JavaScript + OAuth guru? We need to make OAuth AJAX requests to CouchDB

Bug #677697 reported by Jason Gerard DeRose
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Dmedia
Fix Released
High
Jason Gerard DeRose

Bug Description

Stuart Langridge said that if I use basic auth instead of OAuth to talk to desktopcouch, he will be very very cross with me!

Both dmedia (and Novacut) will use HTML5 user interfaces that make AJAX requests to CouchDB. This is cool because it allows us to 1) use familiar, productive web technologies that countless designers already know, and 2) run basically the same user interface whether hosted on a server or running as a WebKitGtk/QtWebKit local application.

desktopcouch configures its CouchDB instance to use OAuth (which is a good thing). Dirty little secret is desktopcouch also accepts basic auth (that's how firefox ~/.local/share/desktop-couch/couchdb.html works), so that's a development option for getting the plumbing working. But remember, I don't want Stuart to be cross with me!

Things will work like this:

1) When the dmedia service starts, it with get the OAuth credentials from gnomekeyring and insert them as JavaScript variables in the Genshi template
2) When the UI needs to make a request to CouchDB (it will all be AJAX), some yet to be written JavaScript signs the OAuth request client-side no one gets scolded

Over time I will make this component into something very generic that can be used by dmedia, Novacut, or other desktopcouch apps that want to talk to CouchDB with direct AJAX requests.

Related branches

Changed in dmedia:
status: New → Triaged
importance: Undecided → High
milestone: none → 0.2
tags: added: couchdb javascript oath
tags: added: desktopcouch
Revision history for this message
Manish Sinha (मनीष सिन्हा) (manishsinha) wrote :

I did some basic research.

Since computers are shared between many users, the concept of fixed port cannot work since every user has it's own desktopcouch instance. For this the port number of RESTful web service has to be known via dbus. If the bus is not running, it is activated

>> import dbus
>> bus=dbus.SessionBus()
>> proxy=bus.get_object('org.desktopcouch.CouchDB', '/')
>> z=proxy.getPort()
>> z
dbus.Int32(54191)
>> int(z)
54191

So 54191 is the port number on which the RESTful web service runs.

Revision history for this message
Manish Sinha (मनीष सिन्हा) (manishsinha) wrote :

The bigger problem which I see is that how will a sandboxed HTML5 application running in a browser will be able to access DBus to get the port number. Once the port number has been retrieved, next it's just pure RESTful API.

I have no clue how it has to be done. Anyone knows?

Revision history for this message
Jason Gerard DeRose (jderose) wrote :

Okay, even though Stuart will scold me, I'm pushing this back to 0.3. I really want to get the great HTML5 UI that James Raymond has been working on hooked up and in 0.2, and I just don't have time for the oath stuff. So basic auth for now, oath in 0.3

Changed in dmedia:
milestone: 0.2 → 0.3
Changed in dmedia:
assignee: nobody → Jason Gerard DeRose (jderose)
status: Triaged → In Progress
Changed in dmedia:
status: In Progress → Fix Committed
Changed in dmedia:
status: Fix Committed → In Progress
Revision history for this message
Jason Gerard DeRose (jderose) wrote :

Thanks to some help from Stuart Langridge, I've got oauth more or less working using a handler for the WebView 'resource-request-starting' event. It's not exactly pretty, but it's working, so I'm closing this bug. I will open new bugs for specific changes we might need to the oauth functionality.

The current problem is that apparently one can't modify the request headers from python-webkit because the headers are only available via an immutable, opaque gobject.GBoxed. So we can only pass the oauth info via the URL. Causes problems with Futon, but I think it will work okay for what we need to do.

I'm still developing on Maverick, hopefully this python-webkit issue has been fixed in Natty.

Changed in dmedia:
status: In Progress → Fix Committed
Changed in dmedia:
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.