- web-devel - Haskell.org

More collaboration in web development
by Michael Snoyman 22 Oct '15

22 Oct '15

I originally kicked this off as an email to the maintainers of some of the other WAI web frameworks. After some initial brainstorming and some broad consensus to find some more shared common ground, we decided to open this up to a broader discussion. I think the primary forum for this discussion will likely be the web-devel mailing list, though I'm cross-posting to haskell-wai and yesodweb as well for those interested. Please feel free to share with other mailing lists also. (We debated whether to use web-devel or haskell-wai for this discussion and didn't come to a decision, I'm fine moving it elsewhere.) Based on the discussion, it seems like our best next step will be putting together a package containing some form of a Handler monad that could be shared by multiple web frameworks, hopefully making it easier to write code that can move between various frameworks. By contrast, we also seem to be in agreement that the high level routing code will end up being framework-specific, though we may be able to share some common low-level Trie-based dispatch code. I'll leave it to other participants to restate points they made in the initial private discussion. * * * Hi all, When I was in San Francisco a few months ago, Greg and I discussed the state of Haskell web development. It's clear that there's a lot of great stuff going on. Both of us have a strong desire to find as much common ground for all web framework authors to work on as possible, without detracting from meaningful distinctions between the various frameworks. Greg and I have discussed this point off and on for the past few months, and haven't come up with very many concrete ideas. The recent work on http-api-data[1] would be one possible example of collaboration. Other possible ideas that Greg and I brainstormed were some kind of shared library for efficient dispatch (that could be used under the surface for the various high-level interface different libraries already provide), or some kind of a common Handler-like monad (which from what I've seen many people seem to reimplement all over the place). Some concrete benefits we can see from this: * Previously, Persistent users were complaining that their types did not serialize in servant. http-api-data addresses this. * A common Handler would allow a higher layer abstraction for web apps, much like WAI provides at a low level. With something like that, sharing code like authentication logic becomes a reality * We already have precedence for other such shared libraries: client-session, server-session, cookie, and authenticate, as a few examples. These are just ideas to kick off some thoughts, I'm sure some discussion could bring out some better ideas. Overall, it seems like we have a lot of opportunity to improve the situation for everyone if we focus on such collaboration. Having a shared low-level HTTP interface (WAI) has already helped this out considerably, I'm hoping there's something else we can do in this vein as well. Michael [1] http://hackage.haskell.org/package/http-api-data

1 0

esqueleto-2.4.0 released
by Felipe Lessa 05 Aug '15

05 Aug '15

Hey! :) I've just released the first major bump of esqueleto in a long time. This was needed in order to change the signatures of all functions that took IsString arguments to the new SqlString type class. Now you can make your newtypes instances of SqlString without bothering with IsString. And, finally, Maybe is an instance of SqlString, so string-related functions will work with nullable types out-of-the-box. If you had a custom IsString instance previously, you may now need to make it an instance of SqlString as well: instance SqlString FooBar where -- This is not a typo, there are no class methods. If you had generic functions that took a data type that implements IsString, you may need to change them to SqlString. Your code should otherwise work fine without any changes. Cheers, PS: Shhhh, just ignore esqueleto-2.3.0. :) -- Felipe.

1 0

Re: [web-devel] Warp now supports HTTP/2
by Kazu Yamamoto 29 Jul '15

29 Jul '15

Hi, > Incredible work! Out of curiousity, are there any plans to add > support for server push to the WAI interface? Or is there a way to > do it already that I don’t realize? Sorry for this late response. I was in summver vacation. Please give a look at this issue: https://github.com/yesodweb/wai/issues/402 I explained some ideas. --Kazu

1 0

Warp now supports HTTP/2
by Kazu Yamamoto 23 Jul '15

23 Jul '15

Hi, We have released Warp v3.1.0 and WarpTLS v3.1.0 which fully support HTTP/2. http://www.yesodweb.com/blog/2015/07/http2 --Kazu

2 1

Re: [web-devel] [Yesod] ANN: Wai routes 0.7
by Anupam Jain 29 Jun '15

29 Jun '15

On Sun, Jun 28, 2015 at 10:18 AM, Njagi Mwaniki <mwanikibusiness(a)gmail.com> wrote: > Another question for you. How can I or recreate the results of functions > like widgetFile in yesod? I want to use julius, lucius and hamlet in my > wai-routes app. You don't need a widgetFile function to use Julius and Lucius in wai-routes. Take a look at this small example - https://github.com/ajnsit/wai-routes/blob/master/examples/Hamlet.hs - on how to render Cassius from an external file. The process for including Julius or Lucius should be fairly similar to Cassius. Note that Wai-routes 0.7.1 includes a function called `showRouteQuery` (http://hackage.haskell.org/package/wai-routes-0.7.1/docs/Network-Wai-Middle…) which is a route renderer in the format that Shakespearean templates expect. -- Anupam

