CSCI E-168, Fall 2007 - Latest Comments

Re: Implementing a great final project

jgn — Fri, 18 Jan 2008 21:00:55 -0000

Steve, When you use acts_as_authenticated, note that it is "in play" if someone logs in via a browser. So then the use of the session is legit (and saving "state").

But if they come in requesting XML, then you should probably not check the session. This implies, then, that for REST requests, you should not look at the session.

Re: Implementing a great final project

steveharris — Thu, 17 Jan 2008 14:27:18 -0000

I'm deploying the RESTful acts_as_authenticated, which (if I'm understanding what I'm seeing) uses a cookie.

I'm following Alameda's example (chapter 6) -- in his controllers, he restricts every request to only the records "owned" by the current_user, e.g.:

def index
exercises = current_user.exercises.find(:all)
...
end

But this appears to violate the REST statelessness principle.

Sigh. Back to the drawing board...

- Steve

Re: Implementing a great final project

jgn — Mon, 14 Jan 2008 00:03:44 -0000

Glad you asked. I've been waiting for someone to ask about this.

The "intelligent" strategy goes like this:

-- At some point you have code that sees that the user has made a request, but is not logged in. In CCC, this is done in ApplicationController#authorize

-- So what you want to do is: In the code that detects that a user is not logged in, you need to save the incoming request somewhere. For instance,

session[:wanted_path] = request.env['REQUEST_URI']

(I think that's the right item in the request.)

See http://api.rubyonrails.org/... under "Requests" for information about this.

This happens before you redirect to the login action.

-- Then, after a successful login, you want something like the following:

if session[:wanted_path]
p = session[:wanted_path]
session[:wanted_path] = nil
redirect_to p
return
end

The bit where we are redirect to a path or URL is something you've seen before: We do it in LinkWizz to handle bookmarking via the toolbar. There's a line like this:

redirect_to @link.url

which is a very similar idea, except that it's an absolute URL instead of one that is understand as local to the server.

Re: Implementing a great final project

Philipp — Sun, 13 Jan 2008 21:49:47 -0000

"If I am not already logged in, I should be given an opportunity to log in." sort of implies that once the user logs in they are magically sent to the /invitations/invite/### URL. The existing code does does, in a very primitive way, give "an opportunity to log in", but then bumps you to the main page, rather than taking you where you had initially asked to go. May we assume that once they log in they can click on the link in the email again and we take them to the correct page, or are we expected to implement some kind of more-intelligent login system as well?

Re: Implementing a great final project

jgn — Sat, 05 Jan 2008 16:01:26 -0000

There are a number of ways to do this.

The key is that in all cases, you do not use the web-based (form-style) authentication. Why? Because you don't want to use the session to track the "current" user. As you will recall, maintaining state in REST is a no-no.

Here are two strategies, plus one I wish I could offer you, but it's only Rails 2.0.0+:

*ONE*

(1) Omit the REST paths from authentication

(2) Expose all data via REST

But note: This is an app where not much is actually very public. Maybe the list of locations. You could implement nested resources like:

/users/1/playdates

but it is cool to provide any random user with a list of John's playdates? Having said that, this is the way to start. Get this working, then think about option two, into which you would refactor your working code.

*TWO*

(1) Omit the REST paths from authentication

(2) Add a column to the users table with is a GUID for that user. Now allow requests like this:

/users/GUID/playdates

So it might be:

/users/OEeaw-64kD4p5XBcfjn_-F1HPPg/playdates

This is "security by obscurity." A user who wants to get his data via REST would need to know his GUID.

*THREE*

Ideally, you would use authentication during the HTTP request. E.g., with HTTP "basic" authentication.

Unfortunately this isn't supported out-of-the-box with Rails 1.2.3.

This is the idea:

http://railscasts.com/episo...

Re: Implementing a great final project

bchin — Sat, 05 Jan 2008 15:24:01 -0000

Hi,

I'm trying to figure out how to implement REST with the CCC project. Since there's a filter on all the routes except for the login page that checks for authentication, does this mean that you need to be authenticated to access the REST interfaces that you access? I'm unclear on how that works. For example, if I were to provide an interface to access my schedule, what would be the strategy for authentication? Or should the filter be changed to check for the type of format that is requested?

