forms-angular 0.12.0-beta.193 → 0.12.0-beta.194

package/dist/client/forms-angular.js

@@ -4,38 +4,44 @@ var fng;
     var directives;
     (function (directives) {
         /*@ngInject*/
-        function modelControllerDropdown() {
+        modelControllerDropdown.$inject = ["securityService"];
+        function modelControllerDropdown(securityService) {
             var menuVisibilityStr;
             var menuDisabledStr;
             var itemVisibilityStr = "isHidden($index)";
-            var itemClassStr = "ng-class=\"dropdownClass($index)\"";
-            if (fng.formsAngular.elemSecurityFuncBinding) {
-                // without a more fundamental re-write, we cannot support "instant" binding here, so we'll fall-back to using
-                // the next-best alternative, which is one-time binding
-                var oneTimeBinding = fng.formsAngular.elemSecurityFuncBinding !== "normal";
-                var bindingStr = oneTimeBinding ? "::" : "";
-                // as ng-class is already being used, we'll add the .disabled class if the menu item is securely disabled using
-                // class="{{ }}".  note that we "prevent" a disabled menu item from being clicked by checking for the DISABLED
-                // attribute in the doClick(...) function, and aborting if this is found.
-                // note that the 'normal' class introduced here might not actually do anything, but for one-time binding to work
-                // properly, we need a truthy value
-                itemClassStr += " class=\"{{ ".concat(bindingStr, "isSecurelyDisabled(choice.id) ? 'disabled' : 'normal' }}\"");
+            var itemDisabledStr = "ng-class=\"dropdownClass($index)\"";
+            // without a more fundamental re-write, we cannot support "instant" binding here, so we'll fall-back to using
+            // the next-best alternative, which is one-time binding
+            var oneTimeBinding = fng.formsAngular.elemSecurityFuncBinding !== "normal";
+            var bindingStr = oneTimeBinding ? "::" : "";
+            if (securityService.canDoSecurity("hidden")) {
+                menuVisibilityStr = "ng-if=\"contextMenuId && !contextMenuHidden\" ".concat(securityService.getHideableAttrs('{{ ::contextMenuId }}'));
                 if (oneTimeBinding) {
                     // because the isHidden(...) logic is highly likely to be model dependent, that cannot be one-time bound.  to
                     // be able to combine one-time and regular binding, we'll use ng-if for the one-time bound stuff and ng-hide for the rest
-                    itemVisibilityStr = "ng-if=\"::!isSecurelyHidden(choice.id)\" ng-hide=\"".concat(itemVisibilityStr, "\"");
+                    itemVisibilityStr = "ng-if=\"::(choice.divider || !isSecurelyHidden(choice.id))\" ng-hide=\"".concat(itemVisibilityStr, "\"");
                 }
                 else if (fng.formsAngular.elemSecurityFuncBinding === "normal") {
-                    itemVisibilityStr = "ng-hide=\"isSecurelyHidden(choice.id) || ".concat(itemVisibilityStr, "\"");
+                    itemVisibilityStr = "ng-hide=\"".concat(itemVisibilityStr, " || (!choice.divider && isSecurelyHidden(choice.id))\"");
                 }
-                menuVisibilityStr = "ng-if=\"!contextMenuHidden\"";
-                menuDisabledStr = "disableable-link ng-disabled=\"contextMenuDisabled\"";
+                itemVisibilityStr += " ".concat(securityService.getHideableAttrs('{{ ::choice.id }}'));
             }
             else {
                 menuVisibilityStr = "";
-                menuDisabledStr = "";
                 itemVisibilityStr = "ng-hide=\"".concat(itemVisibilityStr, "\"");
             }
+            if (securityService.canDoSecurity("disabled")) {
+                menuDisabledStr = "disableable-link ng-disabled=\"contextMenuDisabled\" ".concat(securityService.getDisableableAttrs('{{ ::contextMenuId }}'));
+                // as ng-class is already being used, we'll add the .disabled class if the menu item is securely disabled using
+                // class="{{ }}".  note that we "prevent" a disabled menu item from being clicked by checking for the DISABLED
+                // attribute in the doClick(...) function, and aborting if this is found.
+                // note that the 'normal' class introduced here might not actually do anything, but for one-time binding to work
+                // properly, we need a truthy value
+                itemDisabledStr += " class=\"{{ ".concat(bindingStr, "(!choice.divider && isSecurelyDisabled(choice.id)) ? 'disabled' : 'normal' }}\" ").concat(securityService.getDisableableAttrs('{{ ::choice.id }}'));
+            }
+            else {
+                menuDisabledStr = "";
+            }
             return {
                 restrict: "AE",
                 replace: true,
@@ -44,7 +50,7 @@ var fng;
                     '  {{contextMenu}} <b class="caret"></b>' +
                     " </a>" +
                     ' <ul class="uib-dropdown-menu dropdown-menu">' +
-                    "  <li ng-repeat=\"choice in items\" ng-attr-id=\"{{choice.id}}\" ".concat(itemVisibilityStr, " ").concat(itemClassStr, ">") +
+                    "  <li ng-repeat=\"choice in items\" ng-attr-id=\"{{choice.id}}\" ".concat(itemVisibilityStr, " ").concat(itemDisabledStr, ">") +
                     '   <a ng-show="choice.text || choice.textFunc" class="dropdown-option" ng-href="{{choice.url || choice.urlFunc()}}" ng-click="doClick($index, $event)">' +
                     "    {{ choice.text || choice.textFunc() }}" +
                     "   </a>" +
@@ -267,7 +273,7 @@ var fng;
 (function (fng) {
     var directives;
     (function (directives) {
-        formInput.$inject = ["$compile", "$rootScope", "$filter", "$timeout", "cssFrameworkService", "formGenerator", "formMarkupHelper"];
+        formInput.$inject = ["$compile", "$rootScope", "$filter", "$timeout", "cssFrameworkService", "formGenerator", "formMarkupHelper", "securityService"];
         var tabsSetupState;
         (function (tabsSetupState) {
             tabsSetupState[tabsSetupState["Y"] = 0] = "Y";
@@ -275,7 +281,7 @@ var fng;
             tabsSetupState[tabsSetupState["Forced"] = 2] = "Forced";
         })(tabsSetupState || (tabsSetupState = {}));
         /*@ngInject*/
-        function formInput($compile, $rootScope, $filter, $timeout, cssFrameworkService, formGenerator, formMarkupHelper) {
+        function formInput($compile, $rootScope, $filter, $timeout, cssFrameworkService, formGenerator, formMarkupHelper, securityService) {
             return {
                 restrict: 'EA',
                 link: function (scope, element, attrs) {
@@ -390,7 +396,7 @@ var fng;
                                     value = '<input placeholder="fng-select2 has been removed" readonly>';
                                 }
                                 else {
-                                    common += formMarkupHelper.handleReadOnlyDisabled(fieldInfo);
+                                    common += formMarkupHelper.handleReadOnlyDisabled(fieldInfo, scope).join(" ");
                                     common += fieldInfo.add ? (' ' + fieldInfo.add + ' ') : '';
                                     common += " aria-label=\"".concat(fieldInfo.label && fieldInfo.label !== "" ? fieldInfo.label : fieldInfo.name, "\" ");
                                     value = '<select ' + common + 'class="' + allInputsVars.formControl.trim() + allInputsVars.compactClass + allInputsVars.sizeClassBS2 + '" ' + requiredStr + '>';
@@ -444,7 +450,8 @@ var fng;
                             case 'radio':
                                 value = '';
                                 common += requiredStr;
-                                common += formMarkupHelper.handleReadOnlyDisabled(fieldInfo);
+                                common += formMarkupHelper.handleReadOnlyDisabled(fieldInfo, scope).join(" ");
+                                ;
                                 common += fieldInfo.add ? (' ' + fieldInfo.add + ' ') : '';
                                 var separateLines = options.formstyle === 'vertical' || (options.formstyle !== 'inline' && !fieldInfo.inlineRadio);
                                 if (angular.isArray(fieldInfo.options)) {
@@ -475,7 +482,8 @@ var fng;
                                 break;
                             case 'checkbox':
                                 common += requiredStr;
-                                common += formMarkupHelper.handleReadOnlyDisabled(fieldInfo);
+                                common += formMarkupHelper.handleReadOnlyDisabled(fieldInfo, scope).join(" ");
+                                ;
                                 common += fieldInfo.add ? (' ' + fieldInfo.add + ' ') : '';
                                 value = formMarkupHelper.generateSimpleInput(common, fieldInfo, options);
                                 if (cssFrameworkService.framework() === 'bs3') {
@@ -484,7 +492,8 @@ var fng;
                                 break;
                             default:
                                 common += formMarkupHelper.addTextInputMarkup(allInputsVars, fieldInfo, requiredStr);
-                                common += formMarkupHelper.handleReadOnlyDisabled(fieldInfo);
+                                common += formMarkupHelper.handleReadOnlyDisabled(fieldInfo, scope).join(" ");
+                                ;
                                 if (fieldInfo.type === 'textarea') {
                                     if (fieldInfo.rows) {
                                         if (fieldInfo.rows === 'auto') {
@@ -534,11 +543,12 @@ var fng;
                         return result;
                     };
                     var containerInstructions = function (info) {
-                        var result = { before: '', after: '' };
+                        var result;
                         if (typeof info.containerType === 'function') {
                             result = info.containerType(info);
                         }
                         else {
+                            result = {};
                             switch (info.containerType) {
                                 case 'tab':
                                     var tabNo = -1;
@@ -551,12 +561,26 @@ var fng;
                                     if (tabNo >= 0) {
                                         // TODO Figure out tab history updates (check for other tab-history-todos)
                                         // result.before = '<uib-tab deselect="tabDeselect($event, $selectedIndex)" select="updateQueryForTab(\'' + info.title + '\')" heading="' + info.title + '"'
-                                        result.before = '<uib-tab deselect="tabDeselect($event, $selectedIndex)" select="updateQueryForTab(\'' + info.title + '\')" heading="' + info.title + '"';
-                                        if (tabNo > 0) {
-                                            result.before += 'active="tabs[' + tabNo + '].active"';
+                                        var idStr = "".concat(_.camelCase(info.title), "Tab");
+                                        var visibility = securityService.considerVisibility(idStr, scope);
+                                        if (visibility.omit) {
+                                            // we already know this field should be invisible, so we needn't add anything for it
+                                            result.omit = true;
+                                        }
+                                        else {
+                                            var attrs_1 = "id=\"".concat(idStr, "\"");
+                                            if (visibility.visibilityAttr) {
+                                                // an angular expression to determine the visibility of this field later...
