feat(data): add sheet addressing

[tripodsan]

fixes #118

changes

• the sheet inside an excel workbook or google spreadsheet can now be addressed using the sheet parameter.
• only sheets having the helix- prefix can be addressed
• if the workbook or spreadsheet does not have any helix- prefixed sheets, the first one is returned.
• By default the used ranged of the selected sheet is returned.
• For excel, A table can be addressed using the table request parameter, which can be a table name or an index. For example, table=Table1 will return the table with the name Table1, table=1 will return the second table in the sheet.
• Note that specifying a table index will result in an additional request to lookup the table names.

[github-actions]

This PR will trigger a minor release when merged.

[codecov]

Codecov Report

Merging #162 into master will not change coverage.
The diff coverage is 100.00%.

@@            Coverage Diff            @@
##            master      #162   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           11        11           
  Lines          292       320   +28     
=========================================
+ Hits           292       320   +28     

Impacted Files	Coverage Δ
src/matchers/excel.js	100.00% <100.00%> (ø)
src/matchers/google.js	100.00% <100.00%> (ø)

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update a120f29...d2b2f54. Read the comment docs.

[trieloff]

If we have to break compatibility, let's make sure we update Google and Excel at the same time.

Overall, I'd much prefer a non-breaking change.

[tripodsan]

If we have to break compatibility, let's make sure we update Google and Excel at the same time.

ok.

Overall, I'd much prefer a non-breaking change.

yes, we could serve the first sheet, if there is no helix-default. but this is one of the security problems we want to fix.
otherwise, you can expose any excel workbook, even the ones not meant for web.

[trieloff]

yes, we could serve the first sheet, if there is no helix-default. but this is one of the security problems we want to fix.
otherwise, you can expose any excel workbook, even the ones not meant for web.

A more gentle change would be to use the new behavior whenever there is a sheet called helix-* and serve the first sheet otherwise.

[tripodsan]

yes, we could serve the first sheet, if there is no helix-default. but this is one of the security problems we want to fix.
otherwise, you can expose any excel workbook, even the ones not meant for web.

A more gentle change would be to use the new behavior whenever there is a sheet called helix-* and serve the first sheet otherwise.

exactly not. otherwise you can expose any excel workbook that does not have an helix-* sheet in it.

[trieloff]

You can only expose the first sheet. I wouldn't allow the table parameter at all. And this only applies to workbooks that have been shared with Helix in the first place, so I don't see how this would result in additional disclosure.

[tripodsan]

You can only expose the first sheet.

currently, yes. you can only expose the first sheet.
with this enhancement, you can also expose other sheets. as requested in the issue.

I wouldn't allow the table parameter at all.

that would be another breaking change. in case someone really wants to share a specific table in a sheet, I think this is useful.

And this only applies to workbooks that have been shared with Helix in the first place, so I don't see how this would result in additional disclosure.

yes - but, people have all sorts of workbooks in their drive that they might expose accidentally. so better safe than sorry.

[tripodsan]

A more gentle change would be to use the new behavior whenever there is a sheet called helix-* and serve the first sheet otherwise.

After discussion with @davidnuescheler we decided to go with this idea.

[trieloff]

🎉 This PR is included in version 1.9.0 🎉

The release is available on:

• v1.9.0
• GitHub release

Your semantic-release bot 📦🚀