Salesforce.com

Understanding Expressions in Lightning

Posted on Updated on

Hi All,

Yesterday I stuck with Expressions in Lightning. While solving this I came to know about different ways of using Expressions and different types of these.

An expression is any set of literal values, variables, sub-expressions, or operators that can be resolved to a single value. You can use expressions for dynamic output or passing values into components by assigning them to attributes. Expressions are also used to provide action methods for user interface events(i.e. OnClick,OnHover).

Bound Expressions

Bound expression syntax is: {!expression}. Curly braces with “!” bang operator is used for Bound expressions.

If you are making any change using Bound expression it will immediately reflected on your component. Bound expressions are used to reflect changes on your Lightning Component. Below are examples of Bound expressions in component.

<aura:component>
	
	<!-- Accessing Fields and Related Objects -->
	<p>{!v.accounts.Name}</p>
	
	<!-- Concatinate value with String -->
	<p>{!'Hello ' + v.msg}</p>
	
	<!-- Ternary Operator -->
	<ui:button aura:id="likeBtn" label="{!(v.likeId == null) ? 'Like It' : 'Unlike It'}" />
	
	<!-- Conditional Markup -->
	<aura:attribute name="edit" type="Boolean" default="true"/>
	<aura:if isTrue="{!v.edit}">
		<ui:button label="Edit"/>
	<aura:set attribute="else">
		You can’t edit this.
	</aura:set>
	</aura:if>
	
	<!-- Adding two items -->
	{!(v.item1) + (v.item2)}
	
	<!-- Using Global Variables -->
	{!$Browser.isPhone}
	{!$Locale.timezone}
	
	<!-- Action Method -->
	<ui:button aura:id="likeBtn" label="Press Me" press="{!c.update}"/>
	
	<!-- Array Length -->
	{!v.myArray && v.myArray.length > 0}
	
</component>

Unbound Expressions

Unbound expression syntax is: {#expression}. Curly braces with “#” hash operator is used for Unbound expressions.

If you are making any change using unbound expression, it will not immediately reflect on your component. If you don’t want to reflect changes, you can use unbound expressions.

Note : Unbound expression changes are not reflected on component but they can be seen by javascript.

Below example show use of unbound expression in component.

//Component1.cmp
<aura:component>
    <aura:attribute name="truthy" type="Boolean"></aura:attribute>
     
    <aura:if isTrue="{#v.truthy}">
        True
    <aura:set attribute="else">
        False
    </aura:set>
    </aura:if>
    <ui:button aura:id="button" label="Check" press="{!c.update}"/>
</aura:component>
 
//Component1Controller.js
({
    update : function(component, event, helper) {
        component.set("v.truthy","false");
		console.log('----> '+component.get("v.truthy"));
    }
})
 
//Component1Renderer.js
({
    rerender: function(cmp, helper) {
        console.log('rerender'); 
        return this.superRerender()
    },
})

In above code when you click on “Check” button it will udpate unbound expression {!#v.truthy} in javascript controller. You will be able to see changes in console but they are not reflected on component.

Hope this will be helpful. Happy coding 🙂

Lightning Component Best Practices PART 2

Posted on

Hi All,

Few days before I wrote an article on best practices of Lightning Components. In that article I told you about best practices of Lightning Component Bundle(Controller, Helper, Renderer) and Events. Today I will tell you about best practices to create secure Lightning Components.

In Winter 16 release Salesforce introduced an important change to Lightning Component, In order to run Lightning Components in your org, you will be required to use the My Domain feature.

Why My Domain? At Salesforce, Trust is their number one value. The security team that reviews all changes to the Force.com platform have determined that requiring of My Domain will allow Salesforce to enact even better security around Lightning Components. And better security is good for everyone.

Because of this new feature insecurity is not neccessorily coming from Lightning Components but can come from JavaScript(Client Side) or Apex(Server Side). All the insecurities may come from JavaScript rather than from Lightning Component. Reason for this is the JavaScript from same domain can actually access,modify and read everything. You should follow below best practices to avoid insecurities from Client Side and Server Side. I tried to explore them.

Client Side

  • When modifying the DOM, avoid the use of HTML rendering functions such as innerHTML or $().append(). Rather use component getters and setters whenever possible.
  • //Component1.cmp
    <aura:component>
    	<aura:attribute name="msg" type="String"></aura:attribute>
    	<div><b>{!v.msg}</b></div>
    </aura:component>
    
    //Component1Helper.js
    ({
    	changeValue : function(component) {
    		component.set("v.msg","Changed value before Render"); // Modifying DOM using setter
    	},
    })
    
    //Component1Renderer.js
    ({
    	render: function(cmp, helper) {
    	   console.log('render');
    	   helper.changeValue(cmp); // Modifying DOM in renderer
    	   return this.superRender()
    	},
    })
    

    In above code I am modifying DOM using setter.