+                                                attrs_1 += " ".concat(visibility.visibilityAttr);
+                                            }
+                                            attrs_1 += securityService.generateDisabledAttr(idStr, scope, { attr: "disable", attrRequiresValue: true }); // uib-tab expects 'disable="true"` rather than 'disabled="true"' or just disabled
+                                            result.before = "<uib-tab ".concat(attrs_1, " deselect=\"tabDeselect($event, $selectedIndex)\" select=\"updateQueryForTab('").concat(info.title, "')\" heading=\"").concat(info.title, "\"");
+                                            if (tabNo > 0) {
+                                                result.before += 'active="tabs[' + tabNo + '].active"';
+                                            }
+                                            result.before += '>';
+                                            result.after = '</uib-tab>';
                                         }
-                                        result.before += '>';
-                                        result.after = '</uib-tab>';
                                     }
                                     else {
                                         result.before = '<p>Error!  Tab ' + info.title + ' not found in tab list</p>';
@@ -708,7 +732,10 @@ var fng;
                                         if (info.formStyle === "inline" && info.inlineHeaders) {
                                             template += generateInlineHeaders(info.schema, options, model, info.inlineHeaders === "always");
                                         }
-                                        var disableCond = formMarkupHelper.handleReadOnlyDisabled(info);
+                                        // handleReadOnlyDisabled() returns two strings - the 'disabled' attribute(s), and the 'disableable'
+                                        // attributes.  for the purpose of deciding if / how to disable sorting if the list itself is
+                                        // disabled, we're only interested in the former...
+                                        var disableCond = formMarkupHelper.handleReadOnlyDisabled(info, scope)[0];
                                         // if we already know that the field is disabled (only possible when formsAngular.elemSecurityFuncBinding === "instant")
                                         // then we don't need to add the sortable attribute at all
                                         // otherwise, we need to include the ng-disabled on the <ol> so this can be referenced by the ui-sortable directive
@@ -717,8 +744,12 @@ var fng;
                                             ? "".concat(disableCond, " ui-sortable=\"sortableOptions\" ng-model=\"").concat(model, "\"")
                                             : "";
                                         template += "<ol class=\"sub-doc\" ".concat(sortableStr, ">");
+                                        // if a "disabled + children" DOM effect is applied to the list, this should serve to disable all of the
+                                        // fields in the list sub-schema, along with the remove and add buttons for this list.  the following
+                                        // string will be added to the list items and the add and remove buttons to identify this fact.
+                                        var disableableAncestorStr = formMarkupHelper.genDisableableAncestorStr(info.id);
                                         template +=
-                                            "<li ng-form id=\"".concat(info.id, "List_{{$index}}\" name=\"form_").concat(niceName, "{{$index}}\" ") +
+                                            "<li ng-form id=\"".concat(info.id, "List_{{$index}}\" name=\"form_").concat(niceName, "{{$index}}\" ").concat(disableableAncestorStr) +
                                                 "  class=\"".concat(convertFormStyleToClass(info.formStyle)) +
                                                 "  ".concat(cssFrameworkService.framework() === 'bs2' ? 'row-fluid' : '') +
                                                 "  ".concat(info.inlineHeaders ? 'width-controlled' : '') +
@@ -730,7 +761,10 @@ var fng;
                                             template += '<div class="row-fluid sub-doc">';
                                         }
                                         if (info.noRemove !== true || info.customSubDoc) {
-                                            template += '   <div class="sub-doc-btns">';
+                                            // we need to put disableableAncestorStr on the div rather than on the remove button because the
+                                            // way that is styled means that any coloured outlines that might be added when "Identify page elements" is on
+                                            // will be masked
+                                            template += "   <div class=\"sub-doc-btns\" ".concat(info.noRemove !== true ? disableableAncestorStr : "", ">");
                                             if (typeof info.customSubDoc == 'string') {
                                                 template += info.customSubDoc;
                                             }
@@ -790,9 +824,10 @@ var fng;
                                             else {
                                                 hideCond = info.noAdd ? "ng-hide=\"".concat(info.noAdd, "\"") : '';
                                                 indicatorShowCond = info.noAdd ? "ng-show=\"".concat(info.noAdd, " && ").concat(indicatorShowCond, "\"") : '';
-                                                var disableCond_1 = formMarkupHelper.handleReadOnlyDisabled(info);
+                                                // we need the button to have disableCond (to actually disable it, if the list is disabled)
+                                                // adding disableableAncestorStr seems more correct than for it to have the disableable attribute
                                                 footer +=
-                                                    "<button ".concat(hideCond, " ").concat(disableCond_1, " id=\"add_").concat(info.id, "_btn\" class=\"add-btn btn btn-default btn-xs btn-mini\" ng-click=\"add('").concat(info.name, "',$event)\">") +
+                                                    "<button ".concat(hideCond, " ").concat(disableCond, " ").concat(disableableAncestorStr, " id=\"add_").concat(info.id, "_btn\" class=\"add-btn btn btn-default btn-xs btn-mini\" ng-click=\"add('").concat(info.name, "',$event)\">") +
                                                         " <i class=\"".concat(formMarkupHelper.glyphClass(), "-plus\"></i> Add ") +
                                                         "</button>";
                                             }
@@ -833,7 +868,7 @@ var fng;
                                 delete info.help;
                                 var inputHtml = generateInput(info, info.type === 'link' ? null : 'arrayItem.x', true, options);
                                 info.help = stashedHelp;
-                                template += formMarkupHelper.handleArrayInputAndControlDiv(inputHtml, controlDivClasses, info, options);
+                                template += formMarkupHelper.handleArrayInputAndControlDiv(inputHtml, controlDivClasses, scope, info, options);
                             }
                             else {
                                 // Single fields here
@@ -967,6 +1002,8 @@ var fng;
                                     callHandleField = false;
                                 }
                                 else if (info.containerType) {
+                                    // for now, the following call will only consider security for tabs and not other container types.
+                                    // hence why we...
                                     var parts = containerInstructions(info);
                                     switch (info.containerType) {
                                         case 'tab':
@@ -977,9 +1014,12 @@ var fng;
                                                 var activeTabNo = _.findIndex(scope.tabs, function (tab) { return (tab.active); });
                                                 scope.activeTabNo = activeTabNo >= 0 ? activeTabNo : 0;
                                             }
-                                            result += parts.before;
-                                            result += processInstructions(info.content, null, options);
-                                            result += parts.after;
+                                            // ...only check for this here!
