tab':
@@ -934,9 +1014,12 @@ var fng;
                                                 var activeTabNo = _.findIndex(scope.tabs, function (tab) { return (tab.active); });
                                                 scope.activeTabNo = activeTabNo >= 0 ? activeTabNo : 0;
                                             }
-                                            result += parts.before;
-                                            result += processInstructions(info.content, null, options);
-                                            result += parts.after;
+                                            // ...only check for this here!
+                                            if (!parts.omit) {
+                                                result += parts.before;
+                                                result += processInstructions(info.content, null, options);
+                                                result += parts.after;
+                                            }
                                             break;
                                         case 'tabset':
                                             tabsSetup = tabsSetupState.Y;
@@ -1506,6 +1589,10 @@ var fng;
                                     needDivider = false;
                                     parentScope.items.push({ divider: true });
                                 }
+                                if (!value.id) {
+                                    // if it doesn't have an id, give it one, so every menu item is possible to secure
+                                    value.id = _.camelCase(value.text || value.textFunc() || "");
+                                }
                                 parentScope.items.push(value);
                             }
                         });
@@ -1813,7 +1900,7 @@ var fng;
          * All methods should be state-less
          *
          */
-        function formGenerator($location, $timeout, $filter, routingService, recordHandler) {
+        function formGenerator($filter, routingService, recordHandler, securityService) {
             function handleSchema(description, source, destForm, destList, prefix, doRecursion, $scope, ctrlState) {
                 function handletabInfo(tabName, thisInst) {
                     var tabTitle = angular.copy(tabName);
@@ -1950,7 +2037,7 @@ var fng;
                         angular.extend(formInstructions, mongooseType.options.form);
                     }
                 }
-                if (mongooseType.instance === 'String') {
+                if (mongooseType.instance === 'String' || (mongooseType.instance === 'ObjectID' && formInstructions.asText)) {
                     if (mongooseOptions.enum) {
                         formInstructions.type = formInstructions.type || 'select';
                         if (formInstructions.select2) {
@@ -2261,14 +2348,19 @@ var fng;
                     return forceNextTime;
                 },
                 add: function add(fieldName, $event, $scope, modelOverride) {
-                    var _a;
+                    var _a, _b;
+                    // for buttons, the click event won't fire if the disabled attribute exists, but the same is not true of
+                    // icons, so we need to check this for simple array item addition
+                    if (((_a = $event === null || $event === void 0 ? void 0 : $event.target) === null || _a === void 0 ? void 0 : _a.hasAttribute) && $event.target.hasAttribute("disabled")) {
+                        return $event.preventDefault();
+                    }
                     // check that target element is visible.  May not be reliable - see https://stackoverflow.com/questions/19669786/check-if-element-is-visible-in-dom
                     if ($event.target.offsetParent) {
                         var arrayField = getArrayFieldToExtend(fieldName, $scope, modelOverride);
                         var schemaElement = $scope.formSchema.find(function (f) { return f.name === fieldName; }); // In case someone is using the formSchema directly
                         var subSchema = schemaElement ? schemaElement.schema : null;
                         var obj = subSchema ? $scope.setDefaults(subSchema, fieldName + '.') : {};
-                        if (typeof ((_a = $scope.dataEventFunctions) === null || _a === void 0 ? void 0 : _a.onInitialiseNewSubDoc) === "function") {
+                        if (typeof ((_b = $scope.dataEventFunctions) === null || _b === void 0 ? void 0 : _b.onInitialiseNewSubDoc) === "function") {
                             $scope.dataEventFunctions.onInitialiseNewSubDoc(fieldName, subSchema, obj);
                         }
                         arrayField.push(obj);
@@ -2281,6 +2373,12 @@ var fng;
                     $scope.setFormDirty($event);
                 },
                 remove: function remove(fieldName, value, $event, $scope, modelOverride) {
+                    var _a;
+                    // for buttons, the click event won't fire if the disabled attribute exists, but the same is not true of
+                    // icons, so we need to check this for simple array item removal
+                    if (((_a = $event === null || $event === void 0 ? void 0 : $event.target) === null || _a === void 0 ? void 0 : _a.hasAttribute) && $event.target.hasAttribute("disabled")) {
+                        return $event.preventDefault();
+                    }
                     // Remove an element from an array
                     var arrayField = getArrayFieldToExtend(fieldName, $scope, modelOverride);
                     var err;
@@ -2329,7 +2427,7 @@ var fng;
                     }
                     return result;
                 },
-                decorateScope: function decorateScope($scope, formGeneratorInstance, recordHandlerInstance, sharedData) {
+                decorateScope: function decorateScope($scope, formGeneratorInstance, recordHandlerInstance, sharedData, pseudoUrl) {
                     $scope.record = sharedData.record;
                     $scope.phase = 'init';
                     $scope.disableFunctions = sharedData.disableFunctions;
@@ -2346,6 +2444,7 @@ var fng;
                     $scope.pageSize = 60;
                     $scope.pagesLoaded = 0;
                     sharedData.baseScope = $scope;
+                    securityService.decorateSecurableScope($scope, { pseudoUrl: pseudoUrl });
                     $scope.generateEditUrl = function (obj) {
                         return formGeneratorInstance.generateEditUrl(obj, $scope);
                     };
@@ -2356,7 +2455,20 @@ var fng;
                         return formGeneratorInstance.generateNewUrl($scope);
                     };
                     $scope.scrollTheList = function () {
-                        return recordHandlerInstance.scrollTheList($scope);
+                        var _a;
+                        // wait until we have the list schema.  until we get a non-empty listSchema (which might never
+                        // happen if we don't have permission to GET it), then there's no point requesting the data
+                        if (((_a = $scope.listSchema) === null || _a === void 0 ? void 0 : _a.length) > 0) {
+                            return recordHandlerInstance.scrollTheList($scope);
+                        }
+                        else {
+                            var unwatch_1 = $scope.$watchCollection("listSchema", function (newValue) {
+                                if ((newValue === null || newValue === void 0 ? void 0 : newValue.length) > 0) {
+                                    unwatch_1();
+                                    return recordHandlerInstance.scrollTheList($scope);
+                                }
+                            });
+                        }
                     };
                     $scope.getListData = function (record, fieldName) {
                         return recordHandlerInstance.getListData(record, fieldName, $scope.listSchema, $scope);
@@ -2406,7 +2518,7 @@ var fng;
             };
         }
         services.formGenerator = formGenerator;
-        formGenerator.$inject = ["$location", "$timeout", "$filter", "routingService", "recordHandler"];
+        formGenerator.$inject = ["$filter", "routingService", "recordHandler", "securityService"];
     })(services = fng.services || (fng.services = {}));
 })(fng || (fng = {}));
 /// <reference path="../../index.d.ts" />
@@ -2415,8 +2527,8 @@ var fng;
     var services;
     (function (services) {
         /*@ngInject*/
-        formMarkupHelper.$inject = ["cssFrameworkService", "inputSizeHelper", "addAllService", "$filter"];
-        function formMarkupHelper(cssFrameworkService, inputSizeHelper, addAllService, $filter) {
+        formMarkupHelper.$inject = ["cssFrameworkService", "inputSizeHelper", "addAllService", "securityService", "$filter"];
+        function formMarkupHelper(cssFrameworkService, inputSizeHelper, addAllService, securityService, $filter) {
             function generateNgShow(showWhen, model) {
                 function evaluateSide(side) {
                     var result = side;
@@ -2454,25 +2566,180 @@ var fng;
             function glyphClass() {
                 return (cssFrameworkService.framework() === 'bs2' ? 'icon' : 'glyphicon glyphicon');
             }
+            // Generate two strings:
+            //   1. firstly, attribute(s) that could be added to element(s) representing the field with the given
+            //      parameters to enable or disable it according to the prevailing security rules.
+            //   2. secondly, attribute(s) that could be added to a element - regardless of whether or not it will
+            //      actually be disabled on this occasion - to identify it as being potentially disableable
+            // This function is a more complicated version of securityService.generateDisabledAttr, also taking into
+            // account the fact that fieldInfo.readonly can influence the disabled state of a field.
+            // nonUniqueId should be required only in cases where a sub-sub schema has been defined in a directive
+            // as a means of getting around the single-level-of-nesting limitation.  in that case, where the
+            // directive's template then includes a <form-input> tag, it is likely that the ids of the sub-sub-schema
+            // elements will include $index from a parent scope (responsible for the sub-schema) in order to
+            // ensure its uniqueness, and in this case (as we are not explicitely managing the addition of the
+            // {{ $index }} expr), we need to be given a version of the id that does not include that expression.
+            // where nonUniqueId is provided, we will also use this for determining ancestors, because in the
+            // nested sub-schema scenario described above, the names of the fields in the sub-sub-schema will
+            // probably not identify the full ancestry.
+            function handleReadOnlyDisabled(partialFieldInfo, scope) {
+                var id = partialFieldInfo.nonUniqueId || partialFieldInfo.id;
+                function getActuallyDisabledAttr() {
+                    if (partialFieldInfo.readonly && typeof partialFieldInfo.readonly === "boolean") {
+                        // if we have a true-valued readonly property then this trumps whatever security rule might apply to this field
+                        return " disabled ";
+                    }
+                    function wrapReadOnly() {
+                        return partialFieldInfo.readonly ? " ng-disabled=\"".concat(partialFieldInfo.readonly, "\" ") : "";
+                    }
+                    if (!id || !securityService.canDoSecurityNow(scope, "disabled")) {
+                        // no security, so we're just concerned about what value fieldInfo.readonly has
+                        return wrapReadOnly();
+                    }
+                    // if scope has been decorated with a requiresDisabledChildren function, we will be using that to check whether any
+                    // of the ancestors of this field's element require their children to be disabled.  if they do, that means us!
+                    var ancestorIds = [];
+                    if (!!scope.requiresDisabledChildren) {
+                        var ancestors = void 0;
+                        // if we have been provided with a nonUniqueId, we should use that to determine ancestors, because in this case,
+                        // the name will not be reliable
+                        if (partialFieldInfo.nonUniqueId) {
+                            var ancestorStr = partialFieldInfo.nonUniqueId.startsWith("f_") ? partialFieldInfo.nonUniqueId.substring(2) : partialFieldInfo.nonUniqueId;
+                            ancestors = ancestorStr.split("_");
+                        }
+                        else {
+                            ancestors = partialFieldInfo.name.split(".");
+                        }
+                        ancestors.pop();
+                        while (ancestors.length > 0) {
+                            ancestorIds.push("f_".concat(ancestors.join("_")));
+                            ancestors.pop();
+                        }
+                    }
+                    if (fng.formsAngular.elemSecurityFuncBinding === "instant") {
+                        // "instant" security is evaluated now, and a positive result trumps whatever fieldInfo.readonly might be set to
+                        if (scope.isSecurelyDisabled(id)) {
+                            return " disabled ";
+                        }
+                        else {
+                            for (var _i = 0, ancestorIds_1 = ancestorIds; _i < ancestorIds_1.length; _i++) {
+                                var ancestorId = ancestorIds_1[_i];
+                                if (scope.requiresDisabledChildren(ancestorId)) {
+                                    return " disabled ";
+                                }
+                            }
+                            return wrapReadOnly();
+                        }
+                    }
+                    var securityFuncStr = "isSecurelyDisabled('".concat(id, "')");
+                    if (ancestorIds.length > 0) {
+                        var ancestorStr = ancestorIds.map(function (aid) { return "requiresDisabledChildren('".concat(aid, "')"); });
+                        securityFuncStr = "(".concat(securityFuncStr, " || ").concat(ancestorStr.join(" || "), ")");
+                    }
+                    var oneTimeBinding = fng.formsAngular.elemSecurityFuncBinding === "one-time";
+                    if (partialFieldInfo.readonly) {
+                        // we have both security and a read-only attribute to deal with
+                        if (oneTimeBinding) {
+                            // if our field has a string-typed readonly attribute *and* one-time binding is required by our securityFunc, we
+                            // cannot simply combine these into a single ng-disabled expression, because the readonly property is highly
+                            // likely to be model-dependent and therefore cannot use one-time-binding.  the best we can do in this case is
+                            // to use ng-disabled for the field's readonly property, and a one-time-bound ng-readonly for the securityFunc.
+                            // this is not perfect, because in the case of selects, ng-readonly doesn't actually prevent the user from
+                            // making a selection.  however, the select will be styled as if it is disabled (including the not-allowed
+                            // cursor), which should deter the user in most cases.  
+                            return wrapReadOnly() + "ng-readonly=\"::".concat(securityFuncStr, "\" ");
+                        }
+                        else {
+                            // if we have both things and we are *NOT* required to use one-time binding for the securityFunc, then they can
+                            // be combined into a single ng-disabled expression
+                            return " ng-disabled=\"".concat(securityFuncStr, " || ").concat(partialFieldInfo.readonly, "\" ");
+                        }
+                    }
+                    else {
+                        // we have security only
+                        return " ng-disabled=\"".concat(oneTimeBinding ? "::" : "").concat(securityFuncStr, "\" ");
+                    }
+                }
+                return [getActuallyDisabledAttr(), securityService.getDisableableAttrs(id)];
+            }
+            function generateArrayElementIdString(idString, info, options) {
+                if (options.subschema && options.model) {
+                    // for subschemas, it is possible that our model will begin with $parent., or $parent.$parent. (etc).  though a bit of 
+                    // a hack where this does occur (probably where a directive used by a sub-schema is using a nested <form-input>
+                    // directive), we need to look for the $index in the same place as our model is looking for data.
+                    var model = options.model;
+                    var nestedSteps = 0;
+                    var stepIndicator = "$parent.";
+                    while (model.startsWith(stepIndicator)) {
+                        nestedSteps++;
+                        model = model.substring(stepIndicator.length);
+                    }
+                    return "".concat(idString, "_{{").concat(stepIndicator.repeat(nestedSteps), "$index}}");
+                }
+                else {
+                    return "".concat(idString, "_{{$index}}");
+                }
+            }
+            function genDisableableAncestorStr(id) {
+                return securityService.getDisableableAncestorAttrs(id);
+            }
+            function isArrayElement(scope, info, options) {
+                return scope["$index"] !== undefined || !!options.subschema;
+            }
             return {
                 isHorizontalStyle: isHorizontalStyle,
+                isArrayElement: isArrayElement,
                 fieldChrome: function fieldChrome(scope, info, options) {
+                    var insert = '';
+                    if (info.id && typeof info.id.replace === "function") {
+                        var uniqueIdStr = info.nonUniqueId || info.nonuniqueid || info.id;
+                        var idStr = void 0;
+                        // replace any . that appear in info.id with "-", but not those that appear between {{ and }}
+                        if (info.id.includes(".") && info.id.includes("{{")) {
+                            idStr = "cg_";
+                            var inExpr = false;
+                            for (var i = 0; i < info.id.length; i++) {
+                                if (info.id[i] === "{" && info.id[i - 1] === "{") {
+                                    inExpr = true;
+                                }
+                                else if (info.id[i] === "}" && info.id[i - 1] === "}") {
+                                    inExpr = false;
+                                }
+                                if (inExpr || info.id[i] !== ".") {
+                                    idStr += info.id[i];
+                                }
+                                else {
+                                    idStr += "-";
+                                }
+                            }
+                        }
+                        else {
+                            idStr = "cg_".concat(info.id.replace(/\./g, '-'));
+                        }
+                        uniqueIdStr = "cg_".concat(uniqueIdStr.replace(/\./g, '-'));
+                        var visibility = securityService.considerVisibility(uniqueIdStr, scope);
+                        if (visibility.omit) {
+                            // we already know this field should be invisible, so we needn't add anything for it
+                            return { omit: true };
+                        }
+                        insert += "id=\"".concat(isArrayElement(scope, info, options) ? generateArrayElementIdString(idStr, info, options) : idStr, "\"");
+                        if (visibility.visibilityAttr) {
+                            // an angular expression to determine the visibility of this field later...
+                            insert += " ".concat(visibility.visibilityAttr);
+                        }
+                    }
                     var classes = info.classes || '';
                     var template = '';
                     var closeTag = '';
-                    var insert = '';
                     info.showWhen = info.showWhen || info.showwhen; //  deal with use within a directive
                     if (info.showWhen) {
                         if (typeof info.showWhen === 'string') {
-                            insert += 'ng-show="' + info.showWhen + '"';
+                            insert += ' ng-show="' + info.showWhen + '"';
                         }
                         else {
-                            insert += 'ng-show="' + generateNgShow(info.showWhen, options.model) + '"';
+                            insert += ' ng-show="' + generateNgShow(info.showWhen, options.model) + '"';
                         }
                     }
-                    if (info.id && typeof info.id.replace === "function") {
-                        insert += ' id="cg_' + info.id.replace(/\./g, '-') + '"';
-                    }
                     if (cssFrameworkService.framework() === 'bs3') {
                         classes += ' form-group';
                         if (options.formstyle === 'vertical' && info.size !== 'block-level') {
@@ -2532,7 +2799,8 @@ var fng;
                         }
                         labelHTML += addAllService.addAll(scope, 'Label', null, options) + ' class="' + classes + '">' + fieldInfo.label;
                         if (addButtonMarkup) {
-                            labelHTML += ' <i id="add_' + fieldInfo.id + '" ng-click="add(\'' + fieldInfo.name + '\',$event)" class="' + glyphClass() + '-plus-sign"></i>';
+                            var disabledAttrs = handleReadOnlyDisabled(fieldInfo, scope);
+                            labelHTML += " <i ".concat(disabledAttrs.join(" "), " id=\"add_").concat(fieldInfo.id, "\" ng-click=\"add('").concat(fieldInfo.name, "', $event)\" class=\"").concat(glyphClass(), "-plus-sign\"></i>");
                         }
                         labelHTML += '</label>';
                         if (fieldInfo.linklabel) {
@@ -2568,13 +2836,24 @@ var fng;
                     if (['inline', 'stacked'].includes(options.formstyle)) {
                         placeHolder = placeHolder || fieldInfo.label;
                     }
-                    common = 'data-ng-model="' + modelString + '"' + (idString ? ' id="' + idString + '" name="' + idString + '" ' : ' name="' + nameString + '" ');
-                    common += (placeHolder ? ('placeholder="' + placeHolder + '" ') : '');
+                    common = 'data-ng-model="' + modelString + '"';
+                    if (idString) {
+                        common += " id=\"".concat(idString, "\"");
+                    }
+                    if (nameString) {
+                        common += " name=\"".concat(nameString, "\"");
+                    }
+                    else if (idString) {
+                        common += " name=\"".concat(idString, "\"");
+                    }
+                    if (placeHolder) {
+                        common += " placeholder=\"".concat(placeHolder, "\"");
+                    }
                     if (fieldInfo.popup) {
-                        common += 'title="' + fieldInfo.popup + '" ';
+                        common += " title=\"".concat(fieldInfo.popup, "\"");
                     }
                     if (fieldInfo.ariaLabel) {
-                        common += 'aria-label="' + fieldInfo.ariaLabel + '" ';
+                        common += " aria-label=\"".concat(fieldInfo.ariaLabel, "\"");
                     }
                     common += addAllService.addAll(scope, 'Field', null, options);
                     return {
@@ -2595,6 +2874,9 @@ var fng;
                         var helpMarkup = cssFrameworkService.framework() === 'bs2' ? { el: 'span', cl: 'help-inline' } : { el: 'div', cl: 'help-block' };
                         value += "<".concat(helpMarkup.el, " class=\"").concat(helpMarkup.cl, "\">").concat(inlineHelp, "</").concat(helpMarkup.el, ">");
                     }
+                    // this is a dummy tag identifying where the input ends and the messages block (that is only visible when the form field is $dirty)
+                    // begins.  our caller could replace this tag with anything it needs to insert between these two things.
