Google Groups Home
Help | Sign in
Repost: Resource-based models
There are currently too many topics in this group that display first. To make this topic appear first, remove this option from another topic.
There was an error processing your request. Please try again.
flag
  5 messages - Collapse all
The group you are posting to is a Usenet group. Messages posted to this group will make your email address visible to anyone on the Internet.
Your reply message has not been sent.
Your post was successful
sebastian.hil...@gmail.com  
View profile
 More options Apr 5, 3:11 pm
From: sebastian.hil...@gmail.com
Date: Sat, 5 Apr 2008 12:11:34 -0700 (PDT)
Local: Sat, Apr 5 2008 3:11 pm
Subject: Repost: Resource-based models
Introduction of resource-based Models
=====================================

My name is Sebastian Hillig and I currently study IT Systems
Engineering in Potsdam/Germany at the Hasso Plattner Institute.

I came to Django when exploring the "world" of web frameworks about
1.5 years ago and gladly got stuck to it. Therefore I am interested in
taking part in Google Summer of Code for Django.

The Proposal
------------

Models in Django are conceputally based on tables in a database. I'd
like to enhance that with the introduction of resource-based models.
The basic idea comes from Ruby on Rails' ActiveResource, which allows
for interaction between two sites through a RESTful API. I would like
to take this a step further and provide an implementation of this type
of interface not bound specifically to REST. The interface will be
generic enough to allow for different types of sources.

Let me explain the pieces of this system. There are models and
sources. Models define the data that a source can fetch. For purposes
to fit this in a short period of development, four months, I will
implement the following models and sources:

    * RESTModel
    * XMLSource

Here is a quick example of how this might look::

    from django_resource_models import models, sources

    class Product(models.RESTModel):
        name = models.CharField()

        class Meta:
            source = sources.XMLSource("http://example.com/products/")

The model will define the fields that it wants to have access to
through the source. The RESTModel will simply be an abstraction on top
of XMLSource which will understand how to deal with the data given by
the source. It is not entirely required to explicitly define the
models in this way. One could use a call to `./manage.py inspectapi
url` to introspect the API and provide the code for integration.

Using the RESTModel above, one can perform similar QuerySet calls on
the API::

    >>> Product.objects.all()
    [<Product: Some Product>, <Product: Another Product>]

    >>> Product.objects.filter(name__startswith='S')
    [<Product: Some Product>]

The implementation of this would more than likely need to be done in-
memory and could result into performing less optimally than through a
database. However, this approach and method is "buyer beware" in that
the user will be fully understanding of what exactly this all means.
Another aspect that will need to be addressed is dealing with creating
data from this side::

    >>> product = Product.objects.create()
    >>> product.name = "Sebastian's Product"
    >>> product.save()
    >>> Product.objects.filter(name__startswith='S')
    [<Product: Some Product>, <Product: Sebastian's Product>]

Another item of importance is integration with existing models::

    from django_resource_models import models as resource_models

    class Post(models.Model):
        title = models.CharField(max_length=100)
        body = models.TextField()
        featured_product = resource_models.ForeignKey(Product)

    >>> Post.objects.filter(product__name__startswith='S')

Allowing for that type of filtering may or may not be possible with
the current Django code. It will be a goal to see about trying to
accomplish this or if worse comes to worse it is disallowed.

The primary concern of this project is to provide a framework for
pluggable resources mapped to models, which are able to consume and
produce other resources than database tables. It wouldn't claim to
have magical powers and read the developer's mind but provide a
convenient set of (optional) functionalities like caching and
integration to the ORM by trying to make the developer only write as
much code as is really needed.

Rough Plan
----------

April 14th:
    * Announcement of accepted students

Preparation phase (2-4 weeks parallel to other phases):
    * Dig into the Django core, get a feeling and document model-
creation if
      not done yet, look for points to hook in.
    * Explore the REST-architecture
    * Figure out solutions for problems like:
        * ForeignKey integration
        * Resource downtimes
        * Making the base model as generic as possible without losing
          functionality.
        * Writing data back to resource.
        * Caching and cache staleness detection.
        * Handling resources that don't have a unique identifier.
        * How to provide complete integration with the ORM (without
tables?)
        * Ideal notation to satisfy generity
        * Investigate the need for improvement for django-rest-
interface

April 26th:
Coding phase 1 (~4 weeks):
    * Base model and base resource implementation
    * Basic ORM integration
    * Implementation of a dummy model and resource

June 15th:
    * Start with integration of RESTModel and XMLSource
    * Refine integration to ORM
    * Caching

July 7th:
    * MIDTERM EVALUATION

July 14th:
Coding phase 2 (3-6 weeks)
    * Writeback to resource
    * Refine ORM integration
    * Finish integration of RESTModel and XMLSource

Rest of the time up to August 18th:
    * Experiment with different sources
    * Ensure good test coverage
    * Documentation
    * Documentation
    * Documentation / although this is planned to be done in parallel
with the
      other phases

Additional Information About Me
-------------------------------

I am Sebastian Hillig, situated in Berlin, Germany. Being 21 years
old, I recently finished my civil service and study IT Systems
Engineering at the Hasso Plattner Institute now, where I have finished
the first term these days.

