[Catalyst-dev] RFC: make ActionClass less ugly or implement Secure attribute in base Action

[Ido Rosen]

This afternoon, I implemented a Catalyst::DispatchType::Secure, which  
filters actions and denies execution to actions with the Secure  
attribute that are being executed over an insecure connection (based  
on $c->req->secure).  mst "suggested" that this would be better  
implemented as an ActionClass.

A first look of the Secure DispatchType is available at http:// 
scsys.co.uk:8001/4608 ...though it is not ready for use.

While I agree that the ActionClass is an ideal venue for "filters"  
such as this (which would overload match(), for example), I can't  
quite bring myself to type "ActionClass('Secure')" rather than just  
"Secure" every time I want to ensure an action is only matched/ 
executed if the connection is being made over SSL.  It's just too ugly!

I have two recommendations to propose:

(1) The Secure attribute should be implemented in the same way as  
Args is, in the base Catalyst::Action::match function.  It should  
take as an argument the action to forward to upon failure to secure  
the connection, or no arguments if it should fail silently.  It  
should not actually rewrite the URL and redirect to an HTTPS server,  
but rather the action that it forwards to (in its argument) should do  
that, which can be implemented by the user.

(2) If you do not want to implement the Secure attribute in the core,  
I propose that ActionClasses be detected, in addition to ActionClass 
('SomeName'), as an attribute with just their name.  For example, if  
I created a really simple Secure ActionClass that just acted as a  
filter, shown below, I could make an Action be of this ActionClass by  
simple specifying: sub myaction : Global Secure { ... }, rather than  
having to type sub myaction : Global ActionClass('Secure') { ... }.

This would pose the potential for naming conflicts.  So, when such  
conflicts arise, I propose that the first ActionClass that matches  
the attribute be used.  When I say "first", I mean: "Recurse down the  
tree of Catalyst::DispatchType and Catalyst::Action inheritance, and  
prefer the DispatchTypes  before ActionClasses, and the first  
ActionClass closest to the base C::Action" when parsing the attributes.

Cheers,
Ido Rosen

A super-simplistic Secure ActionClass (untested):

   package Catalyst::Action::Secure;
   use base 'Catalyst::Action';

sub execute {
     my $self = shift;
     my ($controller, $c ) = @_;

     if ($c->request->secure) { # if secure, proceed without question.
       $self->NEXT::execute( @_ );
       return 1;
     } else { return 0; }
}