Re: State of Plone web api

On 17 Jan 2014, at 12:34 pm, David Glick (Plone) <david.glick-z4DKO/[email protected]> wrote:

> On 1/16/14, 5:26 PM, Dylan Jay wrote:
>> On 17 Jan 2014, at 12:08 pm, David Glick (Plone) <david.glick-z4DKO/[email protected]> wrote:
>> 
>>> On 1/16/14, 5:00 PM, Elizabeth Leddy wrote:
>>>> The most obvious question I have at this point is…. do people really need it that bad? I rarely set objects with an “api” in any framework, and if its needed I am usually wrapping like crazy to maintain certain behaviors and do extra… everything. GETting is obviously a win for ajax front ends but setting… I have my doubts.
>>>> 
>>>> Please note I could be absolutely in a different boat on this - thats why I’m asking. Nothing troll-y intended.
>>>> 
>>> I am working on a project currently with a PHP-based system. Fortunately it has a pretty good REST API, and I can get all the data imported into it by calling that from Python. Similarly, having a good REST API would provide a path for developers to get data into Plone even if Python isn't their preferred language. It would also provide a path for data to get updated in Plone in response to some event happening in some different system on another server.
>> What do you think of a REST api that lets you upload python expressions? Even if you didn't know python, you could at least cut and paste these from examples in developer documentation. It would solve the problem of having to write yet another api that is likely to not get maintained don't you think?
>> 
> I think it's a bad idea. It's very likely to have security holes (as a member of the security team looking at the series of issues we've patched over the last few years, I don't trust restricted python),

I guess you'd say the same about TAL expressions as they are essentially just one line restricted python?

> and it wouldn't be usable by people who don't know Python.

For the vast majority of cases that wouldn't be a problem since you'd only be doing simple things like calling a function e.g.

/myfolder/mypage/pyapi?tal=python:here.getExampleField() 
or 
/myfolder/mypage/pyapi?tal=here/getExampleField 

ie it's python but it's the same syntax as php or javascript so as long as you are a programmer you should be able to get it easily.

but the advantage is you could do things you can't do using xmlrpc or REST e.g

/myfolder/mypage/pyapi?tal=python:here.setExampleField(here.getField2())

or being able to use dexterity api as it currently exists

/myfolder/myDXpage/pyapi?tal=python:here.title%3Dvalue&value=blah

All of which is still the same syntax you'd use in js or php.

The real bonus is that no one needs to write another api, virtually no new code needs to be created and no new documentation needs to be created.
but of course if it's not secure we need to think of something else. I just can't see us creating and maintaining a new REST api.

maybe if both DX and AT supported a single method of set_fields( dict ) at least my problem would be solved :)




------------------------------------------------------------------------------
CenturyLink Cloud: The Leader in Enterprise Cloud Services.
Learn Why More Businesses Are Choosing CenturyLink Cloud For
Critical Workloads, Development Environments & Everything In Between.
Get a Quote or Start a Free Trial Today. 
http://pubads.g.doubleclick.net/gampad/clk?id=119420431&iu=/4140/ostg.clktrk