Adding Rails like Strong Parameter support

[seivan]

I could finish an implementation of Strong Parameter support as a middleware, but not sure if that would be accepted?

[keithwhor]

Middleware wouldn't work, because middleware is currently between the .render() call and actual output to client. I would like strong params fundamentally built in to Controllers, but I'd like to think about what it looks like. Params might need to be its own class w/ associated methods.

Alternatively we could figure out a good pattern for modules that intercept requests (post router, pre-controller, or upon controller initialization). I played around with some ideas during dev but didn't settle on anything concrete.

[seivan]

Yeah, I noticed middleware is used during render(), any reasons in particular for why you would have it so deep in the chain?

If you take a look at Rails, you'll see the middleware called far sooner and obviously before they even hit controllers. This allows you to move a lot more code to the middleware and thus allowing people to tweak what they want or don't want. I do like the idea of being opinionated out of the box, but let people tweak what they want to get rid off.

Don't want cookies? Fine get rid of it.

this.middleware.remove("CookieJar");
this.middleware.remove("StrongParam");
this.middleware.swap("MemcachedSessionStore", RedisSessionStore);

Wish you didn't close the other issue related to it, as I would love to push for changing the middleware execution.
I've also added code to remove and swap middleware.. Unfortunately I can't test as I'm not sure how to get ES6 to work with npm.

[keithwhor]

By closing it I didn't mean I wanted to forget about it :). Let's talk about it here.

I'm totally open to changing Middleware execution, we'll need to rename the current iteration of Middleware as "post-middleware" or something, for modifying data being sent to the client. Endware? Finalizers? I'm not sure.

[seivan]

From the looks of it, you want a middleware stack for responses and one for requests.
I looked at the sample app that has a GzipMiddleware something like that wouldn't work with a rails-like middleware stack.

[seivan]

How about make router.js and controller.js into middleware and you could insert something like GzipMiddleware after them in the stack. Even make helpers to add after a request or just before a response?

Wouldn't be too much change but I've just briefly looked through the code. Just a thought.

[intabulas]

So what are folks thoughts on enforcement at the controller (ala rails permit) vs model level.

[seivan]

@intabulas Permit levels might be different between endpoints on controllers.
e.g. /admin/ scope can do more than /user/

There is some history to why rails moved it out of models and into per controller specifics.

[intabulas]

exactly, which is why it should not be in the model IMHO. I had a much longer initial comment I killed since I though it would be worthwhile to start discussion

[seivan]

I think moving the entire stack into middle-wares is a better move to begin with before adding things like strong-params. Unfortunately that issue got closed down and I am not sure where that stands.

There is no "middleware" as of now, as it only executed before render() is called, which makes it kinda pointless.

[intabulas]

well I think @keithwhor closed it so it could be discussed in this issue, so lets discuss it :)

[keithwhor]

@seivan Middleware (pre-controller execution) is now available as of 0bb2a90

If you'd like to add middleware, submit a PR :)

[intabulas]

So StrongParams, ie: except(), permit() is done in the 0.7 branch.. See https://github.com/intabulas/nodal/commit/536ca14d21be0a896804c5fddbddc3a3d5351ae8

@keithwhor we can close