Just wondering -- how do you know when to add map.resources for a particular model? All of them? The ones you want to be accessible by a public API?
Thanks.
+1
A:
Yes, you are deliberately exposing something as a kind of service, decide whetehr that's want you want to do. Exposing a service implies a certain commitment to your users, general advice keep the number of exposed services under control, they incur onging support debt.
djna
2009-08-08 17:00:27
So does that mean that for models I want to keep "private" I use my own set of controller actions?
2009-08-09 03:37:46
A:
- the model shouldn't reveal any secret or protected data (such as encrypted passwords)
- when you provide external access to a model, you essentially make it a public API. You should then commit to document it, maintain it, and keep it stable (in particular when you find that it is being used).
Martin v. Löwis
2009-08-08 17:00:49
"the model shouldn't reveal any secret or protected data (such as encrypted passwords)"Doesn't restful_authentication add a map.resources :users to your routes.rb file after calling the generator script?
2009-08-09 03:38:20
Right. With proper access control, you might provide such access to administrators. However, I wonder what the point is of exposing such data in API. Users needing access to secret data should use the regular web interface, or perhaps even directly access the database on the server.
Martin v. Löwis
2009-08-09 05:25:49
+1
A:
First of all we do not add map.resources for models. We add them for our controllers.
The map.resources and map.resource generate RESTful urls which do not address a model and its corresponding actions; it addresses only the resource itself. A resource is a combination of dedicated controller and a model.
Usually if you are going to make a complete RESTful app, you add map.respources for all of your controllers. After doing this, you can define all your CRUD(index, new, create, edit and update) actions in the corresponding controller which access a particular resource. The actions which can be carried out on a particular resource depend upon the policies defined by your application. If you have some resource which you do not want the users(via your application front end or via some API) of your application see(or something like that), you simply don't define a show action in the corresponding controller. Similarly other actions.
You should have a look at this small tutorial about REST and Rails. The lines above in the quote are shamelessly copied from the same document.
Waseem
2009-08-09 14:53:38