    The DOM may only be modified in a renderer. Outside a renderer, the DOM is read-only. Suppose if you are trying to modify DOM in a controller than you are playing out side of the cycle of aura. If you do modification in controller the renderer will wipe all the DOM modification and you will end up with no result.

    In above code I am modifying DOM in renderer.

    Note : JS code within a component can only modify DOM elements belonging to the component. For example, it cannot modify document head or directly access the DOM element belonging to another component. In order to modify a parent or sibling component, an event should be passed to the target component. Child components should only be accessed via their attributes, and not by accessing the DOM of the child component directly.

  • To change styles dynamically, use $A.util.toggleClass() or $A.util.addClass(),$A.util.removeClass().
    Use $A.util.toggleClass() for component instead of a DOM element.
  • //toggleCss.cmp
    <aura:component>
    	<div aura:id="changeIt">Change Me!</div><br />
    	<ui:button press="{!c.applyCSS}" label="Add Style" />
    	<ui:button press="{!c.removeCSS}" label="Remove Style" />
    </aura:component>
    //toggleCssController.js
    ({
    	applyCSS: function(cmp, event) {
    		var cmpTarget = cmp.find('changeIt');
    		$A.util.addClass(cmpTarget, 'changeMe');
    	},
    	removeCSS: function(cmp, event) {
    		var cmpTarget = cmp.find('changeIt');
    		$A.util.removeClass(cmpTarget, 'changeMe');
    	}
    })
    //toggleCss.css
    .THIS.changeMe {
    	background-color:yellow;
    	width:200px;
    }
    
  • Use $A.getCallback() to wrap any code that accesses a component outside the normal rerendering lifecycle, such as in a setTimeout() or setInterval() call or in an ES6 Promise. $A.getCallback() preserves the current execution context and grants the correct access level to the asynchronous code. Otherwise, the framework loses context and only allows access to global resources.
  • window.setTimeout(
    	$A.getCallback(function() {
    		if (cmp.isValid()) {
    			cmp.set("v.visible", true);
    		}
    	}), 5000
    )
    

    This sample sets the visible attribute on a component to true after a five-second delay.

  • Avoid the use of inline javascript except when referencing JS controller methods.
  • <div onmouseover="myfunction" >foo</div> //bad
    <div onmouseover="c.myControllerFunction" >foo</div> //OK
    
  • Do not overwrite window or document functions.
  • window.onload = function () {
       //some code
    }
    document.write = function() {
       //some code
    }
    
  • Don’t use Script or Link tag to include JavaScript or CSS file. Instead of this use use the [ltng:require] aura component.
  • <link type='text/css' rel='stylesheet' href='YOUR_CSS_FILE.css' /> //bad
    <script src="YOUR_JS_FILE.js"></script> //bad
    
    <ltng:require styles="CSS FILE 1,CSS FILE 2,..." scripts="JS FILE 1,JS FILE 2,.."></ltng:require> //OK
    
  • Avoid using absolute URL use relative URL with ‘/’ and encodeURL.
  • Events may only be fired within a controller or component file, but not in a renderer. If you fire an event in renderer the event will go and call the controller again and controller will instantiate again,setup data again and call renderer again and cycle will repeat. This will end up with an infinite loop.
  • Avoid using component. This component outputs value as unescaped HTML, which introduces the possibility of security vulnerabilities in your code. You must sanitize user input before rendering it unescaped, or you will create a cross-site scripting (XSS) vulnerability. Only use with trusted or sanitized sources of data.

Server Side

  • All controller classes must have the with sharing keyword. There are no exceptions. In some cases, your code will need to elevate privileges beyond those of the logged in user.
  • public class DemoController() {  //Unsafe
        
        @AuraEnabled
        public static String getSummary() {
            //code
        }
    }
    
    public with sharing class DemoController() {  //safe
        
        @AuraEnabled
        public static String getSummary() {
            //code
        }
    }
    
  • CRUD/FLS permissions are not automatically enforced in lightning components or controllers, nor can you rely on lightning components to enforce security (as the client is under the control of the attacker, so all security checks must always be performed server-side). You must explicitly check for for isAccessible(), isUpdateable(), isCreateable(), isDeletable() prior to performing these operations on sObjects.
public with sharing class DemoController() {
    
    @AuraEnabled
    public static Contact getContact(String fieldName) { //safe
        if(Schema.SObjectType.Contact.fields.getMap().get('Name').getDescribe().isAccessible()){
			//code
		}
    }
}

Above best practices will help your Lightning Components in passing through security review of AppExchange.