+                    value += "<dms/>";
                     if (!options.noid) {
                         value += "<div ng-if=\"".concat((options.name || 'myForm'), "['").concat(fieldInfo.id, "'].$dirty\" class=\"help-block\">") +
                             " <div ng-messages=\"".concat((options.name || 'myForm'), "['").concat(fieldInfo.id, "'].$error\">") +
@@ -2635,18 +2917,21 @@ var fng;
                     }
                     return inputMarkup;
                 },
-                handleArrayInputAndControlDiv: function handleArrayInputAndControlDiv(inputMarkup, controlDivClasses, info, options) {
-                    var result = '<div ';
-                    if (cssFrameworkService.framework() === 'bs3') {
-                        result += 'ng-class="skipCols($index)" ';
-                    }
-                    result += 'class="' + controlDivClasses.join(' ') + '" id="' + info.id + 'List" ';
-                    result += 'ng-repeat="arrayItem in ' + (options.model || 'record') + '.' + info.name + ' track by $index">';
-                    result += inputMarkup;
-                    if (info.type !== 'link') {
-                        result += '<i ng-click="remove(\'' + info.name + '\',$index,$event)" id="remove_' + info.id + '_{{$index}}" class="' + glyphClass() + '-minus-sign"></i>';
-                    }
+                handleArrayInputAndControlDiv: function handleArrayInputAndControlDiv(inputMarkup, controlDivClasses, scope, info, options) {
+                    var indentStr = cssFrameworkService.framework() === 'bs3' ? 'ng-class="skipCols($index)" ' : "";
+                    var arrayStr = (options.model || 'record') + '.' + info.name;
+                    var result = "";
+                    result += '<div id="' + info.id + 'List" class="' + controlDivClasses.join(' ') + '" ' + indentStr + ' ng-repeat="arrayItem in ' + arrayStr + ' track by $index">';
+                    var disabledAttrs = handleReadOnlyDisabled(info, scope);
+                    var removeBtn = info.type !== 'link'
+                        ? "<i ".concat(disabledAttrs.join(" "), " ng-click=\"remove('").concat(info.name, "', $index, $event)\" id=\"remove_").concat(info.id, "_{{$index}}\" class=\"").concat(glyphClass(), "-minus-sign\"></i>")
+                        : "";
+                    result += inputMarkup.replace("<dms/>", removeBtn);
                     result += '</div>';
+                    indentStr = cssFrameworkService.framework() === 'bs3' ? 'ng-class="skipCols(' + arrayStr + '.length)" ' : "";
+                    if (info.help) {
+                        result += '<div class="array-help-block ' + controlDivClasses.join(' ') + '" ' + indentStr + ' id="empty' + info.id + 'ListHelpBlock">' + info.help + '</div>';
+                    }
                     return result;
                 },
                 addTextInputMarkup: function addTextInputMarkup(allInputsVars, fieldInfo, requiredStr) {
@@ -2659,14 +2944,11 @@ var fng;
                         result += ' ' + fieldInfo.add + ' ';
                     }
                     result += requiredStr;
-                    if (fieldInfo.readonly) {
-                        result += " ".concat(typeof fieldInfo.readOnly === 'boolean' ? 'readonly' : 'ng-readonly="' + fieldInfo.readonly + '"', " ");
-                    }
-                    else {
-                        result += ' ';
-                    }
                     return result;
-                }
+                },
+                handleReadOnlyDisabled: handleReadOnlyDisabled,
+                generateArrayElementIdString: generateArrayElementIdString,
+                genDisableableAncestorStr: genDisableableAncestorStr
             };
         }
         services.formMarkupHelper = formMarkupHelper;
@@ -2705,105 +2987,260 @@ var fng;
         /*@ngInject*/
         pluginHelper.$inject = ["formMarkupHelper"];
         function pluginHelper(formMarkupHelper) {
-            return {
-                extractFromAttr: function extractFromAttr(attr, directiveName) {
-                    function deserialize(str) {
-                        var retVal = str.replace(/&quot;/g, '"');
-                        if (retVal === 'true') {
-                            retVal = true;
+            function internalGenDisabledAttrs(scope, id, processedAttrs, idSuffix, params) {
+                // Though id will already have the value of idSuffix appended, processedAttrs.info.name will not.
+                // For handleReadOnlyDisabled() to disable "sub-elements" included in a directive template with an idsuffix when their
+                // 'parent' field is disabled, we need the name to include that suffix as if it were an additional level
+                // of field nesting.
+                var name = processedAttrs.info.name;
+                if (idSuffix) {
+                    if (params === null || params === void 0 ? void 0 : params.nonUniqueIdSuffix) {
+                        // Generally, when genIdAndDisabledStr is called from a directive, the idSuffix will be something like "select"
+                        // or "hasValueCheckbox" (thus enabling a single directive to create a template that includes more than one form
+                        // element - such as a checkbox and an input - each of which has a unique id).
+                        // Where a directive is responsible for creating markup for an whole array of elements, it is likely to include an
+                        // ng-repeat in the template that it generates, and in this case, the idSuffix that it passes to genIdAndDisabledStr
+                        // will probably include a reference to $index to ensure uniqueness.
+                        // Where idSuffix /does/ contain a reference to $index, the directive should provide a version of the idSuffix
+                        // in the params object which does NOT include this.
+                        // This is what we need to use for the ng-disabled/ng-readonly expression.
+                        // (ReallyCare development hint: for an example of where this is needed, see or-opts.ts.)
+                        id = id.replace(idSuffix, params.nonUniqueIdSuffix);
+                        name += ".".concat(params.nonUniqueIdSuffix);
+                    }
+                    else {
+                        name += ".".concat(idSuffix);
+                    }
+                }
+                var attrs = formMarkupHelper.handleReadOnlyDisabled({
+                    id: id,
+                    name: name,
+                    nonUniqueId: processedAttrs.info.nonuniqueid,
+                    readonly: processedAttrs.info.readonly
+                }, scope);
+                // some types of control (such as ui-select) don't deal correctly with a DISABLED attribute and
+                // need ng-disabled, even when the expression is simply "true"
+                if (params === null || params === void 0 ? void 0 : params.forceNg) {
+                    for (var i = 0; i < attrs.length; i++) {
+                        if (attrs[i].toLowerCase().trim() === "disabled") {
+                            attrs[i] = 'ng-disabled="true"';
                         }
-                        else if (retVal === 'false') {
-                            retVal = false;
+                    }
+                }
+                return attrs;
+            }
+            function internalGenDisabledStr(scope, id, processedAttrs, idSuffix, params) {
+                return internalGenDisabledAttrs(scope, id, processedAttrs, idSuffix, params).join(" ");
+            }
+            // text surrounded by @@ @@ is assumed to be something that can have a pseudonym.  We'll rely
+            // upon the relevant controller assigning a pseudo() function to baseScope.
+            function handlePseudos(str) {
+                if (!str) {
+                    return str;
+                }
+                var result = str;
+                while (result.includes("@@")) {
+                    result = result.replace("@@", "{{ baseScope.pseudo('");
+                    result = result.replace("@@", "', true) }}");
+                }
+                return result;
+            }
+            function makeIdStringUniqueForArrayElements(scope, processedAttrs, idString) {
+                if (formMarkupHelper.isArrayElement(scope, processedAttrs.info, processedAttrs.options)) {
+                    return formMarkupHelper.generateArrayElementIdString(idString, processedAttrs.info, processedAttrs.options);
+                }
+                else {
+                    return idString;
+                }
+            }
+            function internalGenIdString(scope, processedAttrs, suffix, makeUniqueForArrayElements) {
+                var result = processedAttrs.info.id;
+                if (suffix) {
+                    if (!suffix.startsWith("_")) {
+                        result += "_";
+                    }
+                    result += suffix;
+                }
+                if (makeUniqueForArrayElements) {
+                    result = makeIdStringUniqueForArrayElements(scope, processedAttrs, result);
+                }
+                return result;
+            }
+            function internalGenDateTimePickerDisabledStr(scope, processedAttrs, idSuffix, idString) {
+                var rawDisabledAttrs = internalGenDisabledAttrs(scope, idString, processedAttrs, idSuffix, { forceNg: true });
+                // first, we need to convert the 'disabled' attribute(s) (those which might actually cause the element to be
+                // disabled - found in rawDisabledAttrs[0]) into something that the datetime picker understands.