Thanks!

Re: Implementing a great final project

jgn — Wed, 02 Jan 2008 22:09:33 -0000

It is up to you. All you are trying to do is get a good quasi-random but unique value that can serve as an alternate key. A lame approach is to use a random number with a lot of bits. But you can do better; a decent GUID can be generated in about a line of Ruby. You may find it easier to write one yourself from scratch, or you may find it easier to use a library -- read on. Whatever you do, make sure to address your choice and strategy in your writeup. Just FYI, knowing how to generate a decent GUID -- or the libraries that would help in whatever language you're using -- is a very useful thing to have around. There are many times when you want to give a file a name you know to be unique: Having part of the filename be based on a GUID is one way to do it. And there are many other uses.

A GUID (or UUID) is a globally-unique identifier. The "classic" GUID is built out of the MAC address (the hardware address of your network adapter) + a time value + a counter. You concatenate all of those things, and then figure out a way to represent the value at a standard length and with a standard character set. Just for example, you could hash that value using Digest:: SHA1.digest (there should be a discussion of this in the Pickaxe), and then you would do something like Base64-encode it (this also should be in the Pickaxe).

For the MAC address + time + counter core value, you can also use the UUID class here:

http://trac.labnotes.org/cg...

(Notice how in the code the returned value is a little gross: This is why you might want to hash and base64 it.)

If you decide to write your own, a somewhat acceptable value instead of the MAC address is to use the IP address of the computer, though in production the computer can be on a subnet and not have an especially good value. But in reality, it isn't totally necessary to have a "real" globally-unique value: It can be enough that it is unique in your own product.

Here's some more information for the general idea:

http://en.wikipedia.org/wik...

Re: Implementing a great final project

bchin — Wed, 02 Jan 2008 21:45:27 -0000

For the implementation of UUID are we supposed to write code to generate a UUID or can we use external libraries?

Re: Implementing a great final project

jgn — Sat, 22 Dec 2007 16:11:42 -0000

Owing to a medical issue, there is a student who will hand in this weekend. Once that is in, I will distribute a solution.

Re: Implementing a great final project

anne002 — Sat, 22 Dec 2007 15:06:28 -0000

For those of us who had trouble with assignment 5, will you post the code you wrote?

Do you have an upgraded version of Child care coop, so we can use it over the web the way we used the previous version as guidance for what some of the features might look like -- for example for email, authentication...

Re: How to change the port on the server?

jgn — Thu, 06 Dec 2007 23:23:15 -0000

ruby script/server -p 3001

ruby script/server --help
(for more info)

Re: Assignment 5; due Dec. 9

jgn — Mon, 03 Dec 2007 12:47:08 -0000

Yes, it is horrendous, I know. Good thing that the course isn't about the look of the final app . . .

Having said that, I think it's a CSS problem. One of the downsides of using a ready-made "skin" such as andreas08 is that we are victims of design choices not made by us.

You might be able to widen it by looking for CSS selectors regarding "input"

Re: Assignment 5; due Dec. 9

traceyz — Mon, 03 Dec 2007 12:42:19 -0000

How can I get the date values in the pull-down menus to look better? In the playdates, as provided in the assignment, for the start-dates and end-dates - the pull-down arrow "steps-on" the right end of the value field. For example - if the day-of-the-month is 23, you will see a 2, followed by about 80% of the three followed by the pull-down arrow.

I implemented the same approach for my add a child - born_on field, using the date_select helper. I have tried a lot of combinations of parameters, but no luck getting some "breathing room" between the value and the pull-down.

Re: Screencast: Setting Up — Mac OSX

anne002 — Fri, 23 Nov 2007 18:56:31 -0000

sudo install_name_tool -change /usr/local/mysql/lib/mysql/libmysqlclient.15.dylib /usr/local/mysql/lib/libmysqlclient.15.dylib /usr/local/lib/ruby/gems/1.8/gems/mysql- 2.7/lib/mysql.bundle

what is this for? Do we need to do it on Leopard?

Re: Windows dev tools I actually use

maxn — Thu, 22 Nov 2007 20:40:31 -0000

I love Cygwin; I think Windows is virtually unusable without it.

