case 4719 - report templates no longer hold the renderer's token or download key

The report page gets placeholders for the token and download key; request
interception (ReportApiRelay, now in every kind of install) puts the real
values only on the page's requests to ayApiUrl, then relays them (IIS) or
lets the browser continue. Requests to other addresses go out unchanged,
without credentials. Notification reports keep their rights. Report
scripting manual and changelog updated. F20 fixed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/8.0/ayanova/docs/ay-report-edit.md

@@ -304,8 +304,8 @@ ayClientMetaData:
 {
     "UserName": "AyaNova username",
     "UserId": "23",
-    "Authorization": "Bearer eJhbGciO...token...data...hb9JyjcWl3Tib",
-    "DownloadToken": "IslXKU....token....data...here....Bg2Vx0yT2rQ",
+    "Authorization": "Bearer ay-report-render-token",
+    "DownloadToken": "ay-report-render-download-key",
     "TimeZoneName": "America/Los_Angeles",
     "LanguageName": "en-US",
     "Hour12": true,
@@ -351,7 +351,7 @@ ayServerMetaData:
 }
 ```
 
-- ayApiUrl - this is the URL of the server relative to the report generator and is useful for calling AyaNova API methods in your prepare data function to bring in sources of information from other areas of AyaNova that might not be directly available to your report
+- ayApiUrl - this is the URL of the server relative to the report generator and is useful for calling AyaNova API methods in your prepare data function to bring in sources of information from other areas of AyaNova that might not be directly available to your report. Always call the AyaNova API through this URL (or the API convenience functions below, which use it): the User's access is only added to requests made to this URL (see [API Usage](#api-usage))
 - HasXXLogo - these keys are set to true if a Logo has been uploaded for each size to AyaNova and are useful for controlling whether or not to show a logo on a report template as can be seen in many of our sample reports
 - Company XXX fields - these fields represent your company information as entered in Global settings to provide a centralized source of information for all reports requiring company contact or address data
 
@@ -559,9 +559,16 @@ The `ayGroupByKey` function does no sorting so the data will be returned in the
 
 The full power of the [AyaNova developer's API](api-intro.md) is available to reports to incorporate data from anywhere in AyaNova as required.
 
-The currently logged in User's API Bearer access token is provided for accessing API routes via the `ayClientMetaData.Authorization` value (see above).
+API calls from a report run with the access of the User running the report, so a report can only do what that User could also do in the AyaNova application. Reports attached to [customer notifications](customer-notify-subscriptions.md) run with full administrative access.
 
-You should not store a static copy of an API Bearer access token or hard code it into your templates because it changes regularly and will expire the moment the User logs in to AyaNova.
+The report itself never holds the User's actual credentials. The `ayClientMetaData.Authorization` and `ayClientMetaData.DownloadToken` values are stand-ins, and the AyaNova server puts the User's actual access in their place only on requests made to the `ayApiUrl` address. So API calls and attachment images work as usual through `ayApiUrl`, but:
+
+- an API call to any other address, including your AyaNova server's own public address typed into a template, is made without the User's access and will be refused; use `ayApiUrl` instead
+- a link to an attachment printed in the finished report (for example from a wiki) does not include a download key and will not open the attachment
+
+Because a report template's script runs with the access of whoever runs the report, only Users with the full "Business administration" role can create or edit report templates.
+
+You should not store a static copy of an API Bearer access token or hard code it into your templates.
 
 While it is possible to login via a script using alternate credentials and access the API with alternative access to the current logged in user, this opens a security hole as you would need to hard code credentials into the report script and for this reason is **absolutely NOT recommended**.
 

docs/8.0/ayanova/docs/changelog.md

@@ -29,6 +29,7 @@ IN PROGRESS
 - Server: AyaNova now checks the email (SMTP) server's security certificate when sending email. If your mail server uses a self-signed or internal certificate and email notifications stop after upgrading, see [SMTP certificate check](ops-config-smtp-accept-any-certificate.md).
 - Server: after repeated failed login attempts, further attempts for that login, or from that address, are refused for a few minutes.
 - Server: new [trusted reverse proxies](ops-config-trusted-proxies.md) setting for a reverse proxy that runs on a different computer from the AyaNova server, so AyaNova sees each user's own address.
+- Server: while a report renders, its template no longer holds the User's actual access token or download key; the AyaNova server adds the User's access only to the report's requests to the `ayApiUrl` address. Templates that call the AyaNova API through any other address need to be changed. See [API usage in reports](ay-report-edit.md#api-usage).
 - Server: users with the "Business administration - restricted" role can view [report templates](adm-report-templates.md) but no longer create, edit or import them, as described for that [role](ay-biz-admin-roles.md). Give the full "Business administration" role to users who edit report templates.
 - Server: the server information page at `/api/v8/` no longer shows license details.
 - Server: business logo uploads must be PNG, JPEG, GIF, WebP or SVG images, and need full rights to global settings. See [business logos](adm-global-logo.md).