+                var rawDisabledStr = rawDisabledAttrs[0];
+                var disabledStr = "";
+                // disabledStr might now include an ng-disabled attribute.  To disable both the date and time inputs, we need to
+                // take the value of that attribute and wrap it up as two new attributes: "disabledDate" and "readonlyTime"
+                // (which is what the datetimepicker directive is expecting to receive)
+                if (rawDisabledStr) {
+                    // disabledStr should contain either 'ng-disabled="xxxx"' or 'ng-readonly="yyyy"', or both.
+                    // the values of xxxx and yyyy could be more-or-less anything, and certainly they could include = or ", which
+                    // makes parsing hard
+                    // our strategy will be to re-format disabledStr as if it was the string representation of an object, and
+                    // then parse it.  we can then refer to the ng-disabled and ng-readonly attributes of the parsed object.
+                    // in the future, perhaps ng-disabled and ng-readonly will be changed to data-ng-disabled and data-ng-readonly
+                    rawDisabledStr = rawDisabledStr.replace("data-ng-disabled", "ng-disabled");
+                    rawDisabledStr = rawDisabledStr.replace("data-ng-readonly", "ng-readonly");
+                    rawDisabledStr = rawDisabledStr.replace("ng-disabled=", '"ng-disabled":');
+                    rawDisabledStr = rawDisabledStr.replace("ng-readonly=", '"ng-readonly":');
+                    try {
+                        rawDisabledStr = "{ ".concat(rawDisabledStr, " }");
+                        var disabledObj = JSON.parse(rawDisabledStr);
+                        rawDisabledStr = disabledObj["ng-disabled"];
+                        // cannot see a way to sensibly deal with both ng-disabled and ng-readonly.  Let's just ignore the ng-readonly
+                        // for now - with the way handleReadOnlyDisabled is currently written, this means we'll be unable to fully
+                        // support a datetime field with a string-typed "readonly" attribute and where fngAngular's elemSecurityFuncBinding
+                        // option is set up to "one-time" or "normal".
+                        if (rawDisabledStr) {
+                            disabledStr = "disabledDate=\"".concat(rawDisabledStr, "\" readonlyTime=\"").concat(rawDisabledStr, "\"");
                         }
-                        else if (!isNaN(parseFloat(retVal)) && isFinite(retVal)) {
-                            retVal = parseFloat(retVal);
+                    }
+                    catch (e) {
+                        // give up
+                    }
+                }
+                // finally, we should add the 'disableable' attribute(s), which might be present in rawDisabledAttrs[1] (regardless
+                // of whether or not the datetime picker is actually disabled) to indicate that it potentially could be
+                return disabledStr + " " + rawDisabledAttrs[1];
+            }
+            function extractFromAttr(attr, directiveName) {
+                function deserialize(str) {
+                    var retVal = str.replace(/&quot;/g, '"');
+                    if (retVal === "true") {
+                        return true;
+                    }
+                    else if (retVal === "false") {
+                        return false;
+                    }
+                    else {
+                        var num = parseFloat(retVal);
+                        if (!isNaN(num) && isFinite(num)) {
+                            return num;
+                        }
+                        else {
+                            return retVal;
                         }
-                        return retVal;
                     }
-                    var info = {};
-                    var options = { formStyle: attr.formstyle };
-                    var directiveOptions = {};
-                    var directiveNameLength = directiveName ? directiveName.length : 0;
-                    var lcDirectiveName = directiveName === null || directiveName === void 0 ? void 0 : directiveName.toLowerCase();
-                    for (var prop in attr) {
-                        if (attr.hasOwnProperty(prop)) {
-                            var lcProp = prop.toLowerCase();
-                            if (lcProp.slice(0, 6) === 'fngfld') {
-                                info[lcProp.slice(6)] = deserialize(attr[prop]);
-                            }
-                            else if (lcProp.slice(0, 6) === 'fngopt') {
-                                options[lcProp.slice(6)] = deserialize(attr[prop]);
-                            }
-                            else if (directiveName && lcProp.slice(0, directiveNameLength) === lcDirectiveName) {
-                                directiveOptions[_.kebabCase(prop.slice(directiveNameLength))] = deserialize(attr[prop]);
-                            }
+                }
+                var info = {};
+                var options = { formStyle: attr.formstyle };
+                var directiveOptions = {};
+                var directiveNameLength = directiveName ? directiveName.length : 0;
+                var lcDirectiveName = directiveName === null || directiveName === void 0 ? void 0 : directiveName.toLowerCase();
+                for (var prop in attr) {
+                    if (attr.hasOwnProperty(prop)) {
+                        var lcProp = prop.toLowerCase();
+                        if (lcProp.slice(0, 6) === "fngfld") {
+                            info[lcProp.slice(6)] = deserialize(attr[prop]);
+                        }
+                        else if (lcProp.slice(0, 6) === "fngopt") {
+                            options[lcProp.slice(6)] = deserialize(attr[prop]);
+                        }
+                        else if (directiveName && lcProp.slice(0, directiveNameLength) === lcDirectiveName) {
+                            directiveOptions[_.kebabCase(prop.slice(directiveNameLength))] = deserialize(attr[prop]);
                         }
                     }
-                    return { info: info, options: options, directiveOptions: directiveOptions };
-                },
-                buildInputMarkup: function buildInputMarkup(scope, model, info, options, addButtons, needsX, generateInputControl) {
-                    var fieldChrome = formMarkupHelper.fieldChrome(scope, info, options, ' id="cg_' + info.id + '"');
-                    var controlDivClasses = formMarkupHelper.controlDivClasses(options);
-                    var elementHtml = fieldChrome.template + formMarkupHelper.label(scope, info, addButtons, options);
-                    var modelString, idString, nameString;
-                    if (addButtons) {
-                        modelString = 'arrayItem' + (needsX ? '.x' : '');
-                        idString = info.id + '_{{$index}}';
-                        nameString = info.name + '_{{$index}}';
+                }
+                var result = { info: info, options: options, directiveOptions: directiveOptions };
+                // any part of the help text or label that is surrounded by @@ @@ is assumed to be something that can have
+                // a pseudonym.  We'll be relying upon the parent controller assigning a pseudo() function to baseScope to
+                // actually perform the translation.
+                // TODO - do this better when fng is re-written!
+                result.info.help = handlePseudos(result.info.help);
+                result.info.label = handlePseudos(result.info.label);
+                return result;
+            }
+            function genIdAndDisabledStr(scope, processedAttrs, idSuffix, params) {
+                var idStr = internalGenIdString(scope, processedAttrs, idSuffix, false);
+                var uniqueIdStr = makeIdStringUniqueForArrayElements(scope, processedAttrs, idStr);
+                return "id=\"".concat(uniqueIdStr, "\" ").concat(internalGenDisabledStr(scope, idStr, processedAttrs, idSuffix, params));
+            }
+            return {
+                extractFromAttr: extractFromAttr,
+                buildInputMarkup: function buildInputMarkup(scope, attrs, params, generateInputControl) {
+                    var processedAttrs = params.processedAttrs || extractFromAttr(attrs, "");
+                    var info = {};
+                    if (!params.ignoreFieldInfoFromAttrs) {
+                        Object.assign(info, processedAttrs.info);
                     }
-                    else {
-                        modelString = model + '.' + info.name;
-                        idString = info.id;
-                        nameString = info.name;
+                    if (params.fieldInfoOverrides) {
+                        Object.assign(info, params.fieldInfoOverrides);
+                    }
+                    var options = Object.assign({}, processedAttrs.options, params.optionOverrides);
+                    var fieldChrome = formMarkupHelper.fieldChrome(scope, info, options);
+                    if (fieldChrome.omit) {
+                        return "";
                     }
-                    if (options.subschema && info.name.indexOf('.') !== -1) {
+                    var controlDivClasses = formMarkupHelper.controlDivClasses(options);
+                    var elementHtml = fieldChrome.template + formMarkupHelper.label(scope, info, params.addButtons, options);
+                    var idString = info.id;
+                    if (info.array || options.subschema) {
+                        idString = formMarkupHelper.generateArrayElementIdString(idString, info, options);
+                    }
+                    var modelString = params.addButtons
+                        ? "arrayItem" + (params.needsX ? ".x" : "")
+                        : attrs.model + "." + info.name;
+                    var nameString = info.name;
+                    if (options.subschema && info.name.indexOf(".") !== -1) {
                         // Schema handling - need to massage the ngModel and the id
-                        var modelBase = model + '.';
-                        var compoundName = info.name;
+                        var modelBase = attrs.model + ".";
                         var root = options.subschemaroot;
-                        var lastPart = compoundName.slice(root.length + 1);
-                        modelString = modelBase;
-                        if (options.index) {
-                            modelString += root + '[' + options.index + '].' + lastPart;
-                            idString = 'f_' + modelString.slice(modelBase.length).replace(/(\.|\[|\]\.)/g, '-');
+                        var lastPart = info.name.slice(root.length + 1);
+                        modelString = modelBase + root;
+                        if (options.subkey) {
+                            idString = modelString.slice(modelBase.length).replace(/\./g, "-") + "-subkey" + options.subkeyno + "-" + lastPart;
+                            modelString += "[" + "$_arrayOffset_" + root.replace(/\./g, "_") + "_" + options.subkeyno + "]." + lastPart;
                         }
                         else {
-                            modelString += root;
-                            if (options.subkey) {
-                                idString = modelString.slice(modelBase.length).replace(/\./g, '-') + '-subkey' + options.subkeyno + '-' + lastPart;
-                                modelString += '[' + '$_arrayOffset_' + root.replace(/\./g, '_') + '_' + options.subkeyno + '].' + lastPart;
-                            }
-                            else {
-                                modelString += '[$index].' + lastPart;
-                                idString = null;
-                                nameString = compoundName.replace(/\./g, '-');
-                            }
+                            modelString += "[$index]." + lastPart;
+                            nameString = info.name.replace(/\./g, "-");
                         }
                     }
                     var buildingBlocks = formMarkupHelper.allInputsVars(scope, info, options, modelString, idString, nameString);
                     buildingBlocks.modelString = modelString;
-                    elementHtml += formMarkupHelper['handle' + (addButtons ? 'Array' : '') + 'InputAndControlDiv'](formMarkupHelper.inputChrome(generateInputControl(buildingBlocks), info, options, buildingBlocks), controlDivClasses, info, options);
+                    buildingBlocks.disableableAncestorStr = formMarkupHelper.genDisableableAncestorStr(info.id);
+                    // defer to the calling directive to generate the markup for the input(s)
+                    var inputHtml = generateInputControl(buildingBlocks);
+                    // wrap this in a div that puts it into the correct bootstrap 'column' and adds validation messages and help text
+                    var wrappedInputHtml = formMarkupHelper.inputChrome(inputHtml, info, options, buildingBlocks);
+                    // further wrap this to add the control div classes, and in the case of an array, the button that allows array elements to be removed
+                    if (params.addButtons) {
+                        elementHtml += formMarkupHelper.handleArrayInputAndControlDiv(wrappedInputHtml, controlDivClasses, scope, info, options);
+                    }
+                    else {
+                        elementHtml += formMarkupHelper.handleInputAndControlDiv(wrappedInputHtml, controlDivClasses);
+                    }
                     elementHtml += fieldChrome.closeTag;
                     return elementHtml;
                 },
-                findIdInSchemaAndFlagNeedX: function findIdInSchemaAndFlagNeedX(scope, id) {
-                    // Find the entry in the schema of scope for id and add a needsX property so string arrays are properly handled
-                    var foundIt = false;
-                    for (var i = 0; i < scope.length; i++) {
-                        var element = scope[i];
-                        if (element.id === id) {
-                            element.needsX = true;
-                            foundIt = true;
-                            break;
-                        }
-                        else if (element.schema) {
-                            if (findIdInSchemaAndFlagNeedX(element.schema, id)) {
-                                foundIt = true;
-                                break;
-                            }
-                        }
-                    }
-                    return foundIt;
+                genIdString: function genIdString(scope, processedAttrs, idSuffix) {
+                    return internalGenIdString(scope, processedAttrs, idSuffix, true);
+                },
+                genDisabledStr: function genDisabledStr(scope, processedAttrs, idSuffix, params) {
+                    var idString = internalGenIdString(scope, processedAttrs, idSuffix, false);
+                    return internalGenDisabledStr(scope, idString, processedAttrs, idSuffix, params);
+                },
+                genIdAndDisabledStr: genIdAndDisabledStr,
+                genDateTimePickerDisabledStr: function genDateTimePickerDisabledStr(scope, processedAttrs, idSuffix) {
+                    var idString = internalGenIdString(scope, processedAttrs, idSuffix, false);
+                    return internalGenDateTimePickerDisabledStr(scope, processedAttrs, idSuffix, idString);
+                },
+                genDateTimePickerIdAndDisabledStr: function genDateTimePickerIdAndDisabledStr(scope, processedAttrs, idSuffix) {
+                    var idStr = internalGenIdString(scope, processedAttrs, idSuffix, false);
+                    var uniqueIdStr = makeIdStringUniqueForArrayElements(scope, processedAttrs, idStr);
+                    return "id=\"".concat(uniqueIdStr, "\" ").concat(internalGenDateTimePickerDisabledStr(scope, processedAttrs, idSuffix, idStr));
+                },
+                genUiSelectIdAndDisabledStr: function genUiSelectIdAndDisabledStr(scope, processedAttrs, idSuffix) {
+                    // ui-select won't be disabled when a simple DISABLED attribute is provided - it requires
+                    // ng-disabled even when the value is simply "true"
+                    return genIdAndDisabledStr(scope, processedAttrs, idSuffix, { forceNg: true });
+                },
+                handlePseudos: handlePseudos,
+                genDisableableAncestorStr: function genDisableableAncestorStr(processedAttrs) {
+                    return formMarkupHelper.genDisableableAncestorStr(processedAttrs.info.id);
                 }
             };
         }
@@ -2822,8 +3259,8 @@ var fng;
          *
          */
         /*@ngInject*/
-        recordHandler.$inject = ["$location", "$window", "$filter", "$timeout", "routingService", "cssFrameworkService", "SubmissionsService", "SchemasService"];
-        function recordHandler($location, $window, $filter, $timeout, routingService, cssFrameworkService, SubmissionsService, SchemasService) {
+        recordHandler.$inject = ["$location", "$window", "$filter", "$timeout", "$sce", "routingService", "cssFrameworkService", "SubmissionsService", "SchemasService"];
+        function recordHandler($location, $window, $filter, $timeout, $sce, routingService, cssFrameworkService, SubmissionsService, SchemasService) {
             // TODO: Put this in a service
             var makeMongoId = function (rnd) {
                 if (rnd === void 0) { rnd = function (r16) { return Math.floor(r16).toString(16); }; }
@@ -3076,18 +3513,12 @@ var fng;
                         var idList = $scope[suffixCleanId(schemaEntry, "_ids")];
                         var thisConversion = void 0;
                         if (fieldValue && idList && idList.length > 0) {
-                            if (fieldName.indexOf(".") !== -1) {
-                                throw new Error("Trying to directly assign to a nested field 332");
-                            } // Not sure that this can happen, but put in a runtime test
                             if (
-                            /*
-                             Check we are starting with an ObjectId (ie not being called because of $watch on conversion, with a
-                             converted value, which would cause an exception)
-                             */
-                            fieldValue.toString().match(/^[a-f0-9]{24}$/) &&
-                                /*
-                                  We are not suppressing conversions
-                                 */
+                            // it's not a nested field
+                            !fieldName.includes(".") &&
+                                // Check we are starting with an ObjectId (ie not being called because of $watch on conversion, with a converted value, which would cause an exception)
+                                fieldValue.toString().match(/^[a-f0-9]{24}$/) &&
+                                // We are not suppressing conversions
                                 (!schemaEntry.internalRef || !schemaEntry.internalRef.noConvert)) {
                                 anObject[fieldName] = convertForeignKeys(schemaEntry, fieldValue, $scope[suffixCleanId(schemaEntry, "Options")], idList);
                             }
@@ -3436,7 +3867,7 @@ var fng;
             }
             function handleError($scope) {
                 return function (response) {
-                    if ([200, 400].indexOf(response.status) !== -1) {
+                    if ([200, 400, 403].indexOf(response.status) !== -1) {
                         var errorMessage = "";
                         if (response.data && response.data.errors) {
                             for (var errorField in response.data.errors) {
@@ -3460,6 +3891,9 @@ var fng;
                         else {
                             errorMessage = response.data.message || response.data._message || response.data.err || "Error!  Sorry - No further details available.";
                         }
+                        // anyone using a watch on $scope.phase, and waiting for it to become "ready" before proceeding, will probably
+                        // want to know that an error has occurred.  This value is NOT used anywhere in forms-angular.
+                        $scope.phase = "error";
                         $scope.showError(errorMessage);
                     }
                     else {
@@ -3522,12 +3956,22 @@ var fng;
                         find: $location.$$search.f,
                         limit: $scope.pageSize,
                         skip: pagesLoaded * $scope.pageSize,
-                        order: $location.$$search.o
+                        order: $location.$$search.o,
+                        concatenate: false
                     })
                         .then(function (response) {
                         var data = response.data;
                         if (angular.isArray(data)) {
-                            //  I have seen an intermittent problem where a page is requested twice
+                            // if the options for the resource identified by $scope.modelName has disambiguation parameters,
+                            // and that resource has more than one list field, the items returned by getPagedAndFilteredList
+                            // might include a "disambiguation" property.  for this to appear on the list page, we need
+                            // to add an item for it to the list schema
+                            if (!$scope.listSchema.find(function (f) { return f.name === "disambiguation"; }) && data.some(function (d) { return d.disambiguation; })) {
+                                $scope.listSchema.push({
+                                    name: "disambiguation",
+                                });
+                            }
+                            // I have seen an intermittent problem where a page is requested twice
                             if (pagesLoaded === $scope.pagesLoaded) {
                                 $scope.pagesLoaded++;
                                 $scope.recordList = $scope.recordList.concat(data);
@@ -3606,50 +4050,47 @@ var fng;
                 },
                 getListData: getListData,
                 suffixCleanId: suffixCleanId,
+                getData: getData,
                 setData: setData,
                 setUpLookupOptions: function setUpLookupOptions(lookupCollection, schemaElement, $scope, ctrlState, handleSchema) {
                     var optionsList = $scope[schemaElement.options] = [];
                     var idList = $scope[schemaElement.ids] = [];
-                    SchemasService.getSchema(lookupCollection)
+                    var dataRequest = !!schemaElement.filter
+                        ? SubmissionsService.getPagedAndFilteredList(lookupCollection, Object.assign({ concatenate: true }, schemaElement.filter)) // { concatenate: true } causes it to concatenate the list fields into the .text property of ILookupItem objects
+                        : SubmissionsService.getAllListAttributes(lookupCollection);
+                    dataRequest
                         .then(function (response) {
-                        var data = response.data;
-                        var listInstructions = [];
-                        handleSchema("Lookup " + lookupCollection, data, null, listInstructions, "", false, $scope, ctrlState);
-                        var dataRequest;
-                        if (typeof schemaElement.filter !== "undefined" && schemaElement.filter) {
-                            dataRequest = SubmissionsService.getPagedAndFilteredList(lookupCollection, schemaElement.filter);
-                        }
-                        else {
-                            dataRequest = SubmissionsService.getAll(lookupCollection);
-                        }
-                        dataRequest
-                            .then(function (response) {
-                            var data = angular.copy(response.data);
-                            if (data) {
-                                for (var i = 0; i < data.length; i++) {
-                                    var option = "";
-                                    for (var j = 0; j < listInstructions.length; j++) {
-                                        var thisVal = data[i][listInstructions[j].name];
-                                        option += thisVal ? thisVal + " " : "";
-                                    }
-                                    option = option.trim();
-                                    var pos = _.sortedIndex(optionsList, option);
-                                    // handle dupes (ideally people will use unique indexes to stop them but...)