1 0

ANN: Wai routes 0.7
by Anupam Jain 13 Jun '15

13 Jun '15

Hi all, I have just released v0.7 of wai-routes, the typesafe urls framework for wai. After letting the code rot for several months, I finally managed to carve out some time to do a bit of housekeeping. The code now compiles with ghc 7.8 and 7.10, and is compatible with wai-3.0. The dependency on yesod-routes has also been removed, as that package was deprecated, and its code has been folded into wai-routes. I also took the opportunity to add a few long pending features - 1. Subsites! Simpler than the corresponding concept in Yesod, though probably less powerful as well. This is still an evolving experimental feature. 2. Ability to get information about the currently executing route, including the Route Attributes (which is exactly the same thing as in Yesod). Get it at - [http://hackage.haskell.org/package/wai-routes] [https://github.com/ajnsit/wai-routes] Feedback would be greatly appreciated, especially from people using wai-routes in their projects! -- Anupam

2 3

Re: [web-devel] [Yesod] Re: ANN: Wai routes 0.7
by Anupam Jain 12 Jun '15

12 Jun '15

Glad you figured it out! The html function accepts Bytestring instead of Text to be compatible with blaze-html. I will probably add a htmlText function which supports Text instead and works seamlessly with Hamlet et all. One minor thing I notices in your code - it converts from Lazy Text -> Strict Text -> Strict ByteString -> Lazy ByteString If you use encodeUtf8 from Data.Text.Lazy.Encoding, you can go directly from Lazy ByteString -> Lazy Text. -- Anupam On Fri, Jun 12, 2015 at 5:16 PM, Njagi Mwaniki <mwanikibusiness(a)gmail.com> wrote: > Never mind. I found a way to make it work here: > https://github.com/urbanslug/cats/blob/master/Handler/Home.hs > > > On Friday, 12 June 2015 12:08:44 UTC+3, Njagi Mwaniki wrote: >> >> Hey, I am trying to use shakesperean templates with this. I just can't get >> it to work. Even in a quasiqote widget kind of way. What am I doing wrong? >> or is this not supported at all. I would like to finally use external files >> for hamlet lucius and julius. I could show you my code but it's just a ball >> of wool so I won't even bother. >> >> On Wednesday, 10 June 2015 22:19:06 UTC+3, Anupam wrote: >>> >>> You are right. The example in the README is meant to be more of a >>> template which gives you a flavor of what the code looks like. It also >>> has chunks of code missing (and with ellipses in its place) that would >>> need to be filled in before it would compile. The code in the >>> examples/ directory on github has working code examples with cabal >>> files >>> (https://github.com/ajnsit/wai-routes/blob/master/examples/Subsites.hs) >>> I am working on improving the documentation, and adding more examples. >>> >>> To answer your other questions - >>> >>> 1. I just released v0.7 today. Docs on Hackage are built periodically, >>> and we should have proper documentation generated soon. >>> >>> 2. The TH code generates a "resource" for your route which is like an >>> abstract representation of your route declaration. It can be reused in >>> other parts of the code. Notably it is useful when you want to >>> separate the declaration for the Route datatype and the dispatching >>> code. In your example, since the resource is created but not used or >>> exported, it generates a warning. For now you can safely ignore it. >>> >>> 3. "HandlerS sub master" is the type of a handler for a Subsite "sub" >>> running within a master site "master". Unfortunately that type is not >>> very easy to work with. "HandlerM" is a Monadic type that provides >>> easy access to all wai-routes functionality, and can then be converted >>> to a HandlerS using runHandlerM. When you don't have a subsite, the >>> type is simply "HandlerM sub master", which is aliased to "Handler >>> master". That's why in your example, the handlers all have the type >>> "Handler MyRoute". >>> >>> 4. "RouteM" is another Monadic type which makes it easy to compose >>> multiple routes and middleware together to create a final wai >>> application. This along with "nested routes", and "subsites", helps >>> you better organise your application. >>> >>> HTH >>> >>> -- Anupam >>> >>> >>> >>> On Wed, Jun 10, 2015 at 8:38 PM, Njagi Mwaniki >>> <mwaniki...(a)gmail.com> wrote: >>> > It could be just me but the example in your README is totally broken. >>> > It >>> > needs at least the extensions like QuasiQotes and TemplateHaskell. Also >>> > where does DB (used in your example) come from? >>> > >>> > Anyway using other examples from your README I got a minimal working >>> > example >>> > here: https://gist.github.com/urbanslug/58a584c002f54ad75c02 >>> > >>> > I have a few questions regarding the types. >>> > >>> > * The haddocks on hackage don't work yet, do they? >>> > * in myRoute L21 I get the warning `Defined but not used: >>> > ‘resourcesMyRoute’` can you help with that? >>> > * I'm confused about this type signature "runHandlerM :: HandlerM sub >>> > master >>> > () -> HandlerS sub master" >>> > * What are HandlerM and RouteM and sub and master? They are in many >>> > type >>> > signatures and I don't get them. >>> > >>> > Thank you. >>> > >>> > On Wednesday, 10 June 2015 01:54:33 UTC+3, Anupam wrote: >>> >> >>> >> Hi all, >>> >> >>> >> I have just released v0.7 of wai-routes, the typesafe urls framework >>> >> for wai. After letting the code rot for several months, I finally >>> >> managed to carve out some time to do a bit of housekeeping. The code >>> >> now compiles with ghc 7.8 and 7.10, and is compatible with wai-3.0. >>> >> The dependency on yesod-routes has also been removed, as that package >>> >> was deprecated, and its code has been folded into wai-routes. >>> >> >>> >> I also took the opportunity to add a few long pending features - >>> >> 1. Subsites! Simpler than the corresponding concept in Yesod, though >>> >> probably less powerful as well. This is still an evolving experimental >>> >> feature. >>> >> 2. Ability to get information about the currently executing route, >>> >> including the Route Attributes (which is exactly the same thing as in >>> >> Yesod). >>> >> >>> >> Get it at - >>> >> [http://hackage.haskell.org/package/wai-routes] >>> >> [https://github.com/ajnsit/wai-routes] >>> >> >>> >> Feedback would be greatly appreciated, especially from people using >>> >> wai-routes in their projects! >>> >> >>> >> -- Anupam >>> > >>> > -- >>> > You received this message because you are subscribed to the Google >>> > Groups >>> > "Yesod Web Framework" group. >>> > To unsubscribe from this group and stop receiving emails from it, send >>> > an >>> > email to yesodweb+u...(a)googlegroups.com. >>> > For more options, visit https://groups.google.com/d/optout. > > -- > You received this message because you are subscribed to the Google Groups > "Yesod Web Framework" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to yesodweb+unsubscribe(a)googlegroups.com. > For more options, visit https://groups.google.com/d/optout.

