From: Matt S Trout Date: Thu, 8 Jun 2006 14:38:02 +0000 (+0000) Subject: Editing in docs branch X-Git-Tag: 5.7099_04~535 X-Git-Url: http://git.shadowcat.co.uk/gitweb/gitweb.cgi?p=catagits%2FCatalyst-Runtime.git;a=commitdiff_plain;h=71dedf57db8d0813e63bcfc3fc3b60b469cf81a8 Editing in docs branch r8964@cain (orig r4228): jester | 2006-05-27 02:28:49 +0000 --- diff --git a/lib/Catalyst/Manual/Tutorial/Authentication.pod b/lib/Catalyst/Manual/Tutorial/Authentication.pod index 438bdbd..4531517 100644 --- a/lib/Catalyst/Manual/Tutorial/Authentication.pod +++ b/lib/Catalyst/Manual/Tutorial/Authentication.pod @@ -3,7 +3,6 @@ Catalyst::Manual::Tutorial::Authentication - Catalyst Tutorial - Part 4: Authentication - =head1 OVERVIEW This is B for the Catalyst tutorial. @@ -46,16 +45,16 @@ L =item 9 -L +L =back - =head1 DESCRIPTION Now that we finally have a simple yet functional application, we can -focus on providing authentication (with authorization coming in Part 5). +focus on providing authentication (with authorization coming next in +Part 5). This part of the tutorial is divided into two main sections: 1) basic, cleartext authentication and 2) hash-based authentication. @@ -68,16 +67,15 @@ following command: IMPORTANT: Does not work yet. Will be completed for final version. - =head1 BASIC AUTHENTICATION -This section explores how add authentication logic to a Catalyst application. - +This section explores how to add authentication logic to a Catalyst +application. =head2 Add Users and Roles to the Database -First, we add both user and role information to the database (we add the -role information here although it will not be used until the +First, we add both user and role information to the database (we will +add the role information here although it will not be used until the authorization section, Part 5). Create a new SQL script file by opening C in your editor and insert: @@ -120,10 +118,10 @@ Then load this into the C database with the following command: $ sqlite3 myapp.db < myapp02.sql -=head2 Add User and Role Information to Dbic Schema +=head2 Add User and Role Information to DBIC Schema This step adds DBIC-based classes for the user-related database tables -(the role information will not be used until the Part 5): +(the role information will not be used until Part 5): Edit C and update the contents to match (only the C [qw/Book BookAuthor Author User UserRole Role/]> line @@ -364,7 +362,6 @@ L if you are on Win32) -- consult L and its subclasses for additional information. - =head2 Configure Authentication Although C<__PACKAGE__-Econfig(name =E 'value');> is still @@ -402,7 +399,6 @@ line up everything on a given 'level' with the same number of indents. Also, be sure not to use C characters (YAML does not support them because they are handled inconsistently across editors). - =head2 Add Login and Logout Controllers Use the Catalyst create script to create two stub controller files: @@ -468,7 +464,7 @@ Next, create a corresponding method in C: # Clear the user's state $c->logout; - # Send the user to the starting + # Send the user to the starting point $c->response->redirect($c->uri_for('/')); } @@ -506,7 +502,8 @@ This is generally done via an C action/method (prior to Catalyst v5.66, this sort of thing would go in C, but starting in v5.66, the preferred location is C). -Edit the existing C class file and insert the following method: +Edit the existing C class file and insert +the following method: =head2 auto @@ -540,9 +537,8 @@ Edit the existing C class file and insert the foll B Catalyst provides a number of different types of actions, such as C, C, and C. You should refer to -L for a more detailed -explanation, but the following bullet points provide a quick -introduction: +L for a more detailed explanation, but the +following bullet points provide a quick introduction: =over 4 @@ -569,7 +565,6 @@ By placing the authentication enforcement code inside the C method of C (or C), it will be called for I request that is received by the entire application. - =head2 Displaying Content Only to Authenticated Users Let's say you want to provide some information on the login page that @@ -625,12 +620,13 @@ C script.) Now trying going to L and you should be redirected to the login page, hitting Shift+Reload if necessary (the "You are already logged in" message should I appear -- if it does, -click the C button and try again). Make note of the -C<***Root::auto User not found...> debug message in the development -server output. Enter username C and password C, and you -should be taken to the Book List page. +click the C button and try again). Note the C<***Root::auto User +not found...> debug message in the development server output. Enter +username C and password C, and you should be taken to +the Book List page. -Open C< root/src/books/list.tt2> and add the following lines to the bottom: +Open C and add the following lines to the +bottom:

Login @@ -648,7 +644,6 @@ You should stay at the login page, but the message should change to "You need to log in to use this application." - =head1 USING PASSWORD HASHES In this section we increase the security of our system by converting @@ -660,9 +655,9 @@ tutorial will function normally. Note that even with the techniques shown in this section, the browser still transmits the passwords in cleartext to your application. We are just avoiding the I of cleartext passwords in the database by -using a SHA-1 hash. If you are concerned about cleartext passwords -between the browser and your application, consider using SSL/TLS. - +using a SHA-1 hash. If you are concerned about cleartext passwords +between the browser and your application, consider using SSL/TLS, made +easy with the Catalyst plugin L. =head2 Get a SHA-1 Hash for the Password @@ -676,7 +671,6 @@ dirty" way to do this: e727d1464ae12436e899a726da5b2f11d8381b26 $ - =head2 Switch to SHA-1 Password Hashes in the Database Next, we need to change the C column of our C table to @@ -697,7 +691,6 @@ Then use the following command to update the SQLite database: B We are using SHA-1 hashes here, but many other hashing algorithms are supported. See C for more information. - =head2 Enable SHA-1 Hash Passwords in C diff --git a/lib/Catalyst/Manual/Tutorial/Authorization.pod b/lib/Catalyst/Manual/Tutorial/Authorization.pod index 9a620fa..0babb83 100644 --- a/lib/Catalyst/Manual/Tutorial/Authorization.pod +++ b/lib/Catalyst/Manual/Tutorial/Authorization.pod @@ -45,7 +45,7 @@ L =item 9 -L +L =back @@ -67,13 +67,11 @@ following command: IMPORTANT: Does not work yet. Will be completed for final version. - =head1 BASIC AUTHORIZATION In this section you learn how to manually configure authorization. - -=head2 Update Plugins to Include Support Authorization +=head2 Update Plugins to Include Support for Authorization Edit C and add C to the list: @@ -99,7 +97,8 @@ Edit C and add C to the list: =head2 Add Config Information for Authorization -Edit C and update it to match (everything from the "authorization:" line down is new): +Edit C and update it to match (everything from the +"authorization:" line down is new): --- name: MyApp @@ -166,8 +165,8 @@ lines to the bottom of the file: [% END %]