Hope this will be helpful cheers!! 🙂

Different Rendering Behavior Of Lightning Component

Posted on Updated on

Hi All,

In this article I will tell you how and when you can use/customize different Renderer.js functions of a Lightning Component. There are different types of renderer functions which are called automatically when a Component is Render, Rerender or Unrender. You can customize these functions to change default rendering behaviour of Component.

Let’s explore these functions.

Render

The framework calls render() function when component is being initialized/rendered. The render() function typically returns a DOM node, an array of DOM nodes, or nothing. The base HTML component expects DOM nodes when it renders a component. Use render function to modify DOM or to modify component markup.

//Component1.cmp
<aura:component>
	<aura:attribute name="msg" type="String"></aura:attribute>
	<div><b>{!v.msg}</b></div>
</aura:component>

//Component1Helper.js
({
	changeValue : function(component) {
		component.set("v.msg","Changed value before Render");
	},
})

//Component1Renderer.js
({
	render: function(cmp, helper) {
	   console.log('render');
	   helper.changeValue(cmp);
	   return this.superRender()
	},
})

In render() function I am calling helper method to modify DOM when component renders.

AfterRender

The afterRender function will be called by framework after render() function.AfterRender function allows us to further change an already rendered component. The afterRender() function enables you to interact with the DOM tree after the framework’s rendering service has inserted DOM elements.

Note :

  1. Both the functions will be called only once, you can keep your business logic that needs to run only once in these functions.
  2. Both functions can be used to modify DOM or markup.
  3. Don’t perform DML in render function. You can do in afterRender.

Rerender

Rerender function will be called when a component’s value changes due to user action like a button click or some other event like component/application event. Rerender function updates component upon rerendering of the component.

//Component1.cmp
<aura:component>
	<aura:attribute name="truthy" type="Boolean"></aura:attribute>
	
	<aura:if isTrue="{!v.truthy}">
		True
	<aura:set attribute="else">
		False
	</aura:set>
	</aura:if>
	<ui:button aura:id="button" label="Check" press="{!c.update}"/>
</aura:component>

//Component1Controller.js
({
	update : function(component, event, helper) {
		component.set("v.truthy","false")
	}
})

//Component1Renderer.js
({
	rerender: function(cmp, helper) {
		console.log('rerender'); 
		return this.superRerender()
	},
})

In above component when you click on “Check” button,update method will update component which in turn call rerender.

Unrender

Framework fires an unrender event when a component is deleted.The base unrender() function deletes all the DOM nodes rendered by a component’s render() function. It is called by the framework when a component is being destroyed. Customize this behavior by overriding unrender() in your component’s renderer. This can be useful when you are working with third-party libraries that are not native to the framework.

//Component1.cmp
<aura:component >

	<aura:attribute name="truthy" type="Boolean"></aura:attribute>
	
	<aura:if isTrue="{!v.truthy}">
		<c:Component2 />
	<aura:set attribute="else">
		Second Component is deleted
	</aura:set>
	</aura:if>
	
	<ui:button aura:id="button" label="Check" press="{!c.update}"/>
</aura:component>

//Component1Controller.js
({
	update : function(component, event, helper) {
		component.set("v.truthy","false")
	}
})

//Component1Renderer.js
({
	rerender: function(cmp, helper) {
		console.log('rerender'); 
		return this.superRerender()
	},
})

//Component2.cmp
<aura:component >
	I am in second component
</aura:component>

//Component2Renderer.js
({
	unrender : function (cmp, helper) {
		console.log('Component 2 unrender '); 
		return this.superUnrender();
	},
})

In above code Component2.cmp is deleted when you click on “Check” button on Component1.cmp. When Component2.cmp is deleted framework calls unrender method.

To know more about Best Practices of Lightning Component Rendering click here
Hope this will be helpful 🙂

Who Viewed Record Last Lightning Component

Posted on

Hi All,

In this article I will tell you how to create Lightning Component which shows list of users who viewed record.You can use this Lightning Component for any object whether it is a custom object or standard object.

This can be useful when trying to trace who last Viewed a record? There’s no way to do this in salesforce as of now.It would be great if you could see on a record if anyone has recently viewed it, so I thought to create this Component.

To implement this you have to do following things.
1) On any object you want to use this Lightning Component, create a new custom textarea(255) field called “Last Visited By“.
2) Set History Tracking on for this field.

When complete it will look like this.

Let’s walk through code.

