web2py ideas we stole - ideas we had "Thanks Django, Rails, TG, Flask, Cherripy, Mako, web.py, ...."

by Massimo Di Pierro @ DePaul University

web2py

Main features ‣One

Instance - Many Applications (hot plug and play)

‣Web

based Integrated Development Environment ‣Web based Database administration (for each app) ‣Each application can connect to multiple Databases ‣Writes SQL for you ‣Strong on Security (no SQL Injections, XSS, CSRF, ..., audited) ‣Built-in ticketing system (logs all errors) ‣Runs everywhere (it is written in Python) download ad and unzip unzip)) ‣Requires NO Installation (just downlo ‣Has no coniguration files and no third party dependencies ‣Can run off a USB drive ‣Always backward compatible (since 2007 and on...) developers elopers already invol involved ved ‣50+ of dev

Admin

wizard

new app

download app edit app

upload app

Included APIs ‣generation ‣web

services: JSON / JSON-RPC / XML / XML-RPC / AMF

‣document ‣10

and parsing: HTML / XML / RSS / JSON

generation WIKI, CSV, RTF, LATEX, PDF

different SQL dialects and Google App Engine

‣ Role

based access control with login plugins local, OpenID OpenID,, OAuth 1 and 2, Janrain, LDAP Consumer + Provider Central Authentication Service

‣sending

SMS, accepting Credit Card payments

internationalization,, ‣internationalization

cron jobs, multi-tenancy multi-tenancy,, ...

web2py Architec Architecture ture

web2py modules

web server (one file)

web2py modules

main wsgi app (one file)

web2py modules

DAL / ORM (one file)

web2py modules

template (one file)

web2py modules

helpers (one file)

web2py Architec Architecture ture

web2py Architec Architecture ture

web2py Architec Architecture ture

web2py Architec Architecture ture

web2py Architec Architecture ture

Admin - Design

plugin_wiki (CMS)

web2py applications

     s      n        i      g      u         l      p

‣No

metadata ‣Can edit files using shell or web IDE

layouts plugin_wiki ....

Architecture of Applications

Architecture of Applications

Architecture of Applications

Architecture of Applications

Architecture of Applications

Architecture of Applications

Architecture of Applications

Architecture of Applications

Complete Application ("friends") File: "friends "friends/models/db_friend.py" /models/db_friend.py" db.define_table db. define_table('friend', ('friend',Field Field('name')) ('name')) File: "friends "friends/controllers/main.py" /controllers/main.py" @auth.requires_login auth.requires_login() () def index def  index(): (): form = crud.create crud.create((db db.friend) .friend) friends = db db((db db.friend). .friend).select select() () return locals() File: "friends "friends/views/main/index.html" /views/main/index.html" {{extend 'layout.html' {{extend 'layout.html'}} }}

{{=

{{=T T('My Friends')}} Friends')}}

New Friend

{{=form {{= form}} }}

Current Friends

{{=friends {{= friends}} }}

web2py/ applications/ friends/ models/db_friends.py controllers/main.py views/main/index.html ... ...

cd /path/to/demo  wget -O web2py_src.zip http://web2py.com/examples/ http://web2py.com/examples/static/web2py_ static/web2py_src.zip src.zip unzip -o -q web2py_src.zip cd web2py web2py python web2py.py python  web2py.py -a hello -p 8000 & cd applications applications  mkdir friends cp -r welcome/* welcome/* friends/ cd friends friends echo "db.define_tab b.define_table('friend',Fi le('friend',Field('name')) eld('name'))" " > models/db_friends.py echo " @auth.requires_login() @auth.r equires_login() def index(): index(): form fo rm = crud.create(db crud.create(db.friend) .friend) friends fr iends = db(db.friend). db(db.friend).select() select() return re turn locals() " > con controllers/main.py trollers/main.py  mkdir views/main echo " {{extend {{exten d 'layout.html' 'layout.html'}} }}

{{=T('My

{{= T('My Friends')}} h1>

New Friend

{{=form  }} }}

Current

Cur rent Friends

{{=friends}} {{=frie nds}} " > vie  ws/main/index.html  ws/main/index.html

Controllers Django (view in MTV) def index(request): index(request): entry_id = request.GET request.GET['entry_id'] ['entry_id'] entry = Entry.objects.get Entry.objects.get(pk=entry_id) (pk=entry_id) output = entry.name return HttpResponse HttpResponse(output) (output)

web2py (controller in MVC)

def index(): entry_id = request.get_vars request.get_vars.entry_id .entry_id or redirect(URL('error')) redirect(URL('error')) entry = Entry Entry(entry_id) (entry_id) output = entry.name return dict dict(output=output (output=output) ) # defaults to generic template

Routing (in, out, onerror) Django (urls.py) urlpatterns = patterns('', (r'^articles/$', (r'^articles/$', 'news.views.index'), 'news.views.index'), (r'^articles/(\d{4}) (r'^articles/(\d{4})/$', /$', 'news.views.read'), 'news.views.read'), )

web2py (routes.py) - ALWAYS OPTIONAL routes_in = [ (r'articles/', (r'articles/', '/news/default/index'), '/news/default/index'), (r'articles/(\d{4}) (r'articles/(\d{4})', ', '/news/default/read/ '/news/default/read/\1 \1'), '), (r'articles/$year (r'articles/$year', ', '/news/default/read/ '/news/default/read/$year $year'), '), (r'127.0.0.*:http://domain.com  (r'127.0.0.*:http://domain.com articles/(\d{4 articles/(\d{4})','/news2/def })','/news2/default/read/\1') ault/read/\1') ] routes_out = [...] routes_onerror = [ (r'init/400 (r'init/400' ', r'/init/default/login'), r'/init/default/login'), (r'*/* (r'*/*', ', r'/init/static/fail.html')] r'/init/static/fail.html')]

