Re: State of Plone web api

On 1/16/14, 4:46 PM, Dylan Jay wrote:
> On 17 Jan 2014, at 3:26 am, Elizabeth Leddy <[email protected]> wrote:
>
>> On January 16, 2014 at 2:19:17 AM, Rok Garbas ([email protected]) wrote:
>>
>>> i'm not sure what the state of the work is. but there was an idea that
>>> plone.api could be used and expose most of its calls also via json
>>>
>>> https://github.com/xiru/plone.api.json
>> The main issue with that was that it has no real security and required manage portal permissions. At the emerald sprint last year I expanded on it and added support for behaviors, included better accessors for dexterity attributes. The only reason I never finished merging it was that writing the test cases to check security was daunting, and like most things open source, my use case for it faded (and thus, my motivation). If someone wants to integrate it I can help: https://github.com/eleddy/puget.batshitcrazy . The main roadblock is getting the dexterity branch tested - you can rip anything you want for your own stuff from https://github.com/eleddy/plone.dexterity/compare. Really, thats the core code that would make api work easy to work with. The rest is slapping a pretty face on it.
> Unfortunately as far I can see this only handles serialising a single object which isn't the major problem.
>
> The example I have that doesn't work with the above api is setting fields.
>
>
> We have in the past said things along the line of "everything in plone is a web api because of the zpublisher and xmlrpc support". I guess the point I'm trying to make is we seem to be writing methods and api in a variety of inconsistent styles all with python in mind, lots of which don,t translate to the web using our existing methods of calling them via the web. plone.api is yet another example written with python in mind and does not translate to the web.
>
> We should decide what is our overarching approach to web apis.
> - Do we create a brand new api which is web centric and has REST bindings? e.g http://pythonhosted.org/wsapi4plone.core/

Yes. (Though wsapi4plone appears to be based on xmlrpc rather than REST. 
REST would be nice, since then you wouldn't need much in the way of a 
client library except for 'requests'.)
> - Do we replace XMLRPC with something else that works for a much greater number of our existing apis? e.g. allowing calling methods with named arguments such as json-rpc [1]
> - or perhaps even an api where we can post arbitrary python expressions that get executed as restrictedpython and the results marshalled as json?
>     - eg /myfolder/@@pyapi?__code__=context.mypage.title%3Dvalue&value=blah. Anyone know if this could be made secure enough?

No.

------------------------------------------------------------------------------
CenturyLink Cloud: The Leader in Enterprise Cloud Services.
Learn Why More Businesses Are Choosing CenturyLink Cloud For
Critical Workloads, Development Environments & Everything In Between.
Get a Quote or Start a Free Trial Today. 
http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk