28 May
2008
28 May
'08
2:31 p.m.
Hi, Vincent.
Vincent Massol wrote:
We should probably have 2 Java APIs: one with restricted rights and
one with unrestricted rights. Some of our org.xwiki components will be
able to call the unrestricted rights api (we need to define how that
will work - security policy?). But this is not related to Velocity.
For example if, as a user, I write a new component I should only be
able to call the restricted rights API, unless I have some extra
rights set up or unless I modify the "container security policy".
We can create 2 QueryManagers: one with only secure languages, and
another with all languages.
Ok. We need QueryManager for Java at first.
This sounds fine. Thanks for idea.
But this is implementation specific. We need QueryManager#createQuery in
any case.
--
Artem Melentyev
4) I'd really like that we try to remove any
velocity-specific API so
that we have only 1 Java API for all. Maybe we can introduce some
velocity tools to handle the cases where you think it is required.
What would be those cases?
Main issue are check rights for returned documents
and shorter
API (ex:
QueryManager#xpath(""), Query#setParams(List)).
We can expose QueryManager as the QueryPlugin (ex: xwiki.getQuery()
returns QueryManager, without plugin api), add some shorter methods
and
protect #createQuery by our @Programming annotation.
I'd prefer that we don't add "shorter" methods (whatever that means -
I'm still unsure) but that we have pure Java API as if the API was
only called from Java.
However, in order to make it simpler from Velocity we could do 2 things:
* Offer some velocity tools for easier access.
* Possibility create some @velocity annotations or something that
would generate some velocity-based api in some cases where we could
not find a good way of doing it. However I'd like to start reviewing
the cases one by one to see if they can really not be called easily-
enough from Velocity. public
interface Query {
static final String HQL = "hql";
static final String XPATH = "xpath";
...
}
btw you don't need static final in an interface ;)
Actually I wouldn't do it like this. Since we're now using components
I would create a Query interface and create each implementation as a
component. That component will be registered with a <role-hint> of
"hql", "xpath", etc.