Templates Mako (template in MTV)

web2py (template or view in MVC)

<%inherit <% inherit file="base.html" file="base.html"/> />

{{extend {{ extend "base.html}} "base.html}}

<%def name="makerow(k) <%def name="makerow(k)"> "> ${ ${k k} ${ ${k*k k*k} } >

{{ def makerow(k): }} {{= {{=k k}} }} {{= {{=k*k k*k}} }} {{ return }}

<%

{{ numbers = range(0,10)

%> % for k in numbers: ${  makerow(k)}  makerow(k)} % endfor ‣In

numbers = range(0,10) }} {{ for k in numbers: }} {{ makerow(k) }} {{ pass }}

web2py, no indentation requirement ‣Django-like blocks, output always escaped

App-Admin Django

‣Django

web2py

"admin" designed for public access ‣web2py "app-admin" designed for administrator access only ‣CRUD components from appadmin can be embedded in apps ‣web2py "app-admin" not to be confused with web2py's "admin"

Models Django (model) class Entry Entry(models.Model): (models.Model): name = models.CharField models.CharField(max_length=255,null=False) (max_length=255,null=False) body = models.TextField models.TextField() () image = models.ImageField models.ImageField() () pub_date = models.DateTimeField models.DateTimeField() () rating = models.IntegerField models.IntegerField() ()

web2py (model) Entry = db db.define_table('entry', .define_table('entry', Field(' Field ('name name',length=255,notnull=True), ',length=255,notnull=True), Field(' Field ('body body',' ','text text'), '), Field(' Field ('image image',' ','upload upload',requires=IS_IMAGE()), ',requires=IS_IMAGE()), Field(' Field ('pub_date pub_date',' ','datetime datetime'), '), Field(' Field ('rating rating',' ','integer integer')] ')]

Queries Django (model) q = Entry.objects.filter Entry.objects.filter(headline (headline  __startswith="What")  __startswith="What") q = q.filter q.filter(pub_date (pub_date  __lte=datetime.now())  __lte=datetime.now()) q = q.exclude q.exclude(body (body  __icontains="food")  __icontains="food") print q

web2py (model)

q = Entry.headline. Entry.headline.startswith startswith("What") ("What") q = q & (Entry.pub_date< (Entry.pub_date
Thread Locals Flask (proxies to objects that are local to a specific context) from flask from flask import request  with app.request_context app.request_context(environ): (environ): assert request.method == 'POST'

web2py (thread-locals) from gluon from gluon import current assert current.request current.request.env.http_  .env.http_   method == 'POST'

‣In

Flask "request" is a proxy to a thread local object. In web2py "request" is a thread local object cotained into a "current" ‣"gluon" is the library that contains web2py.

Multi-version / No-conflic No-conflicts ts https://github.com/mitsuhiko/multiversion import multiversion  multiversion.require_version( multiversion.require_version('mylib', 'mylib', '1.0') import mylib

web2pyy (each app can ship with its own version of libraries) web2p # app 1 import mylib

# from applications/app1/modules/ applications/app1/modules/

# app 2 import mylib

# from applications/app2/modules/ applications/app2/modules/

‣Each

app ships with its own modules/ folder. ‣Not added to sys.path ‣No conflicts ‣One web2py instance

Role based Access Control

For any function

@auth.requires_login() @auth.requires_membership(ro @auth.requires _membership(role='secret le='secret agent') @auth.requires_permission('kill', 'bad_people', all) def test(): return 'done'

Web Services

For any function @service.json @service.xml @service.jsonrpc @service.xmlrpc @service.soap @service.amfrpc3('domain') def add(a,b): return a+b

Record Versioning

Any method db._common_fields.append(auth.signature) crud.settings.update_onaccept(crud.archive)

‣Store

all previous version of each record with names of the user who changed and timestamp of the change

Modularrity with Digintally Signed URLs web page component

component

component

In page

In controller

{{=LOAD('plugin','component',user_signature=True) {{= LOAD('plugin','component',user_signature=True) }}

@auth.requires_signature() def component(): return 'component'

‣web2py

can sign all URLs (links, ajax callbacks, components) so the called action delegates security the caller

Federated Authentication

App "one"

Other apps

auth = Auth( Auth(db db))

auth = Auth( Auth(db db,, cas_provider = 'http://.../one/default/user/cas')

‣Any

application can be both a provider and a client for CAS 2.0 ‣Other federated authentication mechanism available as clients

Multi-tenancy

Any model db._common_fields.append( db ._common_fields.append(Field Field('request_tenant',default= ('request_tenant',default=request.env.host_name request.env.host_name)) ))

‣All

records are filtered based on tenant ownship ‣Tenant identified for example by domain name Tables s can be shared shared between tenant tenant or not ‣Table ‣http://domain1 or http://domain2 (same app, different data)

GAE Deployment

upload to GAE

Web translation

english italian

Error logging

error occurred 3 times oops: 1/0

Who uses web2py?

Conclusions ‣web2py

has been abround for since 2007 ‣+50% was rewritten in 2010 while mantaining backward compatibility ‣Some like it, some find it useful ‣Give

it a try!