Fusebox Conversations: John Quarto-vonTivadar on Plugins

Stan Cox:

John, my main man! I heard you're speaking about plugins and security at the upcoming Fusebox Conference. So what is a "plugin"? Does it hurt?

 

John Quarto:

No, Stan, not if you do it right. It's a way of extending the core functionality of Fusebox. When Fusebox 3 was released, we saw that people had special needs that they wanted handled by the Fusebox core files. They had to change the core files to meet those needs and of course, that introduced problems.

 

SC:

Hmm ... What sort of problems?

 

JQ:

Well, one of the advantages of Fusebox is that it is a well-known standard. It means that my code can work with your code, pretty much seamlessly. But if, when we say "Fusebox", we're talking about two separate things -

 

SC:

So you mean, you might have your kind of core file, and I might have the Rockin' Horse core file.

 

JQ:

Exactly. And when that happens, it means that interoperability goes out the window. It also means that the code you write for one version almost certainly won't work with the next version.

SC:

Versions of what? You mean Fusebox?

 

JQ:

Yes. If you write your code counting on some functionality in Fusebox that's there because you changed the core files, then when version 4 comes out-

 

SC:

Isn't version 4 out already? I'm already trying it out on my own site (the one with frames and lots of buttons and colors ...) Wouldn't want that to break ...

 

JQ:

Yep, officially released. Anyway, when Fusebox 4 was released, the old code wouldn't work with the new version.

 

SC:

And plugins help?

 

JQ:

Yes. They solve the problem because Fusebox 4 is made to accommodate those changes. Fusebox 4 has "plugin points" -- different phases of the code which will include any plugin code you write, making them, in effect, part of the core files. When there's a new version, you just drop your existing plugins in and you're up and running.

 

SC:

Sounds great. So what's a plugin point?

 

JQ:

There are certain points in the processing of a Fusebox request that we identified as points where someone might want to insert some code. For example, there's a "preprocess" plugin point. Any plugins that are registered to run in the preprocess phase will be included before virtually anything else happens in the processing of a fuseaction request.

 

SC:

Preprocess means before processing ... So does that mean there's a plugin point for after processing?

 

JQ:

Right. A "postprocess." We identified all of the points we thought would make sense. There are a total of six of them. One thing that will interest people is that one of the phases is "fuseactionException". When an exception is thrown, the core files will check to see what plugins are registered and will pass control to those plugins. That means that we have a really nice way of doing exception handling -- something that was lacking in Fusebox 3.

 

SC:

Fusebox 4 Rules!

 

JQ:

(laughs)
It does work very well. We're really pleased with Fusebox 4.

 

SC:

But what about security? Did that get built into the core file?

 

JQ:

We thought for a long time about security. The problem is that there is no universal security model. But we didn't want to just punt the ball. Security is too important. What we did was introduce an attribute to the new <fuseaction> tag called "permissions". That allows architects to provide a value that will be available to the core files.

 

SC:

And the core files then check the value of "permissions" with a database of user permissions?

 

JQ:

Well, that might be the way that you would want to handle it, but then again, you might have a completely different mechanism. It's why I say there's no universal security model that fits everyone. Instead of Fusebox trying to impose a one-size-fits-all solution, we provide this "permissions" attribute and then let the architect determine what to do with that in a ...

 

SC:

In a what?

 

JQ:

That's your cue. Your supposed to jump in with the right answer.

 

SC

Oh. Um. in a "security module?"

 

JQ:

Yes-sort of. And how would that security module be implemented?

 

SC:

In a plugin!

 

JQ:

Exactly. It's a perfect application for a plugin. Security can be as simple or as complex as you wish it to be. And you only write one security module, as you called it, and it will be applied for all fuseactions that you wish.

 

SC:

What if I don't want security applied at all?

 

JQ:

Just don't register any security plugin. It's not like you'll pay any performance penalty. The value, if any, of the "permissions" attribute will just be ignored. For that matter, the "permissions" attribute, itself, is optional.

 

SC:

Plugins sound great!

 

JQ:

Yes, and just as importantly, they are very simple to implement. Plus, there are already pre-built plugins available.

 

SC:

You're going to be sharing some tips and tricks on plugins and security at the conference?

 

JQ:

Yes, I've got a fun application that graphically shows how to create a pretty involved security model. And we'll see how plugins can span phases-all sorts of cool stuff.

 

SC:

So where do people go to sign up?

 

JQ:

That would be at www.cfconf.org/fusebox2003.

 

SC:

And what if we want to buy a copy of your Rockin' new book?

 

JQ:

It will be available at the conference or you can buy it from techspedition.com. People preordering the book will get a 25% discount. Of course, there's a way to get the book for free.

 

SC:

What's that?

 

JQ:

Hal and I are doing a "FastTrack to Fusebox 4" class in Las Vegas immediately prior to the conference. Come to the class (halhelms.com) and you'll get a free book AND a pass to the conference.

 

SC:

Wow, thanks for the tips, John!

 

JQ:

You're welcome, Stan. See you at the conference.

 

This interview was originally published (in a slightly different format) by Hal Helms. If you liked it, you might want to check out Hal's Occasional Newsletters on his website.

• Subscribe
• RSS

• Editorial
• Specials
• Community
• News
• Tech and Tags
• Views
• Reviews
• Techniques
• Security
• Best of ColdFusion Talk
• Knowledge Base
• Blog Watch

• Tipical Charlie