+                                            if (!parts.omit) {
+                                                result += parts.before;
+                                                result += processInstructions(info.content, null, options);
+                                                result += parts.after;
+                                            }
                                             break;
                                         case 'tabset':
                                             tabsSetup = tabsSetupState.Y;
@@ -1549,6 +1589,10 @@ var fng;
                                     needDivider = false;
                                     parentScope.items.push({ divider: true });
                                 }
+                                if (!value.id) {
+                                    // if it doesn't have an id, give it one, so every menu item is possible to secure
+                                    value.id = _.camelCase(value.text || value.textFunc() || "");
+                                }
                                 parentScope.items.push(value);
                             }
                         });
@@ -1856,7 +1900,7 @@ var fng;
          * All methods should be state-less
          *
          */
-        function formGenerator($location, $timeout, $filter, routingService, recordHandler) {
+        function formGenerator($filter, routingService, recordHandler, securityService) {
             function handleSchema(description, source, destForm, destList, prefix, doRecursion, $scope, ctrlState) {
                 function handletabInfo(tabName, thisInst) {
                     var tabTitle = angular.copy(tabName);
@@ -2383,7 +2427,7 @@ var fng;
                     }
                     return result;
                 },
-                decorateScope: function decorateScope($scope, formGeneratorInstance, recordHandlerInstance, sharedData) {
+                decorateScope: function decorateScope($scope, formGeneratorInstance, recordHandlerInstance, sharedData, pseudoUrl) {
                     $scope.record = sharedData.record;
                     $scope.phase = 'init';
                     $scope.disableFunctions = sharedData.disableFunctions;
@@ -2400,6 +2444,7 @@ var fng;
                     $scope.pageSize = 60;
                     $scope.pagesLoaded = 0;
                     sharedData.baseScope = $scope;
+                    securityService.decorateSecurableScope($scope, { pseudoUrl: pseudoUrl });
                     $scope.generateEditUrl = function (obj) {
                         return formGeneratorInstance.generateEditUrl(obj, $scope);
                     };
@@ -2410,7 +2455,20 @@ var fng;
                         return formGeneratorInstance.generateNewUrl($scope);
                     };
                     $scope.scrollTheList = function () {
-                        return recordHandlerInstance.scrollTheList($scope);
+                        var _a;
+                        // wait until we have the list schema.  until we get a non-empty listSchema (which might never
+                        // happen if we don't have permission to GET it), then there's no point requesting the data
+                        if (((_a = $scope.listSchema) === null || _a === void 0 ? void 0 : _a.length) > 0) {
+                            return recordHandlerInstance.scrollTheList($scope);
+                        }
+                        else {
+                            var unwatch_1 = $scope.$watchCollection("listSchema", function (newValue) {
+                                if ((newValue === null || newValue === void 0 ? void 0 : newValue.length) > 0) {
+                                    unwatch_1();
+                                    return recordHandlerInstance.scrollTheList($scope);
+                                }
+                            });
+                        }
                     };
                     $scope.getListData = function (record, fieldName) {
                         return recordHandlerInstance.getListData(record, fieldName, $scope.listSchema, $scope);
@@ -2460,7 +2518,7 @@ var fng;
             };
         }
         services.formGenerator = formGenerator;
-        formGenerator.$inject = ["$location", "$timeout", "$filter", "routingService", "recordHandler"];
+        formGenerator.$inject = ["$filter", "routingService", "recordHandler", "securityService"];
     })(services = fng.services || (fng.services = {}));
 })(fng || (fng = {}));
 /// <reference path="../../index.d.ts" />
@@ -2469,8 +2527,8 @@ var fng;
     var services;
     (function (services) {
         /*@ngInject*/
-        formMarkupHelper.$inject = ["cssFrameworkService", "inputSizeHelper", "addAllService", "$filter", "$rootScope"];
-        function formMarkupHelper(cssFrameworkService, inputSizeHelper, addAllService, $filter, $rootScope) {
+        formMarkupHelper.$inject = ["cssFrameworkService", "inputSizeHelper", "addAllService", "securityService", "$filter"];
+        function formMarkupHelper(cssFrameworkService, inputSizeHelper, addAllService, securityService, $filter) {
             function generateNgShow(showWhen, model) {
                 function evaluateSide(side) {
                     var result = side;
@@ -2508,51 +2566,101 @@ var fng;
             function glyphClass() {
                 return (cssFrameworkService.framework() === 'bs2' ? 'icon' : 'glyphicon glyphicon');
             }
-            function handleReadOnlyDisabled(fieldInfo) {
-                if (fieldInfo.readonly && typeof fieldInfo.readonly === "boolean") {
-                    // if we have a true-valued readonly property then this trumps whatever security rule might apply to this field
-                    return " disabled ";
-                }
-                function wrapReadOnly() {
-                    return fieldInfo.readonly ? " ng-disabled=\"".concat(fieldInfo.readonly, "\" ") : "";
-                }
-                if (!fieldInfo.id || !fng.formsAngular.elemSecurityFuncBinding || !fng.formsAngular.elemSecurityFuncName || !$rootScope[fng.formsAngular.elemSecurityFuncName]) {
-                    // no security, so we're just concerned about what value fieldInfo.readonly has
-                    return wrapReadOnly();
-                }
-                if (fng.formsAngular.elemSecurityFuncBinding === "instant") {
-                    // "instant" security is evaluated now, and a positive result trumps whatever fieldInfo.readonly might be set to
-                    if ($rootScope.isSecurelyDisabled(fieldInfo.id)) {
+            // Generate two strings:
+            //   1. firstly, attribute(s) that could be added to element(s) representing the field with the given
+            //      parameters to enable or disable it according to the prevailing security rules.
+            //   2. secondly, attribute(s) that could be added to a element - regardless of whether or not it will
+            //      actually be disabled on this occasion - to identify it as being potentially disableable
+            // This function is a more complicated version of securityService.generateDisabledAttr, also taking into
+            // account the fact that fieldInfo.readonly can influence the disabled state of a field.
+            // nonUniqueId should be required only in cases where a sub-sub schema has been defined in a directive
+            // as a means of getting around the single-level-of-nesting limitation.  in that case, where the
+            // directive's template then includes a <form-input> tag, it is likely that the ids of the sub-sub-schema
+            // elements will include $index from a parent scope (responsible for the sub-schema) in order to
+            // ensure its uniqueness, and in this case (as we are not explicitely managing the addition of the
+            // {{ $index }} expr), we need to be given a version of the id that does not include that expression.
+            // where nonUniqueId is provided, we will also use this for determining ancestors, because in the
+            // nested sub-schema scenario described above, the names of the fields in the sub-sub-schema will
+            // probably not identify the full ancestry.
+            function handleReadOnlyDisabled(partialFieldInfo, scope) {
+                var id = partialFieldInfo.nonUniqueId || partialFieldInfo.id;
+                function getActuallyDisabledAttr() {
+                    if (partialFieldInfo.readonly && typeof partialFieldInfo.readonly === "boolean") {
+                        // if we have a true-valued readonly property then this trumps whatever security rule might apply to this field
                         return " disabled ";
                     }
-                    else {
+                    function wrapReadOnly() {
+                        return partialFieldInfo.readonly ? " ng-disabled=\"".concat(partialFieldInfo.readonly, "\" ") : "";
+                    }
+                    if (!id || !securityService.canDoSecurityNow(scope, "disabled")) {
+                        // no security, so we're just concerned about what value fieldInfo.readonly has
                         return wrapReadOnly();
                     }
-                }
-                var securityFuncStr = "".concat(fng.formsAngular.elemSecurityFuncName, "('").concat(fieldInfo.id, "', 'disabled')");
-                var oneTimeBinding = fng.formsAngular.elemSecurityFuncBinding === "one-time";
-                if (fieldInfo.readonly) {
-                    // we have both security and a read-only attribute to deal with
-                    if (oneTimeBinding) {
-                        // if our field has a string-typed readonly attribute *and* one-time binding is required by our securityFunc, we
-                        // cannot simply combine these into a single ng-disabled expression, because the readonly property is highly
-                        // likely to be model-dependent and therefore cannot use one-time-binding.  the best we can do in this case is
-                        // to use ng-disabled for the field's readonly property, and a one-time-bound ng-readonly for the securityFunc.
-                        // this is not perfect, because in the case of selects, ng-readonly doesn't actually prevent the user from
-                        // making a selection.  however, the select will be styled as if it is disabled (including the not-allowed
-                        // cursor), which should deter the user in most cases.  
-                        return wrapReadOnly() + "ng-readonly=\"::".concat(securityFuncStr, "\" ");
+                    // if scope has been decorated with a requiresDisabledChildren function, we will be using that to check whether any
+                    // of the ancestors of this field's element require their children to be disabled.  if they do, that means us!
+                    var ancestorIds = [];
+                    if (!!scope.requiresDisabledChildren) {
+                        var ancestors = void 0;
+                        // if we have been provided with a nonUniqueId, we should use that to determine ancestors, because in this case,
+                        // the name will not be reliable
+                        if (partialFieldInfo.nonUniqueId) {
+                            var ancestorStr = partialFieldInfo.nonUniqueId.startsWith("f_") ? partialFieldInfo.nonUniqueId.substring(2) : partialFieldInfo.nonUniqueId;
+                            ancestors = ancestorStr.split("_");
+                        }
+                        else {
+                            ancestors = partialFieldInfo.name.split(".");
+                        }
+                        ancestors.pop();
+                        while (ancestors.length > 0) {
+                            ancestorIds.push("f_".concat(ancestors.join("_")));
+                            ancestors.pop();
+                        }
+                    }
+                    if (fng.formsAngular.elemSecurityFuncBinding === "instant") {
+                        // "instant" security is evaluated now, and a positive result trumps whatever fieldInfo.readonly might be set to
+                        if (scope.isSecurelyDisabled(id)) {
+                            return " disabled ";
+                        }
+                        else {
+                            for (var _i = 0, ancestorIds_1 = ancestorIds; _i < ancestorIds_1.length; _i++) {
+                                var ancestorId = ancestorIds_1[_i];
+                                if (scope.requiresDisabledChildren(ancestorId)) {
+                                    return " disabled ";
+                                }
+                            }
+                            return wrapReadOnly();
+                        }
+                    }
+                    var securityFuncStr = "isSecurelyDisabled('".concat(id, "')");
+                    if (ancestorIds.length > 0) {
+                        var ancestorStr = ancestorIds.map(function (aid) { return "requiresDisabledChildren('".concat(aid, "')"); });
+                        securityFuncStr = "(".concat(securityFuncStr, " || ").concat(ancestorStr.join(" || "), ")");
+                    }
+                    var oneTimeBinding = fng.formsAngular.elemSecurityFuncBinding === "one-time";
+                    if (partialFieldInfo.readonly) {
+                        // we have both security and a read-only attribute to deal with
+                        if (oneTimeBinding) {
+                            // if our field has a string-typed readonly attribute *and* one-time binding is required by our securityFunc, we
+                            // cannot simply combine these into a single ng-disabled expression, because the readonly property is highly
+                            // likely to be model-dependent and therefore cannot use one-time-binding.  the best we can do in this case is
+                            // to use ng-disabled for the field's readonly property, and a one-time-bound ng-readonly for the securityFunc.
+                            // this is not perfect, because in the case of selects, ng-readonly doesn't actually prevent the user from
+                            // making a selection.  however, the select will be styled as if it is disabled (including the not-allowed
+                            // cursor), which should deter the user in most cases.  