-This code displays a different combination of links depending on the roles assigned to the user.. - +This code displays a different combination of links depending on the +roles assigned to the user. =head2 Limit C to C Users @@ -175,7 +174,7 @@ C statements in TT templates simply control the output that is sent to the user's browser; it provides no real enforcement (if users know or guess the appropriate URLs, they are still perfectly free to hit any action within your application). We need to enhance the controller -logic to wrap restricted actions with role validation logic. +logic to wrap restricted actions with role-validation logic. For example, we might want to restrict the "formless create" action to admin-level users by editing C and @@ -183,7 +182,7 @@ updating C to match the following code: =head2 url_create - Create a book with the supplied title, and rating + Create a book with the supplied title and rating, with manual authorization =cut @@ -229,7 +228,7 @@ updating C to match the following code: } -To add authorization, we simply write the main code of this method in an +To add authorization, we simply wrap the main code of this method in an C statement that calls C. If the user does not have the appropriate permissions, they receive an "Unauthorized!" message. Note that we intentionally chose to display the message this @@ -244,10 +243,10 @@ create a new copy and comment out the original by making it look like a Pod comment. For example, put something like C<=begin> before C and C<=end> after the closing C<}>. - =head2 Try Out Authentication And Authorization -Press C to kill the previous server instance (if it's still running) and restart it: +Press C to kill the previous server instance (if it's still +running) and restart it: $ script/myapp_server.pl @@ -268,15 +267,12 @@ while logged in as each user. Use one of the 'Logout' links (or go to L in you browser directly) when you are done. - - =head1 ENABLE ACL-BASED AUTHORIZATION This section takes a brief look at how the -L -can automate much of the work required to perform role-based -authorization in a Catalyst application. - +L plugin can automate much of the +work required to perform role-based authorization in a Catalyst +application. =head2 Add the C Plugin @@ -288,7 +284,6 @@ C statement: Note that the remaining C plugins from earlier sections are not shown here, but they should still be included. - =head2 Add ACL Rules to the Application Class Open C in your editor and add the following B the @@ -362,11 +357,10 @@ C B the C<__PACKAGE__-Esetup;> line. =back - =head2 Add a Method to Handle Access Violations By default, -L +L throws an exception when authorization fails. This will take the user to the Catalyst debug screen, or a "Please come back later" message if you are not using the C<-Debug> flag. This step uses the @@ -409,14 +403,14 @@ When you are done, use one of the 'Logout' links (or go to the L URL directly) when you are done. - =head1 AUTHOR Kennedy Clark, C Please report any errors, issues or suggestions to the author. -Copyright 2006, Kennedy Clark, under Creative Commons License (L). +Copyright 2006, Kennedy Clark, under Creative Commons License +(L). Version: .94 diff --git a/lib/Catalyst/Manual/Tutorial/BasicCRUD.pod b/lib/Catalyst/Manual/Tutorial/BasicCRUD.pod index f6685ec..296f0b7 100644 --- a/lib/Catalyst/Manual/Tutorial/BasicCRUD.pod +++ b/lib/Catalyst/Manual/Tutorial/BasicCRUD.pod @@ -56,7 +56,7 @@ L This part of the tutorial builds on the fairly primitive application created in Part 2 to add basic support for Create, Read, Update, and Delete (CRUD) of C objects. Note that the 'list' function in Part -2 already implements the Read portion of Crud (although Read normally +2 already implements the Read portion of CRUD (although Read normally refers to reading a single object; you could implement full read functionality using the techniques introduced below). This section will focus on the Create and Delete aspects of CRUD. More advanced @@ -71,7 +71,6 @@ following command: IMPORTANT: Does not work yet. Will be completed for final version. - =head1 FORMLESS SUBMISSION Our initial attempt at object creation will utilize the "URL arguments" @@ -85,14 +84,16 @@ Edit C and enter the following method: =head2 url_create - Create a book with the supplied title, rating and author + Create a book with the supplied title, rating, and author =cut sub url_create : Local { - # In addition to self & context, get the title, rating & author_id args - # from the URL. Note that Catalyst automatically puts extra information - # after the "/// and then enter: [% # 'uri_for()' builds a full URI; e.g., 'http://localhost:3000/books/list' -%]

Return to list

- [% # Try out the TT Dumper -%] + [% # Try out the TT Dumper (for development only!) -%]
     Dump of the 'book' variable:
     [% Dumper.dump(book) %]
     
-The TT C directive allows access to a variety of plugin modules (we -are talking TT plugins here, not Catalyst plugins) to add extra -functionality to the base TT capabilities. Here, the plugin allows -L "pretty printing" of objects and variables. -Other than that, the rest of the code should be familiar from the -examples in Part 2. +The TT C directive allows access to a variety of plugin modules (TT +plugins, that is, not Catalyst plugins) to add extra functionality to +the base TT capabilities. Here, the plugin allows L +"pretty printing" of objects and variables. Other than that, the rest +of the code should be familiar from the examples in Part 2. B As mentioned earlier, the C view class created by TTSite redefines the name used to access the Catalyst context object in TT templates from the usual C to C. - =head2 Try the C Feature If the application is still running from before, use C to kill -it. Then restart the server: +it. Then restart the server: $ script/myapp_server.pl @@ -184,7 +183,7 @@ output. B: You can use C