Re: Assignment 4; due Nov. 11

jgn — Sun, 18 Nov 2007 10:43:09 -0000

The key part of the "readme" is your answer to one of the two questions: The more detail the better.

The checklist is in the main instructions doc. Here it is again:

CHECKLIST FOR BEING "DONE"

1. Does rake e168:test:migrations pass?
2. Does rake test:units pass?
3. If you add the additional sample data migrations, do they work?
4. Does demo.rb work? [Note: You may need to reverse the data migrations to get demo.rb to work, because both the migrations and demo.rb want to create a user with e-mail john@7fff.com]
5. Do your implementation of Finders (in lib/finders.rb) work? This is tested by test:units
6. Have you written up the answers to one of the two questions above?
7. Did you ZIP up your project, and make sure that the ZIP archive file name contains your name?
8. Did you e-mail the ZIP to your grader and put "E168" in the subject line, and "submission:Assignment4" in the body?

Re: Assignment 4; due Nov. 11

traceyz — Sun, 18 Nov 2007 08:25:06 -0000

Could you clarify what is supposed to go in the README? I assume our answer to our choice of the two questions, but what else? Also, at one time, I saw a check-list for being done, but I can't find it now. Where can I read it?

Re: Assignment 4; due Nov. 11

jgn — Sat, 17 Nov 2007 18:48:37 -0000

Here is the statement that is causing the problem:

INSERT INTO children_playdates (`play
date_id`, `id`, `child_id`) VALUES (10, 11, 11)

Notice that you are trying to set a value for "id." But should children_playdates have an id column? (No; there is no model for that table.) Go to AWDR and review the table structure for the habtm join table, and also look under migrations to see how to suppress the primary key for join tables like this one.

Re: Assignment 4; due Nov. 11

obscurelyfamous — Sat, 17 Nov 2007 11:15:39 -0000

Sagi, if you click on "Go to Forum" underneath the post field, you can edit posts from the forum.

Re: Assignment 4; due Nov. 11

jgn — Fri, 16 Nov 2007 22:25:41 -0000

When you get back to it, paste in the full stack trace for your test failures.

Also, clear out the dev database (rake db:migration VERSION=0) and then re-build it (rake db:migrate). If you have the extra data migrations, that will at least show that your associations are probably good. If you aren't using the extra migrations, then try running demo.rb.

Re: Assignment 4; due Nov. 11

jgn — Fri, 16 Nov 2007 21:04:21 -0000

I think what you are seeing is something that I explained here:

http://e168f07.7fff.com/pri...

Here's what I said:

Version 1.0.006: Fixed "off by one" error in test/finders_test.rb, FindersTest.test_1080_first_names_for_list_of_user_ids

To fix this manually, find the lines

i1 = rand(n)
i2 = i1 + 1

And replace with

i1 = rand(n/2)
i2 = n/2 + rand(n/2)

Re: Assignment 4; due Nov. 11

jgn — Tue, 13 Nov 2007 22:27:36 -0000

Could you add A LOT more information:

-- What is the data your implementation IS returning?

If you need to, alter the test to print out those values as they are returned to the test.

Note that the tests do not touch the data from the migrations. They use the data from the fixtures, and whatever is added during the tests themselves.

Re: Assignment 4; due Nov. 11

traceyz — Tue, 13 Nov 2007 16:25:18 -0000

I am having a small problem with the last test. Everything else is working, although I am sure I can improve my style. The test first asks for user 2 and user 4. In my system, after adding all the migrations, user with id of 4 is bob@example.com, with null first_name and null last_name.

The test is expecting me to deliver ["Harold", "Naomi"] Of course I fail.

What could be going on?

Re: Assignment 4; due Nov. 11

jgn — Mon, 12 Nov 2007 12:40:09 -0000

Accepted invitations is by user. I.e., only users can accept playdates.

It is a different question to ask: How many children are participating in a playdate.

It is NOT the case that ALL children participate in a playdate just because the parent accepts the invitation; each child must be added separately.

Re: Assignment 4; due Nov. 11

jgn — Sat, 10 Nov 2007 19:41:43 -0000

No - Rails basically includes everything automagically.

Still, I should look at that. Requiring a file twice shouldn't trigger such a weird result.

Maybe when you submit you could add a note about that, with a section that is commented that we could trigger to show the issue.