+                            return wrapReadOnly() + "ng-readonly=\"::".concat(securityFuncStr, "\" ");
+                        }
+                        else {
+                            // if we have both things and we are *NOT* required to use one-time binding for the securityFunc, then they can
+                            // be combined into a single ng-disabled expression
+                            return " ng-disabled=\"".concat(securityFuncStr, " || ").concat(partialFieldInfo.readonly, "\" ");
+                        }
                     }
                     else {
-                        // if we have both things and we are *NOT* required to use one-time binding for the securityFunc, then they can
-                        // simply be combined into a single ng-disabled expression
-                        return " ng-disabled=\"".concat(securityFuncStr, " || ").concat(fieldInfo.readonly, "\" ");
+                        // we have security only
+                        return " ng-disabled=\"".concat(oneTimeBinding ? "::" : "").concat(securityFuncStr, "\" ");
                     }
                 }
-                else {
-                    // we have security only
-                    return " ng-disabled=\"".concat(oneTimeBinding ? "::" : "").concat(securityFuncStr, "\" ");
-                }
+                return [getActuallyDisabledAttr(), securityService.getDisableableAttrs(id)];
             }
             function generateArrayElementIdString(idString, info, options) {
                 if (options.subschema && options.model) {
@@ -2572,6 +2680,9 @@ var fng;
                     return "".concat(idString, "_{{$index}}");
                 }
             }
+            function genDisableableAncestorStr(id) {
+                return securityService.getDisableableAncestorAttrs(id);
+            }
             function isArrayElement(scope, info, options) {
                 return scope["$index"] !== undefined || !!options.subschema;
             }
@@ -2581,22 +2692,41 @@ var fng;
                 fieldChrome: function fieldChrome(scope, info, options) {
                     var insert = '';
                     if (info.id && typeof info.id.replace === "function") {
-                        var idStr = "cg_".concat(info.id.replace(/\./g, '-'));
-                        insert += "id=\"".concat(isArrayElement(scope, info, options) ? generateArrayElementIdString(idStr, info, options) : idStr, "\"");
-                        if (fng.formsAngular.elemSecurityFuncBinding && fng.formsAngular.elemSecurityFuncName && $rootScope[fng.formsAngular.elemSecurityFuncName]) {
-                            if (fng.formsAngular.elemSecurityFuncBinding === "instant") {
-                                if ($rootScope.isSecurelyHidden(idStr)) {
-                                    // if our securityFunc supports instant binding and evaluates to true, then nothing needs to be 
-                                    // added to the dom for this field, which we indicate to our caller as follows...
-                                    return { omit: true };
+                        var uniqueIdStr = info.nonUniqueId || info.nonuniqueid || info.id;
+                        var idStr = void 0;
+                        // replace any . that appear in info.id with "-", but not those that appear between {{ and }}
+                        if (info.id.includes(".") && info.id.includes("{{")) {
+                            idStr = "cg_";
+                            var inExpr = false;
+                            for (var i = 0; i < info.id.length; i++) {
+                                if (info.id[i] === "{" && info.id[i - 1] === "{") {
+                                    inExpr = true;
+                                }
+                                else if (info.id[i] === "}" && info.id[i - 1] === "}") {
+                                    inExpr = false;
+                                }
+                                if (inExpr || info.id[i] !== ".") {
+                                    idStr += info.id[i];
+                                }
+                                else {
+                                    idStr += "-";
                                 }
-                                ;
-                            }
-                            else {
-                                var bindingStr = fng.formsAngular.elemSecurityFuncBinding === "one-time" ? "::" : "";
-                                insert += " data-ng-if=\"".concat(bindingStr, "!").concat(fng.formsAngular.elemSecurityFuncName, "('").concat(idStr, "', 'hidden')\"");
                             }
                         }
+                        else {
+                            idStr = "cg_".concat(info.id.replace(/\./g, '-'));
+                        }
+                        uniqueIdStr = "cg_".concat(uniqueIdStr.replace(/\./g, '-'));
+                        var visibility = securityService.considerVisibility(uniqueIdStr, scope);
+                        if (visibility.omit) {
+                            // we already know this field should be invisible, so we needn't add anything for it
+                            return { omit: true };
+                        }
+                        insert += "id=\"".concat(isArrayElement(scope, info, options) ? generateArrayElementIdString(idStr, info, options) : idStr, "\"");
+                        if (visibility.visibilityAttr) {
+                            // an angular expression to determine the visibility of this field later...
+                            insert += " ".concat(visibility.visibilityAttr);
+                        }
                     }
                     var classes = info.classes || '';
                     var template = '';
@@ -2669,8 +2799,8 @@ var fng;
                         }
                         labelHTML += addAllService.addAll(scope, 'Label', null, options) + ' class="' + classes + '">' + fieldInfo.label;
                         if (addButtonMarkup) {
-                            var disableCond = handleReadOnlyDisabled(fieldInfo);
-                            labelHTML += " <i ".concat(disableCond, " id=\"add_").concat(fieldInfo.id, "\" ng-click=\"add('").concat(fieldInfo.name, "', $event)\" class=\"").concat(glyphClass(), "-plus-sign\"></i>");
+                            var disabledAttrs = handleReadOnlyDisabled(fieldInfo, scope);
+                            labelHTML += " <i ".concat(disabledAttrs.join(" "), " id=\"add_").concat(fieldInfo.id, "\" ng-click=\"add('").concat(fieldInfo.name, "', $event)\" class=\"").concat(glyphClass(), "-plus-sign\"></i>");
                         }
                         labelHTML += '</label>';
                         if (fieldInfo.linklabel) {
@@ -2787,14 +2917,14 @@ var fng;
                     }
                     return inputMarkup;
                 },
-                handleArrayInputAndControlDiv: function handleArrayInputAndControlDiv(inputMarkup, controlDivClasses, info, options) {
+                handleArrayInputAndControlDiv: function handleArrayInputAndControlDiv(inputMarkup, controlDivClasses, scope, info, options) {
                     var indentStr = cssFrameworkService.framework() === 'bs3' ? 'ng-class="skipCols($index)" ' : "";
                     var arrayStr = (options.model || 'record') + '.' + info.name;
                     var result = "";
                     result += '<div id="' + info.id + 'List" class="' + controlDivClasses.join(' ') + '" ' + indentStr + ' ng-repeat="arrayItem in ' + arrayStr + ' track by $index">';
-                    var disableCond = handleReadOnlyDisabled(info);
+                    var disabledAttrs = handleReadOnlyDisabled(info, scope);
                     var removeBtn = info.type !== 'link'
-                        ? "<i ".concat(disableCond, " ng-click=\"remove('").concat(info.name, "', $index, $event)\" id=\"remove_").concat(info.id, "_{{$index}}\" class=\"").concat(glyphClass(), "-minus-sign\"></i>")
+                        ? "<i ".concat(disabledAttrs.join(" "), " ng-click=\"remove('").concat(info.name, "', $index, $event)\" id=\"remove_").concat(info.id, "_{{$index}}\" class=\"").concat(glyphClass(), "-minus-sign\"></i>")
                         : "";
                     result += inputMarkup.replace("<dms/>", removeBtn);
                     result += '</div>';
@@ -2817,7 +2947,8 @@ var fng;
                     return result;
                 },
                 handleReadOnlyDisabled: handleReadOnlyDisabled,
-                generateArrayElementIdString: generateArrayElementIdString
+                generateArrayElementIdString: generateArrayElementIdString,
+                genDisableableAncestorStr: genDisableableAncestorStr
             };
         }
         services.formMarkupHelper = formMarkupHelper;
@@ -2856,16 +2987,63 @@ var fng;
         /*@ngInject*/
         pluginHelper.$inject = ["formMarkupHelper"];
         function pluginHelper(formMarkupHelper) {
-            function internalGenDisabledStr(id, processedAttrs, forceNg) {
-                var result = formMarkupHelper.handleReadOnlyDisabled({ id: id, readonly: processedAttrs.info.readonly }).trim();
+            function internalGenDisabledAttrs(scope, id, processedAttrs, idSuffix, params) {
+                // Though id will already have the value of idSuffix appended, processedAttrs.info.name will not.
+                // For handleReadOnlyDisabled() to disable "sub-elements" included in a directive template with an idsuffix when their
+                // 'parent' field is disabled, we need the name to include that suffix as if it were an additional level
+                // of field nesting.
+                var name = processedAttrs.info.name;
+                if (idSuffix) {
+                    if (params === null || params === void 0 ? void 0 : params.nonUniqueIdSuffix) {
+                        // Generally, when genIdAndDisabledStr is called from a directive, the idSuffix will be something like "select"
+                        // or "hasValueCheckbox" (thus enabling a single directive to create a template that includes more than one form
+                        // element - such as a checkbox and an input - each of which has a unique id).
+                        // Where a directive is responsible for creating markup for an whole array of elements, it is likely to include an
+                        // ng-repeat in the template that it generates, and in this case, the idSuffix that it passes to genIdAndDisabledStr
+                        // will probably include a reference to $index to ensure uniqueness.
+                        // Where idSuffix /does/ contain a reference to $index, the directive should provide a version of the idSuffix
+                        // in the params object which does NOT include this.
+                        // This is what we need to use for the ng-disabled/ng-readonly expression.
+                        // (ReallyCare development hint: for an example of where this is needed, see or-opts.ts.)
+                        id = id.replace(idSuffix, params.nonUniqueIdSuffix);
+                        name += ".".concat(params.nonUniqueIdSuffix);
+                    }
+                    else {
+                        name += ".".concat(idSuffix);
+                    }
+                }
+                var attrs = formMarkupHelper.handleReadOnlyDisabled({
+                    id: id,
+                    name: name,
+                    nonUniqueId: processedAttrs.info.nonuniqueid,
+                    readonly: processedAttrs.info.readonly
+                }, scope);
                 // some types of control (such as ui-select) don't deal correctly with a DISABLED attribute and
                 // need ng-disabled, even when the expression is simply "true"
-                if (forceNg && result.toLowerCase() === "disabled") {
-                    return 'ng-disabled="true"';
+                if (params === null || params === void 0 ? void 0 : params.forceNg) {
+                    for (var i = 0; i < attrs.length; i++) {
+                        if (attrs[i].toLowerCase().trim() === "disabled") {
+                            attrs[i] = 'ng-disabled="true"';
+                        }
+                    }
                 }
-                else {
-                    return result;
+                return attrs;
+            }
+            function internalGenDisabledStr(scope, id, processedAttrs, idSuffix, params) {
+                return internalGenDisabledAttrs(scope, id, processedAttrs, idSuffix, params).join(" ");
+            }
+            // text surrounded by @@ @@ is assumed to be something that can have a pseudonym.  We'll rely
+            // upon the relevant controller assigning a pseudo() function to baseScope.
