It's provided for convenience, but not exactly the convenience you're alluding to. The bool parameter isn't hard-coded into Yesod, it is determined by the isWriteRequest method. This makes it very convenient for defining read and write permissions. If you have a good RESTful design, then the default implementation of isWriteRequest will likely be correct for you. However, there are times when you'd want to specify something else. For example, you might have a page that requires a file parameter, and therefore is a POST request, but is actually read-only. For such situations, you can easily override. So the convenience of that bool parameter is that (1) it's usually the easiest way to distinguish GET from POST and (2) when you have a more complicated setup, you can still keep your isAuthorized function nice and declarative. All that said, I have no objections to looking into a new API. And now is the time to discuss it; Greg and I have been putting in a lot of code in the past week towards the 0.9 release. Michael On Tue, Jul 19, 2011 at 2:11 PM, Anakreon Mentis wrote:

I understand that it is provided for convenience. In case the authors of yesod are considering changes in the function's interface, it would be more convenient to write isAuthorized HomeR POST = Unauthorized

Admitably is just a little more convenient and perhaps is not worth the hassle to check if anyone is using the Bool parameter of isAuthorized and possibly make a non backward compatible change.

On Tue, Jul 19, 2011 at 6:31 AM, Max Cantor wrote:

...

forgot to reply to all

Begin forwarded message:

...

From: Max Cantor Date: July 19, 2011 10:45:54 AM GMT+08:00 To: Anakreon Mentis Subject: Re: [web-devel] Yesod. Routes. Resources. Authorization. ACL

Since isAuthorized runs in the Handler monad you can pull out the request method from the request.  I think the second parameter is just intended as a bit of a timesaver.

max

On Jul 19, 2011, at 5:46 AM, Anakreon Mentis wrote:

...

Regarding the isAuthorized function discussed at http://www.haskell.org/pipermail/web-devel/2011/000855.html, I believe it would be better if the second parameter was the method (GET, POST, ..) instead of a boolean indicating if it is POST or DELETE.

_______________________________________________ web-devel mailing list web-devel@haskell.org http://www.haskell.org/mailman/listinfo/web-devel

_______________________________________________ web-devel mailing list web-devel@haskell.org http://www.haskell.org/mailman/listinfo/web-devel

_______________________________________________ web-devel mailing list web-devel@haskell.org http://www.haskell.org/mailman/listinfo/web-devel