Re: Announcement of a little browser demo of plone.jsonapi.* in action

On 2/1/14, 12:55 AM, Ramon Bartl wrote:
> Hi Matthew,
>
>> This looks awesome.
>> +1 for security review asap
>> +1 for moving into core pending security review
>> I haven't tried it yet, so I have a couple functionality questions:
>> 	• is it good-to-go with Dexterity content types?
>> 		• If no Dexterity yet, then +1 for extending it to Dexterity content types...and I will use post-haste
>> 	• I didn't see an example for collections...can these be set also?
>> Great job...super useful!
>>
>> Can't wait to play.
> Thanks a lot:) and good questions.
>
> You can basically add any custom route for Plone 3/4 sites with `plone.jsonapi.core`,
> it is as easy as this:
>
> from plone.jsonapi.core import router
>
> @router.add_route("/hello/<string:name>", "hello", methods=["GET"])
> def hello(context, request, name="world"):
>      return { ... }
>          "url": router.url_for("hello", values={"name": name}, force_external=True),
>          "hello": name,
>      }
>
> Since you get the context and request, you can grab any tool you need
> to fetch the informations you want to expose to the user.
>
> The `plone.jsonapi.routes` package is just a *route provider* which specifies
> such routes for the standard Plone (AT) content types -- yes, and also for collections:)
>
> It uses the portal catalog to search for the content with the permissions
> of the current logged in user, so you only get what you are allowed to see.
>
> If the user requests a detail URL (one with the UID at the end), the object gets waked up
> and an adapter (IInfo) provides the dictionary representation of the content type through
> Schema introspection.
>
> So basically I'm not bypassing Plone security in any way. You are only allowed to
> get/create/update/delete these contents where you have the right permission to do so.

So it checks 'Add portal content' and type-specific add permissions for 
creation, 'Modify portal content' for update and 'Delete objects' for 
delete?

Does it pay attention to field-level read/write permissions for 
get/update/create?


------------------------------------------------------------------------------
WatchGuard Dimension instantly turns raw network data into actionable 
security intelligence. It gives you real-time visual feedback on key
security issues and trends.  Skip the complicated setup - simply import
a virtual appliance and go from zero to informed in seconds.
http://pubads.g.doubleclick.net/gampad/clk?id=123612991&iu=/4140/ostg.clktrk