-                                    if (optionsList[pos] === option) {
-                                        option = option + "    (" + data[i]._id + ")";
-                                        pos = _.sortedIndex(optionsList, option);
+                        var items = response.data;
+                        if (items) {
+                            items.sort(function (a, b) { return a.text.localeCompare(b.text); });
+                            optionsList.push.apply(optionsList, items.map(function (i) { return i.text; }));
+                            idList.push.apply(idList, items.map(function (i) { return i.id; }));
+                            var dupes = new Set();
+                            for (var i = 0; i < optionsList.length - 1; i++) {
+                                for (var j = i + 1; j < optionsList.length; j++) {
+                                    if (_.isEqual(optionsList[i], optionsList[j])) {
+                                        dupes.add(optionsList[i]);
                                     }
-                                    optionsList.splice(pos, 0, option);
-                                    idList.splice(pos, 0, data[i]._id);
                                 }
-                                if ($scope.readingRecord) {
-                                    $scope.readingRecord
-                                        .then(function () {
-                                        updateRecordWithLookupValues(schemaElement, $scope, ctrlState);
-                                    });
+                            }
+                            // append the id to any duplicates to make them unique
+                            dupes.forEach(function (d) {
+                                for (var i = 0; i < optionsList.length; i++) {
+                                    if (optionsList[i] === d) {
+                                        optionsList[i] += "(" + idList[i] + ")";
+                                    }
                                 }
+                            });
+                            if ($scope.readingRecord) {
+                                $scope.readingRecord
+                                    .then(function () {
+                                    updateRecordWithLookupValues(schemaElement, $scope, ctrlState);
+                                });
                             }
-                        });
+                        }
+                    })
+                        .catch(function (e) {
+                        $scope.handleHttpError(e);
                     });
                 },
                 setUpLookupListOptions: function setUpLookupListOptions(ref, formInstructions, $scope, ctrlState) {
@@ -3771,7 +4212,7 @@ var fng;
                     $scope.showError = function (error, alertTitle) {
                         $scope.alertTitle = alertTitle ? alertTitle : "Error!";
                         if (typeof error === "string") {
-                            $scope.errorMessage = error;
+                            $scope.errorMessage = $sce.trustAsHtml(error);
                         }
                         else if (!error) {
                             $scope.errorMessage = "An error occurred - that's all we got.  Sorry.";
@@ -3945,10 +4386,11 @@ var fng;
                         }
                     };
                     $scope.isCancelDisabled = function () {
+                        var _a;
                         if ($scope[$scope.topLevelFormName] && $scope[$scope.topLevelFormName].$pristine) {
                             return true;
                         }
-                        else if (typeof $scope.disableFunctions.isCancelDisabled === "function") {
+                        else if (typeof ((_a = $scope.disableFunctions) === null || _a === void 0 ? void 0 : _a.isCancelDisabled) === "function") {
                             return $scope.disableFunctions.isCancelDisabled($scope.record, ctrlState.master, $scope[$scope.topLevelFormName]);
                         }
                         else {
@@ -3956,6 +4398,7 @@ var fng;
                         }
                     };
                     $scope.isSaveDisabled = function () {
+                        var _a;
                         $scope.whyDisabled = undefined;
                         var pristine = false;
                         function generateWhyDisabledMessage(form, subFormName) {
@@ -4028,7 +4471,7 @@ var fng;
                         if (pristine || !!$scope.whyDisabled) {
                             return true;
                         }
-                        else if (typeof $scope.disableFunctions.isSaveDisabled !== "function") {
+                        else if (typeof ((_a = $scope.disableFunctions) === null || _a === void 0 ? void 0 : _a.isSaveDisabled) !== "function") {
                             return false;
                         }
                         else {
@@ -4043,10 +4486,11 @@ var fng;
                         }
                     };
                     $scope.isDeleteDisabled = function () {
+                        var _a;
                         if (!$scope.id) {
                             return true;
                         }
-                        else if (typeof $scope.disableFunctions.isDeleteDisabled === "function") {
+                        else if (typeof ((_a = $scope.disableFunctions) === null || _a === void 0 ? void 0 : _a.isDeleteDisabled) === "function") {
                             return $scope.disableFunctions.isDeleteDisabled($scope.record, ctrlState.master, $scope[$scope.topLevelFormName]);
                         }
                         else {
@@ -4054,7 +4498,8 @@ var fng;
                         }
                     };
                     $scope.isNewDisabled = function () {
-                        if (typeof $scope.disableFunctions.isNewDisabled === "function") {
+                        var _a;
+                        if (typeof ((_a = $scope.disableFunctions) === null || _a === void 0 ? void 0 : _a.isNewDisabled) === "function") {
                             return $scope.disableFunctions.isNewDisabled($scope.record, ctrlState.master, $scope[$scope.topLevelFormName]);
                         }
                         else {
@@ -4090,11 +4535,25 @@ var fng;
                         //}
                     };
                     $scope.sortableOptions = {
-                        update: function () {
-                            if ($scope.topLevelFormName) {
+                        update: function (e, ui) {
+                            if (e.target.hasAttribute("disabled")) {
+                                // where formsAngular.elemSecurityFuncBinding is set to "one-time" or "normal", the <ol> that the
+                                // ui-sortable directive has been used with will have an ng-disabled that may or may not have caused
+                                // a disabled attribute to be added to that element.  in the case where this attribute has been
+                                // added, sorting should be prevented.
+                                // allowing the user to begin the drag, and then preventing it only once they release the mouse button,
+                                // doesn't seem like the best solution, but I've yet to find something that works better.  the
+                                // cancel property (see commented-out code below) looks like it should work (and kind of does), but this
+                                // screws up mouse events on input fields hosted within the draggable <li> items, so you're
+                                // basically prevented from updating any form element in the nested schema
+                                ui.item.sortable.cancel();
+                            }
+                            else if ($scope.topLevelFormName) {
                                 $scope[$scope.topLevelFormName].$setDirty();
                             }
-                        }
+                        },
+                        // don't do this (see comment above)
+                        //cancel: "ol[disabled]>li"
                     };
                     $scope.setUpCustomLookupOptions = function (schemaElement, ids, options, baseScope) {
                         for (var _i = 0, _a = [$scope, baseScope]; _i < _a.length; _i++) {
@@ -4145,6 +4604,222 @@ var fng;
     })(services = fng.services || (fng.services = {}));
 })(fng || (fng = {}));
 /// <reference path="../../../../node_modules/@types/angular/index.d.ts" />
+var fng;
+(function (fng) {
+    var services;
+    (function (services) {
+        /*@ngInject*/
+        securityService.$inject = ["$rootScope"];
+        function securityService($rootScope) {
+            function canDoSecurity(type) {
+                return (!!fng.formsAngular.elemSecurityFuncBinding &&
+                    ((type === "hidden" && !!fng.formsAngular.hiddenSecurityFuncName) ||
+                        (type === "disabled" && !!fng.formsAngular.disabledSecurityFuncName)));
+            }
+            function canDoSecurityNow(scope, type) {
+                return (canDoSecurity(type) && // we have security configured
+                    (
+                    // the host app has not (temporarily) disabled this security type (which it might do, as an optimisation, when there are
+                    // currently no security rules to apply); and 
+                    // it has provided the callbacks that are specified in the security configuration; and
+                    // the provided scope (if any) has been decorated (by us).  pages and popups which aren't form controllers will need to use
+                    // (either directly, or through formMarkupHelper), the decorateSecurableScope() function below
+                    (type === "hidden" &&
+                        $rootScope[fng.formsAngular.hiddenSecurityFuncName] &&
+                        (!scope || !!scope.isSecurelyHidden))
+                        ||
+                            (type === "disabled" &&
+                                $rootScope[fng.formsAngular.disabledSecurityFuncName] &&
+                                (!scope || !!scope.isSecurelyDisabled))));
+            }
+            function isSecurelyHidden(elemId, pseudoUrl) {
+                return $rootScope[fng.formsAngular.hiddenSecurityFuncName](elemId, pseudoUrl);
+            }
+            function getSecureDisabledState(elemId, pseudoUrl) {
+                return $rootScope[fng.formsAngular.disabledSecurityFuncName](elemId, pseudoUrl);
+            }
+            function isSecurelyDisabled(elemId, pseudoUrl) {
+                return !!getSecureDisabledState(elemId, pseudoUrl); // either true or "+"
+            }
+            function getBindingStr() {
+                return fng.formsAngular.elemSecurityFuncBinding === "one-time" ? "::" : "";
+            }
+            function ignoreElemId(elemId) {
+                var _a;
+                return (_a = fng.formsAngular.ignoreIdsForHideableOrDisableableAttrs) === null || _a === void 0 ? void 0 : _a.some(function (id) { return elemId.includes(id); });
+            }
+            function getXableAttrs(elemId, attr) {
+                if (elemId && attr && !ignoreElemId(elemId)) {
+                    return " ".concat(attr, " title=\"").concat(elemId, "\"");
+                }
+                else {
+                    return "";
+                }
+            }
+            function getDisableableAttrs(elemId) {
+                // even when an element should not actually be disabled, we should still mark what would otherwise have been a
+                // potentially-disabled element with scope.disableableAttr - where this is set - and where it is set, also set its
+                // title to be the same as its id so that users can learn of its id by hovering over it.  this will
+                // help anyone trying to figure out what is the right element id to use for a DOM security rule
+                return getXableAttrs(elemId, fng.formsAngular.disableableAttr);
+            }
+            function getDisableableAncestorAttrs(elemId) {
+                // even when an element should not actually be disabled, we should still mark what would otherwise have been a
+                // potentially-disabled element with scope.disableableAttr - where this is set - and where it is set, also set its
+                // title to be the same as its id so that users can learn of its id by hovering over it.  this will
+                // help anyone trying to figure out what is the right element id to use for a DOM security rule
+                return getXableAttrs(elemId, fng.formsAngular.disableableAncestorAttr);
+            }
+            function getHideableAttrs(elemId) {
+                // even when canDoSecurityNow() returns false, we should still mark what would otherwise have been a
+                // potentially-hidden element with scope.hideableAttr, where this is set, and where it is set, also set its
+                // title to be the same as its id so that users can learn of its id by hovering over it.  this will
+                // help anyone trying to figure out what is the right element id to use for a DOM security rule
+                return getXableAttrs(elemId, fng.formsAngular.hideableAttr);
+            }
+            return {
+                canDoSecurity: canDoSecurity,
+                canDoSecurityNow: canDoSecurityNow,
+                isSecurelyHidden: isSecurelyHidden,
+                isSecurelyDisabled: isSecurelyDisabled,
+                getHideableAttrs: getHideableAttrs,
+                getDisableableAttrs: getDisableableAttrs,
+                getDisableableAncestorAttrs: getDisableableAncestorAttrs,
+                // whilst initialising new pages and popups, pass their scope here for decoration with functions that can be used to check
+                // the disabled / hidden state of DOM elements on that page according to the prevailing security rules.