2 1

Re: [web-devel] [Yesod] Re: ANN: Wai routes 0.7
by Anupam Jain 10 Jun '15

10 Jun '15

You are right. The example in the README is meant to be more of a template which gives you a flavor of what the code looks like. It also has chunks of code missing (and with ellipses in its place) that would need to be filled in before it would compile. The code in the examples/ directory on github has working code examples with cabal files (https://github.com/ajnsit/wai-routes/blob/master/examples/Subsites.hs) I am working on improving the documentation, and adding more examples. To answer your other questions - 1. I just released v0.7 today. Docs on Hackage are built periodically, and we should have proper documentation generated soon. 2. The TH code generates a "resource" for your route which is like an abstract representation of your route declaration. It can be reused in other parts of the code. Notably it is useful when you want to separate the declaration for the Route datatype and the dispatching code. In your example, since the resource is created but not used or exported, it generates a warning. For now you can safely ignore it. 3. "HandlerS sub master" is the type of a handler for a Subsite "sub" running within a master site "master". Unfortunately that type is not very easy to work with. "HandlerM" is a Monadic type that provides easy access to all wai-routes functionality, and can then be converted to a HandlerS using runHandlerM. When you don't have a subsite, the type is simply "HandlerM sub master", which is aliased to "Handler master". That's why in your example, the handlers all have the type "Handler MyRoute". 4. "RouteM" is another Monadic type which makes it easy to compose multiple routes and middleware together to create a final wai application. This along with "nested routes", and "subsites", helps you better organise your application. HTH -- Anupam On Wed, Jun 10, 2015 at 8:38 PM, Njagi Mwaniki <mwanikibusiness(a)gmail.com> wrote: > It could be just me but the example in your README is totally broken. It > needs at least the extensions like QuasiQotes and TemplateHaskell. Also > where does DB (used in your example) come from? > > Anyway using other examples from your README I got a minimal working example > here: https://gist.github.com/urbanslug/58a584c002f54ad75c02 > > I have a few questions regarding the types. > > * The haddocks on hackage don't work yet, do they? > * in myRoute L21 I get the warning `Defined but not used: > ‘resourcesMyRoute’` can you help with that? > * I'm confused about this type signature "runHandlerM :: HandlerM sub master > () -> HandlerS sub master" > * What are HandlerM and RouteM and sub and master? They are in many type > signatures and I don't get them. > > Thank you. > > On Wednesday, 10 June 2015 01:54:33 UTC+3, Anupam wrote: >> >> Hi all, >> >> I have just released v0.7 of wai-routes, the typesafe urls framework >> for wai. After letting the code rot for several months, I finally >> managed to carve out some time to do a bit of housekeeping. The code >> now compiles with ghc 7.8 and 7.10, and is compatible with wai-3.0. >> The dependency on yesod-routes has also been removed, as that package >> was deprecated, and its code has been folded into wai-routes. >> >> I also took the opportunity to add a few long pending features - >> 1. Subsites! Simpler than the corresponding concept in Yesod, though >> probably less powerful as well. This is still an evolving experimental >> feature. >> 2. Ability to get information about the currently executing route, >> including the Route Attributes (which is exactly the same thing as in >> Yesod). >> >> Get it at - >> [http://hackage.haskell.org/package/wai-routes] >> [https://github.com/ajnsit/wai-routes] >> >> Feedback would be greatly appreciated, especially from people using >> wai-routes in their projects! >> >> -- Anupam > > -- > You received this message because you are subscribed to the Google Groups > "Yesod Web Framework" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to yesodweb+unsubscribe(a)googlegroups.com. > For more options, visit https://groups.google.com/d/optout.

1 0

Re: [web-devel] [Haskell-cafe] no Web-Security component in Haskell?
by Thomas Koch 23 May '15

23 May '15

// moving the question with more info from haskell-cafe to web-devel Hallo, I already wrote a message with the same subject to haskell-cafe without reply. I did not found anything comparable to Spring Security[1][2] (Java) or Symfony Security[3] (PHP) in Haskell. Both components are used in web applications to grant or deny access to resources based on roles, ACLs or custom voters. [1] http://projects.spring.io/spring-security [2] http://docs.spring.io/autorepo/docs/spring-security/3.1.7.RELEASE/apidocs [3] http://api.symfony.com/master/Symfony/Component/Security/Core/SecurityConte… A naive strategy would be to port the concepts of both components, which are very similar, to Haskell. They represent a lot of accumulated knowledge from many experts about web security. Or are there better ways to do web security in a powerful language like Haskell? There was some unfinished role-based-access-control effort in snap[4] that has been removed from git now. [4] https://groups.google.com/forum/#!topic/snap_framework/yUgSEVpP2GE There seem to be a more modern (and more complex) thing than Role-Based- Access-Control now, XACML[5] which is used inside Red Hats JBoss[6]. [5] http://en.wikipedia.org/wiki/XACML [6] http://picketlink.org/about Regards, Thomas Koch

1 0

ANN: nonce package
by Felipe Lessa 22 May '15

22 May '15

(Please forgive me if you received multiple copies of this e-mail.) Hello, The nonce package [1] contains functions to easily generate cryptographic nonces for many situations. Some places where these generated nonces can be used include: - Password recovery e-mail tokens. - XSRF protection tokens. - Session IDs sent on cookies. - Initialization vectors. It uses an AES CPRNG periodically reseeded from /dev/urandom (or equivalent). It has no frills, no knobs, so it's hard to misuse. It's been available for an year but I just realized I've never properly announced it. Regrettably, I've seen many uses of the random package (System.Random) when generating nonces. It's a bad choice: it is not a cryptographically secure PRNG, contains low entropy (64-bit state), and its default usage is seeded predictably (using a constant seed). Please avoid using the random package for generating nonces at all costs. In its stead, use the nonce package or something similar. Cheers, [1] http://hackage.haskell.org/package/nonce -- Felipe.

1 0