+            function handlePseudos(str) {
+                if (!str) {
+                    return str;
                 }
+                var result = str;
+                while (result.includes("@@")) {
+                    result = result.replace("@@", "{{ baseScope.pseudo('");
+                    result = result.replace("@@", "', true) }}");
+                }
+                return result;
             }
             function makeIdStringUniqueForArrayElements(scope, processedAttrs, idString) {
                 if (formMarkupHelper.isArrayElement(scope, processedAttrs.info, processedAttrs.options)) {
@@ -2888,8 +3066,11 @@ var fng;
                 }
                 return result;
             }
-            function internalGenDateTimePickerDisabledStr(processedAttrs, idString) {
-                var rawDisabledStr = internalGenDisabledStr(idString, processedAttrs, true);
+            function internalGenDateTimePickerDisabledStr(scope, processedAttrs, idSuffix, idString) {
+                var rawDisabledAttrs = internalGenDisabledAttrs(scope, idString, processedAttrs, idSuffix, { forceNg: true });
+                // first, we need to convert the 'disabled' attribute(s) (those which might actually cause the element to be
+                // disabled - found in rawDisabledAttrs[0]) into something that the datetime picker understands.
+                var rawDisabledStr = rawDisabledAttrs[0];
                 var disabledStr = "";
                 // disabledStr might now include an ng-disabled attribute.  To disable both the date and time inputs, we need to
                 // take the value of that attribute and wrap it up as two new attributes: "disabledDate" and "readonlyTime"
@@ -2921,7 +3102,9 @@ var fng;
                         // give up
                     }
                 }
-                return disabledStr;
+                // finally, we should add the 'disableable' attribute(s), which might be present in rawDisabledAttrs[1] (regardless
+                // of whether or not the datetime picker is actually disabled) to indicate that it potentially could be
+                return disabledStr + " " + rawDisabledAttrs[1];
             }
             function extractFromAttr(attr, directiveName) {
                 function deserialize(str) {
@@ -2961,7 +3144,19 @@ var fng;
                         }
                     }
                 }
-                return { info: info, options: options, directiveOptions: directiveOptions };
+                var result = { info: info, options: options, directiveOptions: directiveOptions };
+                // any part of the help text or label that is surrounded by @@ @@ is assumed to be something that can have
+                // a pseudonym.  We'll be relying upon the parent controller assigning a pseudo() function to baseScope to
+                // actually perform the translation.
+                // TODO - do this better when fng is re-written!
+                result.info.help = handlePseudos(result.info.help);
+                result.info.label = handlePseudos(result.info.label);
+                return result;
+            }
+            function genIdAndDisabledStr(scope, processedAttrs, idSuffix, params) {
+                var idStr = internalGenIdString(scope, processedAttrs, idSuffix, false);
+                var uniqueIdStr = makeIdStringUniqueForArrayElements(scope, processedAttrs, idStr);
+                return "id=\"".concat(uniqueIdStr, "\" ").concat(internalGenDisabledStr(scope, idStr, processedAttrs, idSuffix, params));
             }
             return {
                 extractFromAttr: extractFromAttr,
@@ -3006,37 +3201,47 @@ var fng;
                     }
                     var buildingBlocks = formMarkupHelper.allInputsVars(scope, info, options, modelString, idString, nameString);
                     buildingBlocks.modelString = modelString;
+                    buildingBlocks.disableableAncestorStr = formMarkupHelper.genDisableableAncestorStr(info.id);
                     // defer to the calling directive to generate the markup for the input(s)
                     var inputHtml = generateInputControl(buildingBlocks);
                     // wrap this in a div that puts it into the correct bootstrap 'column' and adds validation messages and help text
                     var wrappedInputHtml = formMarkupHelper.inputChrome(inputHtml, info, options, buildingBlocks);
                     // further wrap this to add the control div classes, and in the case of an array, the button that allows array elements to be removed
-                    var inputAndControlDivGenerator = params.addButtons
-                        ? formMarkupHelper.handleArrayInputAndControlDiv
-                        : formMarkupHelper.handleInputAndControlDiv;
-                    elementHtml += inputAndControlDivGenerator(wrappedInputHtml, controlDivClasses, info, options);
+                    if (params.addButtons) {
+                        elementHtml += formMarkupHelper.handleArrayInputAndControlDiv(wrappedInputHtml, controlDivClasses, scope, info, options);
+                    }
+                    else {
+                        elementHtml += formMarkupHelper.handleInputAndControlDiv(wrappedInputHtml, controlDivClasses);
+                    }
                     elementHtml += fieldChrome.closeTag;
                     return elementHtml;
                 },
                 genIdString: function genIdString(scope, processedAttrs, idSuffix) {
                     return internalGenIdString(scope, processedAttrs, idSuffix, true);
                 },
-                genDisabledStr: function genDisabledStr(scope, processedAttrs, idSuffix, forceNg) {
-                    var idString = internalGenIdString(scope, processedAttrs, idSuffix, false);
-                    return internalGenDisabledStr(idString, processedAttrs, forceNg);
-                },
-                genIdAndDisabledStr: function genIdAndDisabledStr(scope, processedAttrs, idSuffix, forceNg) {
+                genDisabledStr: function genDisabledStr(scope, processedAttrs, idSuffix, params) {
                     var idString = internalGenIdString(scope, processedAttrs, idSuffix, false);
-                    return "id=\"".concat(makeIdStringUniqueForArrayElements(scope, processedAttrs, idString), "\" ") + internalGenDisabledStr(idString, processedAttrs, forceNg);
+                    return internalGenDisabledStr(scope, idString, processedAttrs, idSuffix, params);
                 },
+                genIdAndDisabledStr: genIdAndDisabledStr,
                 genDateTimePickerDisabledStr: function genDateTimePickerDisabledStr(scope, processedAttrs, idSuffix) {
                     var idString = internalGenIdString(scope, processedAttrs, idSuffix, false);
-                    return internalGenDateTimePickerDisabledStr(processedAttrs, idString);
+                    return internalGenDateTimePickerDisabledStr(scope, processedAttrs, idSuffix, idString);
                 },
                 genDateTimePickerIdAndDisabledStr: function genDateTimePickerIdAndDisabledStr(scope, processedAttrs, idSuffix) {
-                    var idString = internalGenIdString(scope, processedAttrs, idSuffix, false);
-                    return "id=\"".concat(makeIdStringUniqueForArrayElements(scope, processedAttrs, idString), "\" ") + internalGenDateTimePickerDisabledStr(processedAttrs, idString);
+                    var idStr = internalGenIdString(scope, processedAttrs, idSuffix, false);
+                    var uniqueIdStr = makeIdStringUniqueForArrayElements(scope, processedAttrs, idStr);
+                    return "id=\"".concat(uniqueIdStr, "\" ").concat(internalGenDateTimePickerDisabledStr(scope, processedAttrs, idSuffix, idStr));
+                },
+                genUiSelectIdAndDisabledStr: function genUiSelectIdAndDisabledStr(scope, processedAttrs, idSuffix) {
+                    // ui-select won't be disabled when a simple DISABLED attribute is provided - it requires
+                    // ng-disabled even when the value is simply "true"
+                    return genIdAndDisabledStr(scope, processedAttrs, idSuffix, { forceNg: true });
                 },
+                handlePseudos: handlePseudos,
+                genDisableableAncestorStr: function genDisableableAncestorStr(processedAttrs) {
+                    return formMarkupHelper.genDisableableAncestorStr(processedAttrs.info.id);
+                }
             };
         }
         services.pluginHelper = pluginHelper;
@@ -3054,8 +3259,8 @@ var fng;
          *
          */
         /*@ngInject*/
-        recordHandler.$inject = ["$location", "$window", "$filter", "$timeout", "routingService", "cssFrameworkService", "SubmissionsService", "SchemasService"];
-        function recordHandler($location, $window, $filter, $timeout, routingService, cssFrameworkService, SubmissionsService, SchemasService) {
+        recordHandler.$inject = ["$location", "$window", "$filter", "$timeout", "$sce", "routingService", "cssFrameworkService", "SubmissionsService", "SchemasService"];
+        function recordHandler($location, $window, $filter, $timeout, $sce, routingService, cssFrameworkService, SubmissionsService, SchemasService) {
             // TODO: Put this in a service
             var makeMongoId = function (rnd) {
                 if (rnd === void 0) { rnd = function (r16) { return Math.floor(r16).toString(16); }; }
@@ -3662,7 +3867,7 @@ var fng;
             }
             function handleError($scope) {
                 return function (response) {
-                    if ([200, 400].indexOf(response.status) !== -1) {
+                    if ([200, 400, 403].indexOf(response.status) !== -1) {
                         var errorMessage = "";
                         if (response.data && response.data.errors) {
                             for (var errorField in response.data.errors) {
@@ -3686,6 +3891,9 @@ var fng;
                         else {
                             errorMessage = response.data.message || response.data._message || response.data.err || "Error!  Sorry - No further details available.";
                         }
+                        // anyone using a watch on $scope.phase, and waiting for it to become "ready" before proceeding, will probably
+                        // want to know that an error has occurred.  This value is NOT used anywhere in forms-angular.
