Protecting script Google Spreadsheet through standalone Apps Script - google-apps-script

Question

I have a spreadsheet that I share with other people trough a link to make a copy.
In that spreadsheet I have a script and I don't want that other people can see my script.
To protect my script from this spreadsheet I moved it to a standalone spreadsheet.
In my spreadsheet I use a Trigger.
My standalone script starts with:
function onEdit(e) {
...
This script changes some cells when cell G13 changes.
My script in my spreadsheet is:
function createSpreadsheetOpenTrigger() {
const ss = SpreadsheetApp.openById("1Ik3ywr00UIQH9lwvEPYI1wi6xVpBDN8QVtZabtG96gY");
ScriptApp.newTrigger('onEdit')
.forSpreadsheet(ss)
.onEdit()
.create();
}
If I change cell G13 in my spreadsheet, nothing happens.
What do I do wrong?
Documentation: https://developers.google.com/apps-script/guides/triggers/installable#managing_triggers_programmatically

Answer 1

In your script of createSpreadsheetOpenTrigger() in the container-bound script of Spreadsheet, onEdit is put in a standalone script. In this case, unfortunately, onEdit in the standalone script cannot be run from Spreadsheet. I think that this might be the reason for your current issue.
Pattern 1:
In this pattern, your showing script is modified. I thought that this pattern might be close to your expected situation.
1. Container-bound script side.
In this case, please remove your script from your container-bound script. In this pattern, only a standalone script is used.
Also, in this case, even when Spreadsheet has no container-bound script, this pattern can be used. Only the below standalone script can be used.
2. Standalone script side.
Please modify your standalone script as follows. Please set the spreadsheet ID of your Spreadsheet to spreadsheetId and save the script.
function createSpreadsheetOpenTrigger() {
const spreadsheetId = "###"; // Please set the spreadsheet ID of your Spreadsheet.
const ss = SpreadsheetApp.openById(spreadsheetId);
ScriptApp.newTrigger('installedOnEdit').forSpreadsheet(ss).onEdit().create();
}
// In this pattern, please set your script in this function.
function installedOnEdit(e) {
e.range.setValue(JSON.stringify(e));
}
3. Install OnEdit trigger.
In order to install OnEdit trigger, please run createSpreadsheetOpenTrigger. By this, the OnEdit trigger is installed.
4. Testing.
Please edit the cell in your Spreadsheet. By this, the script of the standalone script is run, and you can see the event object in the edited cell.
And, in this case, the other users cannot see your standalone script. I thought that this might be your expected situation.
Note:
As an important point, it supposes the following sample situation.
User "A" is the owner of Google Spreadsheet.
User "B" has the writer permission for the Spreadsheet of user "A".
Under this condition, when user "A" creates a standalone script including the following script. And, run createSpreadsheetOpenTrigger.
function createSpreadsheetOpenTrigger() {
const spreadsheetId = "###"; // Spreadsheet ID of the owner's spreadsheet.
const ss = SpreadsheetApp.openById(spreadsheetId);
ScriptApp.newTrigger('installedOnEdit').forSpreadsheet(ss).onEdit().create();
}
function installedOnEdit(e) {
e.range.setValue("ok1");
}
And, when user "B" creates a standalone script including the following script. And, run createSpreadsheetOpenTrigger.
function createSpreadsheetOpenTrigger() {
const spreadsheetId = "###"; // Spreadsheet ID of the owner's spreadsheet.
const ss = SpreadsheetApp.openById(spreadsheetId);
ScriptApp.newTrigger('installedOnEdit').forSpreadsheet(ss).onEdit().create();
}
function installedOnEdit(e) {
e.range.offset(0, 1).setValue("ok2");
}
In the above situation, when user "A" or "B" edit a cell of the Spreadsheet, the values of ok1 and ok2 are put into the edited cell and the right side of the edited cell. From this situation, it seems that both script are run to the same Spreadsheet. It is considered that when other users have the write permission, when the above method is used, the edited information can be retrieved.
Pattern 2:
In this pattern, a library is used.
From your situation, if you have both the standalone script and the container-bound script of Spreadsheet, how about using the standalone script as a library? When the standalone script is used as the library and it is loaded on the container-bound script of Spreadsheet, the script of the standalone script can be seen by only you. Other users cannot see it. I thought that this might be your expected situation.
When this is reflected in a sample script, please do the following flow.
1. Prepare a standalone script.
Please copy and paste the following script to the script editor of the standalone script.
function myFunction(e) {
return {message: "From hidden script.", object: e};
}
If you want to hide the script, please write it to this project.
2. Deploy standalone script as a library.
Please deploy the standalone script as a library. You can see the official document at here. In this case, it is not required to share the standalone script. I think that this point is for your goal.
3. Prepare a container-bound script.
Please copy and paste the following script to the script editor of the container-bound script of Spreadsheet. And, please install the library. Ref And, in this sample, please install the library as Lib. By this, the library is used.
And, please install the OnEdit trigger to the function installedOnEdit.
function installedOnEdit(e) {
const res = Lib.myFunction(e);
e.range.setValue(JSON.stringify(res));
}
4. Testing.
Please edit a cell of the Spreadsheet. By this, installedOnEdit is run by the installable OnEdit trigger, and you can see message: "From hidden script." in a cell. And, installedOnEdit uses the script of Lib. And, other users cannot see the library. I thought that this might be your expected situation.
References:
Installable Triggers
Libraries