RFC: HTTP API approach (REST)

This is a multi-part message in MIME format.
--------------28D9AAEB67829ADA16754528
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable

Hi,

I have implemented a mock for a resource-centric Horde API (Kind of REST
Level 1).

Major roadblock was understanding how the Horde Controller Framework
(rampage) actually works and where to change bits which seemed to get in
my way. Please comment if this goes into the desired direction. The
earlier I know which bits are not likely to go into upstream horde, the
easier I can adopt.


Overview:

I basically cloned the endpoint file rampage.php into an own app,
changing some details.

We do not auth upfront. We may want to allow public=C2=A0 access to some
resources or use a non-standard userbase, think API users/machine users
or we want to enforce auth per request, i.e. no cookie/session key.
Depends on case

We use a modified RequestMapper to understand registry API names
This RequestMapper looks in the first /slug/ of the URL for API names
(while the original mapper looked for Application names)

Thus, the URL does not reveal which horde app is actually implementing
the resource. The implementing app's routes.php config file matches the
route to a controller and may require an explicit authentication
scenario (like method http-auth, backend horde-auth). Otherwise we fall
back to some configured global (no auth or http-basic)

The original Horde Controller Framework's runner understands pre and
post filters but the default SettingsExporter noops. A base "api"
controller class exists chiefly to override the SettingsExporter for all
derived controllers.

This SettingsExporter understands authentication and permission related
optional extra keys in routes.php and configures suitable pre filters.

I intentionally did not yet try to integrate this with either
base/rampage.php or base/rpc.php at this point.


Status:

The current repo ships with a toy usecase where the "api" app itself
exposes an endpoint /api/introspection/apps
However, the auth module is not yet implemented, the endpoint currently
runs unauthenticated.
The controller is just for presentation. A real base controller will
need to provide different behavior on GET, POST and most likely some
request details/headers (json or xml, language preference, pagination...)=


https://github.com/ralflang/horde-api

This is really just a first draft to see if it's worth to continue or if
it is a flawed design. There is so much to add next.


How to run:

- checkout into a horde git tree as "api" directory
- copy the registry snippet from /doc/ to base/config/registry.d/
- run git-tools dev install
- create a config via the menu
- you can run or ignore the db migration file, doesn't matter
- hit $horde/api/introspection/apps for the toy usecase

Regards,
Ralf


--------------28D9AAEB67829ADA16754528
Content-Type: application/pgp-keys;
 name="pEpkey.asc"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
 filename="pEpkey.asc"

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQENBFvSz9ABCAC/D3VOv9UiDxS9rLwc2SYOKj7kg5ERpKULorWII7QcIc8PC5xt
OlxRxI8sg15y8JvtrPo8FJG9RfDiwbqrRSL4nzlIui960c/SM9ayaXR9Q8YPRV93
PVZH94tdMdnO65tsMYmuwMtrN6DOokyT9snS++NHjH7KG2SnGu6lsonLF+Q1oxY4
c+yHZpRcHekTIKU1kuBGq5z/2WvdKq+mmpXOyZMDUDcjta0SsZTWCjbEhvDR69ks
+HleY2okRL+7oIjjwxscikGEU/w60AMl7K+js1sVCImaU/iknNw6zooOqttIQ2D5
TgvMSOhb2J9M4adUWWIjvu34rjzkA29fBJ/ZABEBAAG0HlJhbGYgTGFuZyA8bGFu
Z0BiMS1zeXN0ZW1zLmRlPokBVAQTAQgAPhYhBDyjTDPbiozTL6xj+U/BHU5Zc3Iw
BQJb0s/RAhsDBQkB4TOABQsJCAcCBhUKCQgLAgQWAgMBAh4BAheAAAoJEE/BHU5Z
c3IwGQUH/ity/TiyE0hPR40lAVxRp6DSmiMXj4N1ZNxKpvkZpvrJGFA8N0qmxQlj
uaVbPbZmbY1AUiJ3VrbWMIWq+DGcmghdC4f0ePfRBzQ72S8kzNEnaTbRurxafFIT
nIHQ2m6VSH1V397ItW9f/nmtPQfcsDnJLfyN8wCKRmZtgBRCfCJPIQsWSibL5lML
C0Os2UaHgRRCOcp1da4ETH8UlT5PxLWLKkaQEqY6fwlizAlWLsPT1Wj3CnI0OfAI
HFkt2lv+rpAkmRhhpfuNYm/8LHN/w4OovR7JgVRv+k/HkHj24ghc9+eSCgmu1v/k
3fsO+ozNSNnG3vXKZY+e+LP2oQyEMga5AQ0EW9LP0AEIANHRShH5i8iethpLtwRK
QkFIFQulLwfZgrKdXWdTROB6UT3tDWtojkhKwk9wvR3X2Qck5HTF9ZhuqaaPAxyM
VO8GlkN2OJnE+E7CYuc32E06CUpn9z6oY436qehoq6gAdCXFz8lWJlSuJt6MaHs2
2IomeHmbOPOtRl8RdMzmPyzmFfpQDbOBvOupBUHLYa5Yo1gxsYCB4PDQwJIWvAIh
ASK04Ydins8LvhwHU0PnwaLjHlC6VRkiyrOqsyLZqor/mE1z1yi1HU4DdHtSq13z
HF4R+F0uECuvrpx0KiZFC5UfNeT1f35FS91Yu38Pjq/dKsOJ6XmLtKy6uFOF2KZZ
sC8AEQEAAYkBOwQYAQgAJhYhBDyjTDPbiozTL6xj+U/BHU5Zc3IwBQJb0s/QAhsM
BQkB4TOAAAoJEE/BHU5Zc3IwepEH9jViFWaw4ho2Imo6N6svLalzkDqwpqecR1me
eVncI0W707uB2M4Y4ji9HCxVz5QgAKA4S0GKXUzjKPgbFe2sqI/zM5E6eWiUwcGT
+AA6lvhJb/YKkQ7jZ69CAc09+sV5HFPKMo19Yxpsz45jXhgtlCsCkqcobtEm90Qg
o3HeZ1gJ0VGKxRHakyAsgh5lfKnpIUCRLxmcYpUTCZ0oLhafrwfKlW3X7x0jBC3f
EbYJmGcUBIH7vTxXcmsfh0Ury7JxMjsywsi9AoeVInpO/cCNYYPlsOgO/98hJYGg
kOgZizmcxHWKR+5qM0ufNQoQYU1OhSovkVtNFSn5+lOMiBwtTA=3D=3D
=3DoyfV
-----END PGP PUBLIC KEY BLOCK-----

--------------28D9AAEB67829ADA16754528
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

-- 
dev mailing list
Frequently Asked Questions: http://wiki.horde.org/FAQ
To unsubscribe, mail: [email protected]

--------------28D9AAEB67829ADA16754528--