Hey Alessandro!
So our plan involves a lot of URI parsing to work around the two things you
mentioned there. Since for every new form created, the URI will start with
"/fr/orbeon/builder/new", we have that as an acceptable URI.
As far as the new form summaries go, since the URI for a summary is
"/fr/app/form/summary", we are only going to have a few apps that we allow
to pass through, and from there we are going to let our program that we are
connecting Orbeon Forms to block everything that isn't a form saved in our
database to that app. With this part I don't know if I'm explaining it as
well as it was explained to me, just because I don't fully understand how we
are going to keep all of our users from viewing whatever form they want just
by writing in a different URL.
Blocking the overall summary page "/fr/" from end users is something we
absolutely want to do.
Our workaround seems like it's fine for like broke-stroke blocking, but I
don't know how tricky it will be within our program to track who can see
what.
I will definitely post back when we work this out!
Thanks!
Christina