draft: Integrate grist databases into docs (Panographix - HackDays 2025)

[matts2cant]

⚠️ This PR is a draft and needs to be cleaned ⚠️

Purpose

Merge the HackDays 2025 “database & charts” prototype into the public Docs repository to kick-start native data-driven capabilities (tables, charts, embeds) for civil-servant users while preserving Docs’ friendly UX.

Proposal

This PR introduces three custom blocks developed during HackDays 2025:

1. <DatabaseBlock> – lets authors create a new Grist table or pick an existing one directly from the editor, then display and edit the data inline.
2. <EmbedBlock> – safely embeds third-party content (maps, videos, etc.) via an iframe wrapper.
3. <ChartsBlock> – renders configurable charts (bar, line, pie…) based on a Grist view the user selects.

Behind the scenes we rely on Grist as a lightweight backend, but the UI hides the Grist complexity so that non-technical agents can stay focused on their documents.

Known limitations / next steps

• General cleanup of the code
• Authentication: today we pass a hard-coded Grist API token (env var GRIST_TOKEN). We aim to fetch it via OIDC (ProConnect) before merge.
• The <ChartsBlock> currently supports only one simple series and lacks style options. We'll probably end-up merging only the database and embed blocks first, then do charts in another PR.
• Accessibility review (ARIA roles, colour contrast) still pending.

Screenshot

[gitguardian]

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

Since your pull request originates from a forked repository, GitGuardian is not able to associate the secrets uncovered with secret incidents on your GitGuardian dashboard.
Skipping this check run and merging your pull request will create secret incidents on your GitGuardian dashboard.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
-	-	Bearer Token	67e29ff	src/frontend/apps/impress/src/api/gristApi.ts	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Revoke and rotate the secret.

2. If possible, rewrite git history with git commit --amend and git push --force.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

[matts2cant]

FYI, the API token detected by gitguardian was from a local grist install, this will of course be removed :)

[matts2cant]

@virgile-dev @sampaccoud

Hi there ! We've freed-up time from @SimonClo who will help me get this PR cleaned-up and merge-ready.
We have a lot of cleaning to do, but there is 2 blocking points we need to address :

• Right now the custom block asks the user for a Grist API token the first time he creates the database (not great UX). Long-term, we’d like to make this seamless and fetch the API token via OIDC/ProConnect. What is your take on this ? Do you know if that’s possible ? Can you point me to the right person on the Grist team ?
• We’ve run into some CORS issues when implementing the feature. We worked around it by running Grist locally, but that’s going to be a problem in production. I see two possible solutions for now: either change Grist’s CORS policy, or have the Django backend act as a proxy to the Grist API. What do you think?

[sampaccoud]

Hi @matts2cant The product owner in DINUM for Grist is @vviers and @jonathanperret worked both on Grist and on OIDC resource server in ProConnect. He is probably the good person to add resource server to Grist so we can create a project and read from our projects with a resource server token.

Regarding the CORS issue, we should probably treat it the same way and set the CORS header in Grist responses when answering to a resource server request...?

[virgile-dev]

Nice ! Thank you for creating the PR. It would be awesome to see this merged into Docs.

[SimonClo]

Hi @vviers, hi @jonathanperret,

Hope you're both doing well. Just following up to see if you’ve had a chance to review the two blocking points we mentioned regarding our Grist integration, and to get your input on the best way forward.

1. OIDC/ProConnect token:
Do you think it would be possible to add Grist as an OIDC resource server, so it can accept and validate tokens issued by ProConnect? If so, what would be the prerequisites or next steps to set this up?

2. CORS issue:
We’ve identified two potential approaches:

• Update Grist’s CORS policy to allow requests from our domain(s), ideally when a valid OIDC token is present.
• Use our Django backend as a proxy to relay requests to the Grist API.

From your perspective, which approach would be cleaner or more secure in the long term?

Thanks again for your help!

[vviers]

1. OIDC/ProConnect token:
   Do you think it would be possible to add Grist as an OIDC resource server, so it can accept and validate tokens issued by ProConnect? If so, what would be the prerequisites or next steps to set this up?

Yes, absolutely possible and desirable. The way forward is to implement this in grist-core (https://github.com/gristlabs/grist-core) and have this merged :)

This is quite a big, security-heavy project so it might take some time to review, but I think @jonathanperret should be able to start working on this soon-ish (though you are more than welcomed to give it a whirl if you want)

[SimonClo]

Thanks @vviers for your answer ! Regarding the CORS issue would you have an opinion on the subject ?

By the way, we are closing this PR because we have split it into two new ones:

• one for the database block (Integrate grist databases into docs (Panographix - HackDays 2025) #1082)
• a second for the embeddable block (Integrate embedded block into docs (Panographix - HackDays 2025) #1083)

We've decided to leave aside for the moment the charts block, which still needed a lot of rework.

[matts2cant]

Closing this PR because we split it in two :

• one for the database block (Integrate grist databases into docs (Panographix - HackDays 2025) #1082)
• a second for the embeddable block (Integrate embedded block into docs (Panographix - HackDays 2025) #1083)