My background: Right after finishing grammar school, I did a 5 month
internship at a local web development business, where I am currently
employed for part time work on their content management system.

This would be my first real involvement into open source development,
so I'd be glad to be given the opportunity to participate in the
highly interesting field of django development.


    Reply to author    Forward  
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
Jason L.  
View profile
 More options Apr 7, 12:57 pm
From: "Jason L." <sarcasticzom...@gmail.com>
Date: Mon, 7 Apr 2008 09:57:30 -0700 (PDT)
Local: Mon, Apr 7 2008 12:57 pm
Subject: Re: Repost: Resource-based models
Sebastian,

A fellow student chiming in. :)

For what it's worth, I think offering a layer that can handle
alternative "sources" for a model is a pretty darn cool idea. Written
properly, this could actually replace certain types of serialization
and make new caching methods pretty darn simple.

My only concern regarding 'remote sources' would be security. This
amounts to a direct pipeline into the database from the outside world.
Most security (when it comes to reaching out and touching someone) is
left to the developer; they manually have to establish secure
connections. Your writeup doesn't mention this, and if this is
intended to work like Django's object layer, it seems that the
implementation would hide such details from the end user.

I admit that I'm not familiar with RoR or ActiveSource. Is there
something I'm missing that makes the security issue a moot point?

-Jason L.


    Reply to author    Forward  
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
Jason L.  
View profile
 More options Apr 7, 12:59 pm
From: "Jason L." <sarcasticzom...@gmail.com>
Date: Mon, 7 Apr 2008 09:59:57 -0700 (PDT)
Local: Mon, Apr 7 2008 12:59 pm
Subject: Re: Repost: Resource-based models

> My only concern regarding 'remote sources' would be security. This
> amounts to a direct pipeline into the database from the outside world.

What I mean by this, for the record, is this: either you're taking
external information and saving it to the local database, or you're
implementing the ability to push data back to the external server. In
either case, security is an issue. How would an external source
authenticate the writeback? How would the internal database protect
itself from malicious data?

-Jason L.


    Reply to author    Forward  
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
sebastian.hil...@gmail.com  
View profile
 More options Apr 7, 6:35 pm
From: sebastian.hil...@gmail.com
Date: Mon, 7 Apr 2008 15:35:56 -0700 (PDT)
Local: Mon, Apr 7 2008 6:35 pm
Subject: Re: Repost: Resource-based models

> What I mean by this, for the record, is this: either you're taking
> external information and saving it to the local database, or you're
> implementing the ability to push data back to the external server. In
> either case, security is an issue. How would an external source
> authenticate the writeback? How would the internal database protect
> itself from malicious data?

I'm not 100% sure about that, yet. Even though I think of a mechanism
that all fields should be sanitized and converted to their expected
data-type or are being converted by the developer (or in the case of
strings being marked as safe) which would be the behaviour I'd assume
referring to templating in django. That's how far I'd like to go with
the base mechanisms itself. In regards to caching/saving I'm not yet
sure what this will look like but if there would be a database cache,
I agree that the input has to be sanitized there too, although I
thought of the easiest implementation of caching via a normal django
model so there's a fair amount of sanitation built-in.

Further security and writeback is something I personally would want to
see implemented in specific resource-backends since different types of
backends may require different qualities of authentication and
different methods of writebacks.
For example in a REST-model, which is based on HTTP-requests, one
would have to send an authenticated HTTP-request to the source in
order to gain priviliges for a writeback. Another problem might be
posed by malicious XML-input there, which might use bugs in the
XMLparser, but I don't think that would be a problem of the
implementation specifically since everyone using that XML-parser could
get into serious trouble with malicious XML-files.


    Reply to author    Forward  
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
Brian Rosner  
View profile
 More options Apr 9, 3:25 pm
From: Brian Rosner <bros...@gmail.com>
Date: Wed, 9 Apr 2008 13:25:34 -0600
Local: Wed, Apr 9 2008 3:25 pm
Subject: Re: Repost: Resource-based models
I would like to mentor Sebastian. I helped him put together his  
proposal and am behind the idea. I look forward mentoring him and I  
hope he learns alot and writes alot of excellent code.

Brian Rosner
http://oebfare.com


    Reply to author    Forward  
You must Sign in before you can post messages.
To post a message you must first join this group.
Please update your nickname on the subscription settings page before posting.
You do not have the permission required to post.
End of messages
« Back to Discussions « Newer topic     Older topic »

Create a group - Google Groups - Google Home - Terms of Service - Privacy Policy
©2008 Google