+                // if the host app indicates that security checks should be skipped for this page, we will NOT assign the corresponding
+                // functions.  the presence of these functions will be checked later by canDoSecurityNow(), which will always be called
+                // before any security logic is applied.  this allows security to be bypassed entirely at the request of the host app,
+                // providing an opportunity for optimisation.
+                decorateSecurableScope: function (securableScope, params) {
+                    if (canDoSecurity("hidden") && (!fng.formsAngular.skipHiddenSecurityFuncName || (params === null || params === void 0 ? void 0 : params.overrideSkipping) || !$rootScope[fng.formsAngular.skipHiddenSecurityFuncName](params === null || params === void 0 ? void 0 : params.pseudoUrl))) {
+                        securableScope.isSecurelyHidden = function (elemId) {
+                            return isSecurelyHidden(elemId, params === null || params === void 0 ? void 0 : params.pseudoUrl);
+                        };
+                    }
+                    if (canDoSecurity("disabled") && (!fng.formsAngular.skipDisabledSecurityFuncName || (params === null || params === void 0 ? void 0 : params.overrideSkipping) || !$rootScope[fng.formsAngular.skipDisabledSecurityFuncName](params === null || params === void 0 ? void 0 : params.pseudoUrl))) {
+                        securableScope.isSecurelyDisabled = function (elemId) {
+                            return isSecurelyDisabled(elemId, params === null || params === void 0 ? void 0 : params.pseudoUrl);
+                        };
+                        if (!fng.formsAngular.skipDisabledAncestorSecurityFuncName || (params === null || params === void 0 ? void 0 : params.overrideSkipping) || !$rootScope[fng.formsAngular.skipDisabledAncestorSecurityFuncName](params === null || params === void 0 ? void 0 : params.pseudoUrl)) {
+                            securableScope.requiresDisabledChildren = function (elemId) {
+                                return getSecureDisabledState(elemId, params === null || params === void 0 ? void 0 : params.pseudoUrl) === "+";
+                            };
+                        }
+                    }
+                },
+                doSecurityWhenReady: function (cb) {
+                    if (canDoSecurityNow(undefined, "hidden")) {
+                        cb();
+                    }
+                    else if (canDoSecurity("hidden")) {
+                        // wait until the hidden security function has been provided (externally) before proceeding with the callback...
+                        // we assume here that the hidden security and disabled security functions are both going to be provided at the
+                        // same time (and could therefore watch for either of these things)
+                        var unwatch_2 = $rootScope.$watch(fng.formsAngular.hiddenSecurityFuncName, function (newValue) {
+                            if (newValue) {
+                                unwatch_2();
+                                cb();
+                            }
+                        });
+                    }
+                },
+                considerVisibility: function (id, scope) {
+                    var hideableAttrs = getHideableAttrs(id);
+                    if (canDoSecurityNow(scope, "hidden")) {
+                        if (fng.formsAngular.elemSecurityFuncBinding === "instant") {
+                            if (scope.isSecurelyHidden(id)) {
+                                // if our securityFunc supports instant binding and evaluates to true, then nothing needs to be
+                                // added to the dom for this field, which we indicate to our caller as follows...
+                                return { omit: true };
+                            }
+                        }
+                        else {
+                            return { visibilityAttr: "data-ng-if=\"".concat(getBindingStr(), "!isSecurelyHidden('").concat(id, "')\"").concat(hideableAttrs) };
+                        }
+                    }
+                    return { visibilityAttr: hideableAttrs };
+                },
+                // consider the visibility of a container whose visibility depends upon at least some of its content being visible.
+                // the container is assumed not to itself be securable (hence it doesn't have an id - or at least, not one we're
+                // concerned about - and it doesn't itself need a "hideable" attribute) 
+                considerContainerVisibility: function (contentIds, scope) {
+                    if (canDoSecurityNow(scope, "hidden")) {
+                        if (fng.formsAngular.elemSecurityFuncBinding === "instant") {
+                            if (contentIds.some(function (id) { return !scope.isSecurelyHidden(id); })) {
+                                return {};
+                            }
+                            else {
+                                return { omit: true };
+                            }
+                        }
+                        else {
+                            var attrs = contentIds.map(function (id) { return "!isSecurelyHidden('".concat(id, "')"); });
+                            return { visibilityAttr: "data-ng-if=\"".concat(getBindingStr(), "(").concat(attrs.join(" || "), ")\"") };
+                        }
+                    }
+                    return {};
+                },
+                // Generate an attribute that could be added to the element with the given id to enable or disable it
+                // according to the prevailing security rules.  In most cases, the attribute will either be "disabled"
+                // (in the case of 'instant' binding) or data-ng-disabled="xxxx" (in the case of one-time or normal
+                // binding).  For directives that require something different, use params:
+                //  - forceNg will wrap a positive (disabled) result in an angular directive (e.g., data-ng-disabled="true")
+                //    rather than returning simply "disabled"
+                //  - attrRequiresValue will translate a positive (disabled) result into an attribute with a truthy value
+                //    (e.g., disabled="true") rather than returning simply "disabled"
+                //  - attr can be used in the case where a directive expects an attribute other than "disabled".
+                //    (for example, uib-tab expects "disable").
+                // Even if the element is not be disabled on this occasion, we will always return the value of
+                // fng.formsAngular.disableableAttr - where set - as a way of marking it as potentially disableable.
+                // Because they can also have a readonly attribute which needs to be taken into consideration, this
+                // function is NOT suitable for fields, which are instead handled by fieldformMarkupHelper.handleReadOnlyDisabled().
