[TAPESTRY-209] order of validate & activateExternalPage

• Type: Bug
• Status: Resolved
• Resolution: Won't Fix
• Affects Version/s: 3.0
• Component/s: Framework
• Environment: Operating System: All; Platform: All
• Bugzilla Id: 30704
• Assignee: Unassigned
• Reporter: joe panico
• Created: 17/Aug/04 08:01
• Updated: 18/Aug/06 13:07
• Resolved: 10/Mar/06 10:08

Description

I'm proposing that the current implementations of
ExternalService/ExternalCallback are somewhat broken for real-world
applications. The problem is the order in which validate() and
activateExternalPage(parameters, cycle) are called on the target IExternalPage.
Currently, the External Service/callback implementations follow this sequence:

1) cycle.activate(page);

activate() will trigger a call to validate()

2) page.activateExternalPage(parameters, cycle);

This means that validate(IRequestCycle) will be called on a target
IExternalPage before the state has been set (activateExternalPage) on that
page. For most of my pages, I'm performing stateful page validation, in
other words validate has to check not only that a particular user is allowed
to see a particular ExternalPage, but also that the user is allowed to see
particular target state (content) in that page. So I've been using my own
copy of ExternService that simply switches the order of these operations.

A concrete example:

I have an ExternalPage which represents a page in a Photo Album. The identities
of the Photo and Photo Album which are the target (content) of this ExternalPage
are encoded in the URL (they are ExternalPage parameters).

This page is "protected", meaning that it may require the user authenticate
before viewing an album. The Page may also require authorization, meaning that
only certain users are allowed to view that particular album in that particular
page. In other words, the state (album id) associated with that page is required
in order to perform page.validate().

I propose an easy fix for this problem. Simply reorder the validate and
activateXternalPage operations. The new implementation would look like this:

...

Object[] parameters = getParameters(cycle);

cycle.setServiceParameters(parameters);

page.activateExternalPage(parameters, cycle);

cycle.activate(page);

// Render the response.
engine.renderResponse(cycle, output);

...

Issue Links

• is duplicated by: TAPESTRY-980 in ExternalService, activate the external page before validating