+                        $scope.phase = "error";
                         $scope.showError(errorMessage);
                     }
                     else {
@@ -3748,12 +3956,22 @@ var fng;
                         find: $location.$$search.f,
                         limit: $scope.pageSize,
                         skip: pagesLoaded * $scope.pageSize,
-                        order: $location.$$search.o
+                        order: $location.$$search.o,
+                        concatenate: false
                     })
                         .then(function (response) {
                         var data = response.data;
                         if (angular.isArray(data)) {
-                            //  I have seen an intermittent problem where a page is requested twice
+                            // if the options for the resource identified by $scope.modelName has disambiguation parameters,
+                            // and that resource has more than one list field, the items returned by getPagedAndFilteredList
+                            // might include a "disambiguation" property.  for this to appear on the list page, we need
+                            // to add an item for it to the list schema
+                            if (!$scope.listSchema.find(function (f) { return f.name === "disambiguation"; }) && data.some(function (d) { return d.disambiguation; })) {
+                                $scope.listSchema.push({
+                                    name: "disambiguation",
+                                });
+                            }
+                            // I have seen an intermittent problem where a page is requested twice
                             if (pagesLoaded === $scope.pagesLoaded) {
                                 $scope.pagesLoaded++;
                                 $scope.recordList = $scope.recordList.concat(data);
@@ -3832,50 +4050,47 @@ var fng;
                 },
                 getListData: getListData,
                 suffixCleanId: suffixCleanId,
+                getData: getData,
                 setData: setData,
                 setUpLookupOptions: function setUpLookupOptions(lookupCollection, schemaElement, $scope, ctrlState, handleSchema) {
                     var optionsList = $scope[schemaElement.options] = [];
                     var idList = $scope[schemaElement.ids] = [];
-                    SchemasService.getSchema(lookupCollection)
+                    var dataRequest = !!schemaElement.filter
+                        ? SubmissionsService.getPagedAndFilteredList(lookupCollection, Object.assign({ concatenate: true }, schemaElement.filter)) // { concatenate: true } causes it to concatenate the list fields into the .text property of ILookupItem objects
+                        : SubmissionsService.getAllListAttributes(lookupCollection);
+                    dataRequest
                         .then(function (response) {
-                        var data = response.data;
-                        var listInstructions = [];
-                        handleSchema("Lookup " + lookupCollection, data, null, listInstructions, "", false, $scope, ctrlState);
-                        var dataRequest;
-                        if (typeof schemaElement.filter !== "undefined" && schemaElement.filter) {
-                            dataRequest = SubmissionsService.getPagedAndFilteredList(lookupCollection, schemaElement.filter);
-                        }
-                        else {
-                            dataRequest = SubmissionsService.getAll(lookupCollection);
-                        }
-                        dataRequest
-                            .then(function (response) {
-                            var data = angular.copy(response.data);
-                            if (data) {
-                                for (var i = 0; i < data.length; i++) {
-                                    var option = "";
-                                    for (var j = 0; j < listInstructions.length; j++) {
-                                        var thisVal = data[i][listInstructions[j].name];
-                                        option += thisVal ? thisVal + " " : "";
+                        var items = response.data;
+                        if (items) {
+                            items.sort(function (a, b) { return a.text.localeCompare(b.text); });
+                            optionsList.push.apply(optionsList, items.map(function (i) { return i.text; }));
+                            idList.push.apply(idList, items.map(function (i) { return i.id; }));
+                            var dupes = new Set();
+                            for (var i = 0; i < optionsList.length - 1; i++) {
+                                for (var j = i + 1; j < optionsList.length; j++) {
+                                    if (_.isEqual(optionsList[i], optionsList[j])) {
+                                        dupes.add(optionsList[i]);
                                     }
-                                    option = option.trim();
-                                    var pos = _.sortedIndex(optionsList, option);
-                                    // handle dupes (ideally people will use unique indexes to stop them but...)
-                                    if (optionsList[pos] === option) {
-                                        option = option + "    (" + data[i]._id + ")";
-                                        pos = _.sortedIndex(optionsList, option);
-                                    }
-                                    optionsList.splice(pos, 0, option);
-                                    idList.splice(pos, 0, data[i]._id);
                                 }
-                                if ($scope.readingRecord) {
-                                    $scope.readingRecord
-                                        .then(function () {
-                                        updateRecordWithLookupValues(schemaElement, $scope, ctrlState);
-                                    });
+                            }
+                            // append the id to any duplicates to make them unique
+                            dupes.forEach(function (d) {
+                                for (var i = 0; i < optionsList.length; i++) {
+                                    if (optionsList[i] === d) {
+                                        optionsList[i] += "(" + idList[i] + ")";
+                                    }
                                 }
+                            });
+                            if ($scope.readingRecord) {
+                                $scope.readingRecord
+                                    .then(function () {
+                                    updateRecordWithLookupValues(schemaElement, $scope, ctrlState);
+                                });
                             }
-                        });
+                        }
+                    })
+                        .catch(function (e) {
+                        $scope.handleHttpError(e);
                     });
                 },
                 setUpLookupListOptions: function setUpLookupListOptions(ref, formInstructions, $scope, ctrlState) {
@@ -3997,7 +4212,7 @@ var fng;
                     $scope.showError = function (error, alertTitle) {
                         $scope.alertTitle = alertTitle ? alertTitle : "Error!";
                         if (typeof error === "string") {
-                            $scope.errorMessage = error;
+                            $scope.errorMessage = $sce.trustAsHtml(error);
                         }
                         else if (!error) {
                             $scope.errorMessage = "An error occurred - that's all we got.  Sorry.";
@@ -4171,10 +4386,11 @@ var fng;
                         }
                     };
                     $scope.isCancelDisabled = function () {
+                        var _a;
                         if ($scope[$scope.topLevelFormName] && $scope[$scope.topLevelFormName].$pristine) {
                             return true;
                         }
-                        else if (typeof $scope.disableFunctions.isCancelDisabled === "function") {
+                        else if (typeof ((_a = $scope.disableFunctions) === null || _a === void 0 ? void 0 : _a.isCancelDisabled) === "function") {
                             return $scope.disableFunctions.isCancelDisabled($scope.record, ctrlState.master, $scope[$scope.topLevelFormName]);
                         }
                         else {
@@ -4182,6 +4398,7 @@ var fng;
                         }
                     };
                     $scope.isSaveDisabled = function () {
+                        var _a;
                         $scope.whyDisabled = undefined;
                         var pristine = false;
                         function generateWhyDisabledMessage(form, subFormName) {
@@ -4254,7 +4471,7 @@ var fng;
                         if (pristine || !!$scope.whyDisabled) {
                             return true;
                         }
-                        else if (typeof $scope.disableFunctions.isSaveDisabled !== "function") {
+                        else if (typeof ((_a = $scope.disableFunctions) === null || _a === void 0 ? void 0 : _a.isSaveDisabled) !== "function") {
                             return false;
                         }
                         else {
@@ -4269,10 +4486,11 @@ var fng;
                         }
                     };
                     $scope.isDeleteDisabled = function () {
+                        var _a;
                         if (!$scope.id) {
                             return true;
                         }
-                        else if (typeof $scope.disableFunctions.isDeleteDisabled === "function") {
+                        else if (typeof ((_a = $scope.disableFunctions) === null || _a === void 0 ? void 0 : _a.isDeleteDisabled) === "function") {
                             return $scope.disableFunctions.isDeleteDisabled($scope.record, ctrlState.master, $scope[$scope.topLevelFormName]);
                         }
                         else {
@@ -4280,7 +4498,8 @@ var fng;
                         }
                     };
                     $scope.isNewDisabled = function () {
-                        if (typeof $scope.disableFunctions.isNewDisabled === "function") {
+                        var _a;
+                        if (typeof ((_a = $scope.disableFunctions) === null || _a === void 0 ? void 0 : _a.isNewDisabled) === "function") {
                             return $scope.disableFunctions.isNewDisabled($scope.record, ctrlState.master, $scope[$scope.topLevelFormName]);
                         }
                         else {
@@ -4385,6 +4604,222 @@ var fng;
     })(services = fng.services || (fng.services = {}));
 })(fng || (fng = {}));
 /// <reference path="../../../../node_modules/@types/angular/index.d.ts" />
+var fng;
+(function (fng) {
+    var services;
+    (function (services) {
+        /*@ngInject*/
+        securityService.$inject = ["$rootScope"];
+        function securityService($rootScope) {
+            function canDoSecurity(type) {
+                return (!!fng.formsAngular.elemSecurityFuncBinding &&
+                    ((type === "hidden" && !!fng.formsAngular.hiddenSecurityFuncName) ||
+                        (type === "disabled" && !!fng.formsAngular.disabledSecurityFuncName)));
+            }
+            function canDoSecurityNow(scope, type) {
+                return (canDoSecurity(type) && // we have security configured
+                    (
+                    // the host app has not (temporarily) disabled this security type (which it might do, as an optimisation, when there are
