Serverside DataSource.OP_VALIDATE OPS_VALID_FOR_FIELDVALUEEXPRESSION javadoc

[Blama]

Hi Isomorphic,

I'm trying to implement a DataSource attribute that defines the allowed clientside OperationIds (using the OperationType in case no OperationId is given).
This way I can easily mark a DataSource as read-only and also only allow special read-operations.

Now in my IDACall.handleDSRequest()-override if I want to display that an action is not allowed, I'll return a DSResponse.setFailure("myMeaningfulErrorMessage").
This works for every action besides validate. So I need to handle this case specially (with a validation error).

Therefore I check the OperationType with a switch-statement.
But what to use for OperationType "validate"?
There is a string DataSource.OP_VALIDATE in Eclipse, but not the Javadocs.
But in the docs there is a DataSource.OPS_VALID_FOR_FIELDVALUEEXPRESSION, which returns a java.util.Set. Should I use this? If so, could you document it better? Or is the Javadoc for DataSource.OP_VALIDATE just missing (I think so).

Thank you & Best regards
Blama

[Blama]

Hi Isomorphic,

I just realized that what I'm going to do in the end is basically restrict access to the DataSource to the operationBindings I define in my .ds.xml. The requiresRole on each operationBinding will then further limit access.
This way, the allowedClientOperationIds-DataSource attribute I was going to develop is basically a listing of defined operationBindings and therefore unnecessary repetition.

Is there some server.properties option saying that only explicitly defined operationBindings are allowed? So no default-"fetch"-fallback if there is no "fetch"-operationBinding in the .ds.xml?
If not I'm going to build this using BasicDataSource.getObjectProperty("operationBindings"), but if it were there, this would be great.

In general, I think that listing every operationBinding I use is a bit of work, but whitelisting seems to be the less error-prone approach here. Do you agree?

Best regards
Blama

[Isomorphic]

We'll add the missing OP_VALIDATE JavaDoc. That is intended as a supported constant, and the meaning of the operationType is already covered in the client-side docs.

As far the approach of using defined operationBindings as a "whitelist", your use of getObjectProperty() makes sense as a way to do this. There is no existing single property to do this.

[Isomorphic]

The missing OP_VALIDATE JavaDoc has been added. Please try the next nightly build, dated January 9.

Regards
Isomorphic Software

[Blama]

Hi Isomorphic,

great. thank you. I implemented the whitelisting in my IDACall subclass and can share it if anyone is interested.

Best regards
Blama