LastVisitedController.apxc :

public with sharing class LastVisitedController{
    
    @AuraEnabled
    public static sObject getViewersList(String recordId, String objectName){
        System.debug('objectName = '+objectName +' recordId = '+recordId);
        
        String query = 'SELECT Id, Name, '+
                       '(Select OldValue, NewValue, Field From Histories Where Field = \'Last_Visited_By__c\' ORDER BY CreatedDate DESC) '+
                       'FROM '+objectName +' Where Id = \''+ recordId + '\' LIMIT 1' ;
        
        sObject obj = Database.Query(query);
        
        return obj;
    }
    
    @AuraEnabled
    public static void updateRecord(String recordId, String objectName){
        Datetime sdate = System.now();        //Format the datetime value to your locale        
        String sysTime = sdate.format('dd/MM/yyyy HH:mm');
    
        String query = 'SELECT Id, Name, Last_Visited_By__c '+
                        'FROM '+objectName +' Where Id = \''+ recordId + '\' LIMIT 1' ;
        
        sObject obj = Database.Query(query);
        obj.put('Last_Visited_By__c' , System.Userinfo.getFirstName() + ' '+ System.Userinfo.getLastName() +' '+ sysTime);
        update obj;
    }
    
}

The getViewersList method is used to return list of users who visited record recently. Method updateRecord is used to update “Last Visited By” field when a user visited record.

LastVisitedCmp.cmp :

<aura:component controller="LastVisitedController" implements="force:appHostable,force:hasRecordId,force:hasSObjectName,flexipage:availableForAllPageTypes">
    <ltng:require styles="/resource/SLDS/assets/styles/salesforce-lightning-design-system-vf.css"/>
    <!-- Atrribute Defination for Object Name -->
	<aura:attribute name="sObjectName" type="String"></aura:attribute>
    <!-- Atrribute Defination for Record Id -->
	<aura:attribute name="recordId" type="String"></aura:attribute>
    <!-- Atrribute Defination for Who visited -->
	<aura:attribute name="visitorsList" type="sObject"></aura:attribute>
    <!-- Event Handler for init Event-->
    <aura:handler name="init" value="{!this}" action="{!c.doInit}"></aura:handler>
    <!--page header-->
    <div class="slds">
        <div class="slds-page-header">
            <div class="slds-grid">
                <div class="slds-col slds-has-flexi-truncate">
                    <div class="slds-media">
                        <div class="slds-media__body">
                            <div class="slds-grid">
                                <h1 class="slds-text-heading--medium slds-m-right--small slds-truncate slds-align-middle">Recently Visited By</h1>
                            </div>
                        </div>
                    </div>
                </div>
            </div>   
        </div>
    </div>
    <!--Container-->
    <div class="container" style="overflow-y:scroll;height:300px">
        <ul class="slds-list--vertical slds-has-cards">
            <aura:iteration items="{!v.visitorsList.Histories}" var="h">
                <li class="slds-list__item">
                    <div class="slds-tile slds-tile--board">
                        <div class="slds-tile__detail">
                            <p class="slds-text-heading--medium">{!h.NewValue}</p>
                        </div>
                    </div>
                </li>
            </aura:iteration>	
        </ul>
    </div>
</aura:component>

The force:appHostable interface indicates the component can be hosted in the Salesforce1 Mobile app.
The flexipage:availableForAllPageTypes interface indicates the component can be used in App Builder.
The force:hasRecordId interface indicates the current record Id should be injected in the component’s recordId attribute.
The force:hasSObjectName interface indicates the current sObjectName should be injected in the component’s sObjectName attribute.

When the component is instantiated on the page, the current record Id and sObject are automatically injected in the recordId and sObjectName attribute. You can then make calls to the server passing the recordId and sObjectName as a parameter to retrieve or save data for that specific record.

LastVisitedCmpController.js :

({
	doInit : function(component, event, helper) {
		helper.getViewerList(component);
	},
})

LastVisitedCmpHelper.js :

({
	getViewerList : function(component) {
		var action = component.get("c.getViewersList");
        action.setParams({
            "recordId" : component.get("v.recordId"),
            "objectName" : component.get("v.sObjectName")
        });
        action.setCallback(this, function(action) {
        	component.set("v.visitorsList",action.getReturnValue());
        });
        
        $A.enqueueAction(action);
	},
    updateRecord : function(component) {
		var action = component.get("c.updateRecord");
        action.setParams({
            "recordId" : component.get("v.recordId"),
            "objectName" : component.get("v.sObjectName")
        });
        $A.enqueueAction(action);
	},
})

LastVisitedCmpRenderer.js :

({
    afterRender : function(component,helper){
        this.superAfterRender();
        helper.updateRecord(component);
    }	
})

The afterRender will be called when Component render completly. It will call helper function which updates “Last Viewed By” field of current record in the background.

🙂