+                    // currently no security rules to apply); and 
+                    // it has provided the callbacks that are specified in the security configuration; and
+                    // the provided scope (if any) has been decorated (by us).  pages and popups which aren't form controllers will need to use
+                    // (either directly, or through formMarkupHelper), the decorateSecurableScope() function below
+                    (type === "hidden" &&
+                        $rootScope[fng.formsAngular.hiddenSecurityFuncName] &&
+                        (!scope || !!scope.isSecurelyHidden))
+                        ||
+                            (type === "disabled" &&
+                                $rootScope[fng.formsAngular.disabledSecurityFuncName] &&
+                                (!scope || !!scope.isSecurelyDisabled))));
+            }
+            function isSecurelyHidden(elemId, pseudoUrl) {
+                return $rootScope[fng.formsAngular.hiddenSecurityFuncName](elemId, pseudoUrl);
+            }
+            function getSecureDisabledState(elemId, pseudoUrl) {
+                return $rootScope[fng.formsAngular.disabledSecurityFuncName](elemId, pseudoUrl);
+            }
+            function isSecurelyDisabled(elemId, pseudoUrl) {
+                return !!getSecureDisabledState(elemId, pseudoUrl); // either true or "+"
+            }
+            function getBindingStr() {
+                return fng.formsAngular.elemSecurityFuncBinding === "one-time" ? "::" : "";
+            }
+            function ignoreElemId(elemId) {
+                var _a;
+                return (_a = fng.formsAngular.ignoreIdsForHideableOrDisableableAttrs) === null || _a === void 0 ? void 0 : _a.some(function (id) { return elemId.includes(id); });
+            }
+            function getXableAttrs(elemId, attr) {
+                if (elemId && attr && !ignoreElemId(elemId)) {
+                    return " ".concat(attr, " title=\"").concat(elemId, "\"");
+                }
+                else {
+                    return "";
+                }
+            }
+            function getDisableableAttrs(elemId) {
+                // even when an element should not actually be disabled, we should still mark what would otherwise have been a
+                // potentially-disabled element with scope.disableableAttr - where this is set - and where it is set, also set its
+                // title to be the same as its id so that users can learn of its id by hovering over it.  this will
+                // help anyone trying to figure out what is the right element id to use for a DOM security rule
+                return getXableAttrs(elemId, fng.formsAngular.disableableAttr);
+            }
+            function getDisableableAncestorAttrs(elemId) {
+                // even when an element should not actually be disabled, we should still mark what would otherwise have been a
+                // potentially-disabled element with scope.disableableAttr - where this is set - and where it is set, also set its
+                // title to be the same as its id so that users can learn of its id by hovering over it.  this will
+                // help anyone trying to figure out what is the right element id to use for a DOM security rule
+                return getXableAttrs(elemId, fng.formsAngular.disableableAncestorAttr);
+            }
+            function getHideableAttrs(elemId) {
+                // even when canDoSecurityNow() returns false, we should still mark what would otherwise have been a
+                // potentially-hidden element with scope.hideableAttr, where this is set, and where it is set, also set its
+                // title to be the same as its id so that users can learn of its id by hovering over it.  this will
+                // help anyone trying to figure out what is the right element id to use for a DOM security rule
+                return getXableAttrs(elemId, fng.formsAngular.hideableAttr);
+            }
+            return {
+                canDoSecurity: canDoSecurity,
+                canDoSecurityNow: canDoSecurityNow,
+                isSecurelyHidden: isSecurelyHidden,
+                isSecurelyDisabled: isSecurelyDisabled,
+                getHideableAttrs: getHideableAttrs,
+                getDisableableAttrs: getDisableableAttrs,
+                getDisableableAncestorAttrs: getDisableableAncestorAttrs,
+                // whilst initialising new pages and popups, pass their scope here for decoration with functions that can be used to check
+                // the disabled / hidden state of DOM elements on that page according to the prevailing security rules.
+                // if the host app indicates that security checks should be skipped for this page, we will NOT assign the corresponding
+                // functions.  the presence of these functions will be checked later by canDoSecurityNow(), which will always be called
+                // before any security logic is applied.  this allows security to be bypassed entirely at the request of the host app,
+                // providing an opportunity for optimisation.
+                decorateSecurableScope: function (securableScope, params) {
+                    if (canDoSecurity("hidden") && (!fng.formsAngular.skipHiddenSecurityFuncName || (params === null || params === void 0 ? void 0 : params.overrideSkipping) || !$rootScope[fng.formsAngular.skipHiddenSecurityFuncName](params === null || params === void 0 ? void 0 : params.pseudoUrl))) {
+                        securableScope.isSecurelyHidden = function (elemId) {
+                            return isSecurelyHidden(elemId, params === null || params === void 0 ? void 0 : params.pseudoUrl);
+                        };
+                    }
+                    if (canDoSecurity("disabled") && (!fng.formsAngular.skipDisabledSecurityFuncName || (params === null || params === void 0 ? void 0 : params.overrideSkipping) || !$rootScope[fng.formsAngular.skipDisabledSecurityFuncName](params === null || params === void 0 ? void 0 : params.pseudoUrl))) {
+                        securableScope.isSecurelyDisabled = function (elemId) {
+                            return isSecurelyDisabled(elemId, params === null || params === void 0 ? void 0 : params.pseudoUrl);
+                        };
+                        if (!fng.formsAngular.skipDisabledAncestorSecurityFuncName || (params === null || params === void 0 ? void 0 : params.overrideSkipping) || !$rootScope[fng.formsAngular.skipDisabledAncestorSecurityFuncName](params === null || params === void 0 ? void 0 : params.pseudoUrl)) {
+                            securableScope.requiresDisabledChildren = function (elemId) {
+                                return getSecureDisabledState(elemId, params === null || params === void 0 ? void 0 : params.pseudoUrl) === "+";
+                            };
+                        }
+                    }
+                },
+                doSecurityWhenReady: function (cb) {
+                    if (canDoSecurityNow(undefined, "hidden")) {
+                        cb();
+                    }
+                    else if (canDoSecurity("hidden")) {
+                        // wait until the hidden security function has been provided (externally) before proceeding with the callback...
+                        // we assume here that the hidden security and disabled security functions are both going to be provided at the
+                        // same time (and could therefore watch for either of these things)
+                        var unwatch_2 = $rootScope.$watch(fng.formsAngular.hiddenSecurityFuncName, function (newValue) {
+                            if (newValue) {
+                                unwatch_2();
+                                cb();
+                            }
+                        });
+                    }
+                },
+                considerVisibility: function (id, scope) {
+                    var hideableAttrs = getHideableAttrs(id);
+                    if (canDoSecurityNow(scope, "hidden")) {
+                        if (fng.formsAngular.elemSecurityFuncBinding === "instant") {
+                            if (scope.isSecurelyHidden(id)) {
+                                // if our securityFunc supports instant binding and evaluates to true, then nothing needs to be
+                                // added to the dom for this field, which we indicate to our caller as follows...
+                                return { omit: true };
+                            }
+                        }
+                        else {
+                            return { visibilityAttr: "data-ng-if=\"".concat(getBindingStr(), "!isSecurelyHidden('").concat(id, "')\"").concat(hideableAttrs) };
+                        }
+                    }
+                    return { visibilityAttr: hideableAttrs };
+                },
+                // consider the visibility of a container whose visibility depends upon at least some of its content being visible.
+                // the container is assumed not to itself be securable (hence it doesn't have an id - or at least, not one we're
+                // concerned about - and it doesn't itself need a "hideable" attribute) 
+                considerContainerVisibility: function (contentIds, scope) {
+                    if (canDoSecurityNow(scope, "hidden")) {
+                        if (fng.formsAngular.elemSecurityFuncBinding === "instant") {
+                            if (contentIds.some(function (id) { return !scope.isSecurelyHidden(id); })) {
+                                return {};
+                            }
+                            else {
+                                return { omit: true };
+                            }
+                        }
+                        else {
+                            var attrs = contentIds.map(function (id) { return "!isSecurelyHidden('".concat(id, "')"); });
+                            return { visibilityAttr: "data-ng-if=\"".concat(getBindingStr(), "(").concat(attrs.join(" || "), ")\"") };
+                        }
+                    }
+                    return {};
+                },
+                // Generate an attribute that could be added to the element with the given id to enable or disable it
+                // according to the prevailing security rules.  In most cases, the attribute will either be "disabled"
+                // (in the case of 'instant' binding) or data-ng-disabled="xxxx" (in the case of one-time or normal
+                // binding).  For directives that require something different, use params:
+                //  - forceNg will wrap a positive (disabled) result in an angular directive (e.g., data-ng-disabled="true")
+                //    rather than returning simply "disabled"
+                //  - attrRequiresValue will translate a positive (disabled) result into an attribute with a truthy value
+                //    (e.g., disabled="true") rather than returning simply "disabled"
+                //  - attr can be used in the case where a directive expects an attribute other than "disabled".
+                //    (for example, uib-tab expects "disable").
+                // Even if the element is not be disabled on this occasion, we will always return the value of
+                // fng.formsAngular.disableableAttr - where set - as a way of marking it as potentially disableable.
+                // Because they can also have a readonly attribute which needs to be taken into consideration, this
+                // function is NOT suitable for fields, which are instead handled by fieldformMarkupHelper.handleReadOnlyDisabled().