+                generateDisabledAttr: function (id, scope, params) {
+                    function getActuallyDisabledAttrs() {
+                        var result = "";
+                        if (canDoSecurityNow(scope, "disabled")) {
+                            if (!params) {
+                                params = {};
+                            }
+                            if (params.attrRequiresValue && params.forceNg) {
+                                throw new Error("Invalid combination of parameters provided to generateDisabledAttr() [attrRequiresValue and forceNg]");
+                            }
+                            var attr = params.attr || "disabled";
+                            if (fng.formsAngular.elemSecurityFuncBinding === "instant") {
+                                if (scope.isSecurelyDisabled(id)) {
+                                    if (params.attrRequiresValue) {
+                                        return " ".concat(attr, "=\"true\"");
+                                    }
+                                    else if (params.forceNg) {
+                                        result = "true";
+                                    }
+                                    else {
+                                        return " ".concat(attr);
+                                    }
+                                }
+                            }
+                            else {
+                                result = "".concat(getBindingStr(), "isSecurelyDisabled('").concat(id, "')");
+                            }
+                            if (result) {
+                                if (attr === "disabled") {
+                                    return " data-ng-disabled=\"".concat(result, "\"");
+                                }
+                                else {
+                                    return " data-ng-attr-".concat(attr, "=\"").concat(result, "\"");
+                                }
+                            }
+                        }
+                        return result;
+                    }
+                    return getActuallyDisabledAttrs() + getDisableableAttrs(id);
+                },
+            };
+        }
+        services.securityService = securityService;
+    })(services = fng.services || (fng.services = {}));
+})(fng || (fng = {}));
+/// <reference path="../../../../node_modules/@types/angular/index.d.ts" />
 var ExpirationCache = /** @class */ (function () {
     function ExpirationCache(timeout) {
         if (timeout === void 0) { timeout = 60 * 1000; }
@@ -4190,9 +4865,11 @@ var fng;
              {
              aggregate - whether or not to aggregate results (http://docs.mongodb.org/manual/aggregation/)
              find - find parameter
+             projection - the fields to return
              limit - limit results to this number of records
              skip - skip this number of records before returning results
              order - sort order
+             concatenate - whether to concatenate all of the list fields into a single text field (and return { id, text }[]), or not (in which case the documents - albeit only list fields and _id - are returned without transformation)
              }
              */
             var generateListQuery = function (options) {
@@ -4213,9 +4890,11 @@ var fng;
                 };
                 addParameter('l', options.limit);
                 addParameter('f', options.find);
+                addParameter('p', options.projection);
                 addParameter('a', options.aggregate);
                 addParameter('o', options.order);
                 addParameter('s', options.skip);
+                addParameter('c', options.concatenate);
                 return queryString;
             };
             // TODO Figure out tab history updates (check for other tab-history-todos)
@@ -4240,12 +4919,35 @@ var fng;
                 //           changed: changed
                 //         };
                 //       },
-                getListAttributes: function (ref, id) {
+                // return only the list attributes for the given record.  where returnRaw is true, the record's
+                // list attributes will be returned without transformation.  otherwise, the list attributes will be concatenated
+                // (with spaces) and returned in the form { list: string }
+                getListAttributes: function (ref, id, returnRaw) {
                     var actualId = typeof id === "string" ? id : id.id || id._id || id.x || id;
-                    if (typeof actualId !== "string") {
-                        throw new Error("getListAttributes requires a string id but was provided with ".concat(JSON.stringify(id)));
+                    if (typeof actualId === "object") {
+                        throw new Error("getListAttributes doesn't expect an object but was provided with ".concat(JSON.stringify(id)));
+                    }
+                    var queryString = returnRaw ? "?returnRaw=1" : "";
+                    return $http.get("/api/".concat(ref, "/").concat(actualId, "/list").concat(queryString), { cache: expCache });
+                },
+                // return only the list attributes for ALL records in the given collection, returning ILookupItem[]
+                getAllListAttributes: function (ref) {
+                    return $http.get("/api/".concat(ref, "/listAll"), { cache: expCache });
+                },
+                // return only the list attributes for records in the given collection that satisfy the given query conditions (filter, limit etc.)
+                // return ILookupItem[] if options.concatenate is true, else the raw documents
+                getPagedAndFilteredList: function (ref, options) {
+                    if (options.projection) {
+                        throw new Error("Cannot use projection option for getPagedAndFilteredList, because it only returns list fields");
                     }
-                    return $http.get('/api/' + ref + '/' + actualId + '/list', { cache: expCache });
+                    if (options.concatenate === undefined) {
+                        options.concatenate = false;
+                    }
+                    return $http.get("/api/".concat(ref, "/listAll").concat(generateListQuery(options)));
+                },
+                // return ALL attributes for records in the given collection that satisfy the given query conditions (filter, limit etc.)
+                getPagedAndFilteredListFull: function (ref, options) {
+                    return $http.get("/api/".concat(ref).concat(generateListQuery(options)));
                 },
                 readRecord: function (modelName, id) {
                     // TODO Figure out tab history updates (check for other tab-history-todos)
@@ -4253,7 +4955,11 @@ var fng;
                     //         if (tabChangeData && tabChangeData.model === modelName && tabChangeData.id === id) {
                     //           retVal = Promise.resolve({data:tabChangeData.record, changed: tabChangeData.changed, master: tabChangeData.master});
                     //         } else {
-                    return $http.get('/api/' + modelName + '/' + id);
+                    var actualId = typeof id === "string" ? id : id.id || id._id || id.x || id;
+                    if (typeof actualId === "object") {
+                        throw new Error("readRecord doesn't expect an object but was provided with ".concat(JSON.stringify(id)));
+                    }
+                    return $http.get("/api/".concat(modelName, "/").concat(actualId));
                     //           retVal = $http.get('/api/' + modelName + '/' + id);
                     //         }
                     //         tabChangeData = null;
@@ -4263,21 +4969,18 @@ var fng;
                     var options = angular.extend({
                         cache: useCacheForGetAll ? expCache : false
                     }, _options);
-                    return $http.get('/api/' + modelName, options);
-                },
-                getPagedAndFilteredList: function (modelName, options) {
-                    return $http.get('/api/' + modelName + generateListQuery(options));
+                    return $http.get("/api/".concat(modelName), options);
                 },
                 deleteRecord: function (model, id) {
-                    return $http.delete('/api/' + model + '/' + id);
+                    return $http.delete("/api/".concat(model, "/").concat(id));
                 },
                 updateRecord: function (modelName, id, dataToSave) {
-                    expCache.remove('/api/' + modelName);
-                    return $http.post('/api/' + modelName + '/' + id, dataToSave);
+                    expCache.remove("/api/".concat(modelName));
+                    return $http.post("/api/".concat(modelName, "/").concat(id), dataToSave);
                 },
                 createRecord: function (modelName, dataToSave) {
-                    expCache.remove('/api/' + modelName);
-                    return $http.post('/api/' + modelName, dataToSave);
+                    expCache.remove("/api/".concat(modelName));
+                    return $http.post("/api/".concat(modelName), dataToSave);
                 },
                 useCache: function (val) {
                     useCacheForGetAll = val;
@@ -4409,11 +5112,14 @@ var fng;
     var controllers;
     (function (controllers) {
         /*@ngInject*/
-        NavCtrl.$inject = ["$rootScope", "$window", "$scope", "$location", "$filter", "routingService", "cssFrameworkService"];
-        function NavCtrl($rootScope, $window, $scope, $location, $filter, routingService, cssFrameworkService) {
+        NavCtrl.$inject = ["$rootScope", "$window", "$scope", "$filter", "routingService", "cssFrameworkService", "securityService"];
+        function NavCtrl($rootScope, $window, $scope, $filter, routingService, cssFrameworkService, securityService) {
             function clearContextMenu() {
                 $scope.items = [];
                 $scope.contextMenu = undefined;
+                $scope.contextMenuId = undefined;
+                $scope.contextMenuHidden = undefined;
+                $scope.contextMenuDisabled = undefined;
             }
             $rootScope.navScope = $scope; // Lets plugins access menus
             clearContextMenu();
@@ -4491,11 +5197,25 @@ var fng;
                 }
                 return result;
             };
+            function initialiseContextMenu(menuCaption) {
+                $scope.contextMenu = menuCaption;
+                var menuId = "".concat(_.camelCase(menuCaption), "ContextMenu");
+                // the context menu itself (see dropdown.ts) has an ng-if that checks for a value of
+                // contextMenuId.  let's delete this until we know we're ready to evaluate the security
+                // of the menu items...
+                $scope.contextMenuId = undefined;
+                securityService.doSecurityWhenReady(function () {
+                    //... which we now are
+                    $scope.contextMenuId = menuId;
+                    $scope.contextMenuHidden = securityService.isSecurelyHidden($scope.contextMenuId);
+                    $scope.contextMenuDisabled = securityService.isSecurelyDisabled($scope.contextMenuId);
+                });
+            }
             $scope.$on('fngControllersLoaded', function (evt, sharedData, modelName) {
-                $scope.contextMenu = sharedData.dropDownDisplay || sharedData.modelNameDisplay || $filter('titleCase')(modelName, false);
+                initialiseContextMenu(sharedData.dropDownDisplay || sharedData.modelNameDisplay || $filter('titleCase')(modelName, false));
                 if (sharedData.dropDownDisplayPromise) {
                     sharedData.dropDownDisplayPromise.then(function (value) {
-                        $scope.contextMenu = value;
+                        initialiseContextMenu(value);
                     });
                 }
             });
@@ -4544,8 +5264,9 @@ var fng;
                     return item.isHidden ? item.isHidden() : false;
                 }
                 var dividerHide = false;
+                var item = $scope.items[index];
                 // Hide a divider if it appears under another
-                if ($scope.items[index].divider) {
+                if (item.divider) {
                     if (index === 0) {
                         dividerHide = true;
                     }
@@ -4565,7 +5286,7 @@ var fng;
                         }
                     }
                 }
-                return dividerHide || explicitlyHidden($scope.items[index]);
+                return dividerHide || explicitlyHidden(item);
             };
             $scope.isDisabled = function (index) {
                 return $scope.items[index].isDisabled ? $scope.items[index].isDisabled() : false;
@@ -4651,7 +5372,8 @@ var fng;
         .factory('pluginHelper', fng.services.pluginHelper)
         .factory('recordHandler', fng.services.recordHandler)
         .factory('SchemasService', fng.services.SchemasService)
-        .factory('SubmissionsService', fng.services.SubmissionsService);
+        .factory('SubmissionsService', fng.services.SubmissionsService)
+        .factory('securityService', fng.services.securityService);
 })(fng || (fng = {}));
 // expose the library
 var formsAngular = fng.formsAngular;