+                generateDisabledAttr: function (id, scope, params) {
+                    function getActuallyDisabledAttrs() {
+                        var result = "";
+                        if (canDoSecurityNow(scope, "disabled")) {
+                            if (!params) {
+                                params = {};
+                            }
+                            if (params.attrRequiresValue && params.forceNg) {
+                                throw new Error("Invalid combination of parameters provided to generateDisabledAttr() [attrRequiresValue and forceNg]");
+                            }
+                            var attr = params.attr || "disabled";
+                            if (fng.formsAngular.elemSecurityFuncBinding === "instant") {
+                                if (scope.isSecurelyDisabled(id)) {
+                                    if (params.attrRequiresValue) {
+                                        return " ".concat(attr, "=\"true\"");
+                                    }
+                                    else if (params.forceNg) {
+                                        result = "true";
+                                    }
+                                    else {
+                                        return " ".concat(attr);
+                                    }
+                                }
+                            }
+                            else {
+                                result = "".concat(getBindingStr(), "isSecurelyDisabled('").concat(id, "')");
+                            }
+                            if (result) {
+                                if (attr === "disabled") {
+                                    return " data-ng-disabled=\"".concat(result, "\"");
+                                }
+                                else {
+                                    return " data-ng-attr-".concat(attr, "=\"").concat(result, "\"");
+                                }
+                            }
+                        }
+                        return result;
+                    }
+                    return getActuallyDisabledAttrs() + getDisableableAttrs(id);
+                },
+            };
+        }
+        services.securityService = securityService;
+    })(services = fng.services || (fng.services = {}));
+})(fng || (fng = {}));
+/// <reference path="../../../../node_modules/@types/angular/index.d.ts" />
 var ExpirationCache = /** @class */ (function () {
     function ExpirationCache(timeout) {
         if (timeout === void 0) { timeout = 60 * 1000; }
@@ -4430,9 +4865,11 @@ var fng;
              {
              aggregate - whether or not to aggregate results (http://docs.mongodb.org/manual/aggregation/)
              find - find parameter
+             projection - the fields to return
              limit - limit results to this number of records
              skip - skip this number of records before returning results
              order - sort order
+             concatenate - whether to concatenate all of the list fields into a single text field (and return { id, text }[]), or not (in which case the documents - albeit only list fields and _id - are returned without transformation)
              }
              */
             var generateListQuery = function (options) {
@@ -4453,9 +4890,11 @@ var fng;
                 };
                 addParameter('l', options.limit);
                 addParameter('f', options.find);
+                addParameter('p', options.projection);
                 addParameter('a', options.aggregate);
                 addParameter('o', options.order);
                 addParameter('s', options.skip);
+                addParameter('c', options.concatenate);
                 return queryString;
             };
             // TODO Figure out tab history updates (check for other tab-history-todos)
@@ -4480,12 +4919,35 @@ var fng;
                 //           changed: changed
                 //         };
                 //       },
-                getListAttributes: function (ref, id) {
+                // return only the list attributes for the given record.  where returnRaw is true, the record's
+                // list attributes will be returned without transformation.  otherwise, the list attributes will be concatenated
+                // (with spaces) and returned in the form { list: string }
+                getListAttributes: function (ref, id, returnRaw) {
                     var actualId = typeof id === "string" ? id : id.id || id._id || id.x || id;
-                    if (typeof actualId !== "string") {
-                        throw new Error("getListAttributes requires a string id but was provided with ".concat(JSON.stringify(id)));
+                    if (typeof actualId === "object") {
+                        throw new Error("getListAttributes doesn't expect an object but was provided with ".concat(JSON.stringify(id)));
+                    }
+                    var queryString = returnRaw ? "?returnRaw=1" : "";
+                    return $http.get("/api/".concat(ref, "/").concat(actualId, "/list").concat(queryString), { cache: expCache });
+                },
+                // return only the list attributes for ALL records in the given collection, returning ILookupItem[]
+                getAllListAttributes: function (ref) {
+                    return $http.get("/api/".concat(ref, "/listAll"), { cache: expCache });
+                },
+                // return only the list attributes for records in the given collection that satisfy the given query conditions (filter, limit etc.)
+                // return ILookupItem[] if options.concatenate is true, else the raw documents
+                getPagedAndFilteredList: function (ref, options) {
+                    if (options.projection) {
+                        throw new Error("Cannot use projection option for getPagedAndFilteredList, because it only returns list fields");
+                    }
+                    if (options.concatenate === undefined) {
+                        options.concatenate = false;
                     }
-                    return $http.get('/api/' + ref + '/' + actualId + '/list', { cache: expCache });
+                    return $http.get("/api/".concat(ref, "/listAll").concat(generateListQuery(options)));
+                },
+                // return ALL attributes for records in the given collection that satisfy the given query conditions (filter, limit etc.)
+                getPagedAndFilteredListFull: function (ref, options) {
+                    return $http.get("/api/".concat(ref).concat(generateListQuery(options)));
                 },
                 readRecord: function (modelName, id) {
                     // TODO Figure out tab history updates (check for other tab-history-todos)
@@ -4493,7 +4955,11 @@ var fng;
                     //         if (tabChangeData && tabChangeData.model === modelName && tabChangeData.id === id) {
                     //           retVal = Promise.resolve({data:tabChangeData.record, changed: tabChangeData.changed, master: tabChangeData.master});
                     //         } else {
-                    return $http.get('/api/' + modelName + '/' + id);
+                    var actualId = typeof id === "string" ? id : id.id || id._id || id.x || id;
+                    if (typeof actualId === "object") {
+                        throw new Error("readRecord doesn't expect an object but was provided with ".concat(JSON.stringify(id)));
+                    }
+                    return $http.get("/api/".concat(modelName, "/").concat(actualId));
                     //           retVal = $http.get('/api/' + modelName + '/' + id);
                     //         }
                     //         tabChangeData = null;
@@ -4503,21 +4969,18 @@ var fng;
                     var options = angular.extend({
                         cache: useCacheForGetAll ? expCache : false
                     }, _options);
-                    return $http.get('/api/' + modelName, options);
-                },
-                getPagedAndFilteredList: function (modelName, options) {
-                    return $http.get('/api/' + modelName + generateListQuery(options));
+                    return $http.get("/api/".concat(modelName), options);
                 },
                 deleteRecord: function (model, id) {
-                    return $http.delete('/api/' + model + '/' + id);
+                    return $http.delete("/api/".concat(model, "/").concat(id));
                 },
                 updateRecord: function (modelName, id, dataToSave) {
-                    expCache.remove('/api/' + modelName);
-                    return $http.post('/api/' + modelName + '/' + id, dataToSave);
+                    expCache.remove("/api/".concat(modelName));
+                    return $http.post("/api/".concat(modelName, "/").concat(id), dataToSave);
                 },
                 createRecord: function (modelName, dataToSave) {
-                    expCache.remove('/api/' + modelName);
-                    return $http.post('/api/' + modelName, dataToSave);
+                    expCache.remove("/api/".concat(modelName));
+                    return $http.post("/api/".concat(modelName), dataToSave);
                 },
                 useCache: function (val) {
                     useCacheForGetAll = val;
@@ -4649,8 +5112,8 @@ var fng;
     var controllers;
     (function (controllers) {
         /*@ngInject*/
-        NavCtrl.$inject = ["$rootScope", "$window", "$scope", "$location", "$filter", "routingService", "cssFrameworkService"];
-        function NavCtrl($rootScope, $window, $scope, $location, $filter, routingService, cssFrameworkService) {
+        NavCtrl.$inject = ["$rootScope", "$window", "$scope", "$filter", "routingService", "cssFrameworkService", "securityService"];
+        function NavCtrl($rootScope, $window, $scope, $filter, routingService, cssFrameworkService, securityService) {
             function clearContextMenu() {
                 $scope.items = [];
                 $scope.contextMenu = undefined;
@@ -4659,12 +5122,6 @@ var fng;
                 $scope.contextMenuDisabled = undefined;
             }
             $rootScope.navScope = $scope; // Lets plugins access menus
-            $rootScope.isSecurelyHidden = function (elemId) {
-                return fng.formsAngular.elemSecurityFuncName && $rootScope[fng.formsAngular.elemSecurityFuncName](elemId, "hidden");
-            };
-            $rootScope.isSecurelyDisabled = function (elemId) {
-                return fng.formsAngular.elemSecurityFuncName && $rootScope[fng.formsAngular.elemSecurityFuncName](elemId, "disabled");
-            };
             clearContextMenu();
             $scope.toggleCollapsed = function () {
                 $scope.collapsed = !$scope.collapsed;
@@ -4740,15 +5197,19 @@ var fng;
                 }
                 return result;
             };
-            $scope.secureContextMenu = function () {
-                $scope.contextMenuHidden = $rootScope.isSecurelyHidden($scope.contextMenuId);
-                $scope.contextMenuDisabled = $rootScope.isSecurelyDisabled($scope.contextMenuId);
-            };
             function initialiseContextMenu(menuCaption) {
                 $scope.contextMenu = menuCaption;
                 var menuId = "".concat(_.camelCase(menuCaption), "ContextMenu");
-                $scope.contextMenuId = menuId;
-                $scope.secureContextMenu();
+                // the context menu itself (see dropdown.ts) has an ng-if that checks for a value of
+                // contextMenuId.  let's delete this until we know we're ready to evaluate the security
+                // of the menu items...
+                $scope.contextMenuId = undefined;
+                securityService.doSecurityWhenReady(function () {
+                    //... which we now are
+                    $scope.contextMenuId = menuId;
+                    $scope.contextMenuHidden = securityService.isSecurelyHidden($scope.contextMenuId);
+                    $scope.contextMenuDisabled = securityService.isSecurelyDisabled($scope.contextMenuId);
+                });
             }
             $scope.$on('fngControllersLoaded', function (evt, sharedData, modelName) {
                 initialiseContextMenu(sharedData.dropDownDisplay || sharedData.modelNameDisplay || $filter('titleCase')(modelName, false));
@@ -4911,7 +5372,8 @@ var fng;
         .factory('pluginHelper', fng.services.pluginHelper)
         .factory('recordHandler', fng.services.recordHandler)
         .factory('SchemasService', fng.services.SchemasService)
-        .factory('SubmissionsService', fng.services.SubmissionsService);
+        .factory('SubmissionsService', fng.services.SubmissionsService)
+        .factory('securityService', fng.services.securityService);
 })(fng || (fng = {}));
 // expose the library
 var formsAngular = fng.formsAngular;