bionic-falcon

Bionic Falcon – Automated CRUD operations for Falcon 2

Makes RESTful CRUD easier.

Acknowledgements

This is a Falcon 2 compatible adaptation of Gary Monson’s Falcon AutoCRUD package – huge props to him for building out an amazing set of features! I very much plan to keep this package in the same spirit and format as the original.

Quick start for contributing

::

virtualenv -p which python3 virtualenv source virtualenv/bin/activate pip install -r requirements.txt pip install -r dev_requirements.txt nosetests

This runs the tests with SQLite. To run the tests with Postgres (using pg8000), you must have a Postgres server running, and a postgres user with permission to create databases:

::

export BIONIC_DSN=postgresql+pg8000://myuser:mypassword@localhost:5432 nosetests

Some tests are run only when testing on Postgres due to only being relevant to Postgres, such as when testing features to do with Postgres data types.

Usage

Declare your SQLAlchemy models:

::

from sqlalchemy.ext.declarative import declarative_base from sqlalchemy import create_engine, Column, Integer, String

Base = declarative_base()

class Employee(Base): tablename = 'employees' id = Column(Integer, primary_key=True) name = Column(String(50)) age = Column(Integer)

Declare your resources:

::

from bionic_falcon.resource import CollectionResource, SingleResource

class EmployeeCollectionResource(CollectionResource): model = Employee

class EmployeeResource(SingleResource): model = Employee

Apply them to your app, ensuring you pass an SQLAlchemy engine to the resource classes:

::

from sqlalchemy import create_engine import falcon from bionic_falcon.middleware import Middleware

db_engine = create_engine('sqlite:///stuff.db')

app = falcon.API( middleware=[Middleware()], )

app.add_route('/employees', EmployeeCollectionResource(db_engine)) app.add_route('/employees/{id}', EmployeeResource(db_engine))

This automatically creates RESTful endpoints for your resources:

::

http GET http://localhost/employees http GET http://localhost/employees?name=Bob http GET http://localhost/employees?age__gt=24 http GET http://localhost/employees?age__gte=25 http GET http://localhost/employees?age__lt=25 http GET http://localhost/employees?age__lte=24 http GET http://localhost/employees?name__contains=John http GET http://localhost/employees?name__startswith=John http GET http://localhost/employees?name__endswith=Smith http GET http://localhost/employees?name__icontains=john http GET http://localhost/employees?name__istartswith=john http GET http://localhost/employees?name__iendswith=smith http GET http://localhost/employees?name__in=[Grace Hopper,Ada Lovelace] http GET http://localhost/employees?company_id__null=1 http GET http://localhost/employees?company_id__null=0 echo '{"name": "Jim"}' | http POST http://localhost/employees http GET http://localhost/employees/100 echo '{"name": "Jim"}' | http PUT http://localhost/employees/100 echo '{"name": "Jim"}' | http PATCH http://localhost/employees/100 http DELETE http://localhost/employees/100

POST an array to add entities in bulk

echo '[{"name": "Carol"}, {"name": "Elisa"}]' | http POST http://localhost/employees

Note that by default, PUT will only update, and will not insert a new resource if a matching one does not exist at the address. If you wish new resources to be created, then add the following to your resource:

::

allow_put_insert = True

Limiting methods

By default collections will autogenerate methods GET, POST and PATCH,
while single resources will autogenerate methods GET, PUT, PATCH,
DELETE.

To limit which methods are autogenerated for your resource, simply list
method names as follows:

::

   # Able to create and search collection:
   class AccountCollectionResource(CollectionResource):
       model = Account
       methods = ['GET', 'POST']

   # Only able to read individual accounts:
   class AccountResource(CollectionResource):
       model = Account
       methods = ['GET']

Pre-method functionality.

To do something before a POST or PATCH method is called, add special methods as follows:

::

class AccountCollectionResource(CollectionResource): model = Account

   def before_post(self, req, resp, db_session, resource, *args, **kwargs):
     # Anything you do with db_session is in the same transaction as the
     # resource creation.  Resource is the new resource not yet added to the
     # database.
     pass

class AccountResource(SingleResource): model = Account

   def before_patch(self, req, resp, db_session, resource, *args, **kwargs):
     # Anything you do with db_session is in the same transaction as the
     # resource update.  Resource is the modified resource not yet saved to
     # the database.
     pass

   def before_delete(self, req, resp, db_session, resource, *args, **kwargs):
     # Anything you do with db_session is in the same transaction as the
     # resource delete.  Resource is the resource to be deleted (or "marked as
     deleted" - see section on "not really deleting").
     pass

Post-method functionality

To do something after success of a method, add special methods as
follows:

::

   class AccountCollectionResource(CollectionResource):
       model = Account

       def after_get(self, req, resp, collection, *args, **kwargs):
           # 'collection' is the SQLAlchemy collection resulting from the search
           pass

       def after_post(self, req, resp, new, *args, **kwargs):
           # 'new' is the created SQLAlchemy instance
           pass

       def after_patch(self, req, resp, *args, **kwargs):
           pass


   class AccountResource(CollectionResource):
       model = Account

       def after_get(self, req, resp, item, *args, **kwargs):
           # 'item' is the retrieved SQLAlchemy instance
           pass

       def after_put(self, req, resp, item, *args, **kwargs):
           # 'item' is the changed SQLAlchemy instance
           pass

       def after_patch(self, req, resp, item, *args, **kwargs):
           # 'item' is the patched SQLAlchemy instance
           pass

       def after_delete(self, req, resp, item, *args, **kwargs):
           pass

Be careful not to throw an exception in the above methods, as this will
end up propagating a 500 Internal Server Error.

Modifying a patch
~~~~~~~~~~~~~~~~~

If you want to modify the patched resource before it is saved (e.g. to
set default values), you can override the default empty method in
SingleResource:

::

   class AccountResource(SingleResource):
       model = Account

       def modify_patch(self, req, resp, resource, *args, **kwargs):
           """
           Add 'arino' to people's names
           """
           resource.name = resource.name + 'arino'

Identification and Authorization

Define classes that know how to identify and authorize users:

::

class TestIdentifier(object): def identify(self, req, resp, resource, params): req.context['user'] = req.get_header('Authorization') if req.context['user'] is None: raise HTTPUnauthorized('Authentication Required', 'No credentials supplied')

class TestAuthorizer(object): def authorize(self, req, resp, resource, params): if 'user' not in req.context or req.context['user'] != 'Jim': raise HTTPForbidden('Permission Denied', 'User does not have access to this resource')

Then declare which class identifies/authorizes what resource or method:

::

Authorizes for all methods

@identify(TestIdentifier) @authorize(TestAuthorizer) class AccountCollectionResource(CollectionResource): model = Account

Or only some methods

@identify(TestIdentifier) @authorize(TestAuthorizer, methods=['GET', 'POST']) @authorize(OtherAuthorizer, methods=['PATCH']) class OtherAccountCollectionResource(CollectionResource): model = Account

Filters/Preconditions

You may filter on GET, and set preconditions on single resource PATCH or
DELETE:

::

   class AccountCollectionResource(CollectionResource):
       model = Account

       def get_filter(self, req, resp, query, *args, **kwargs):
           # Only allow getting accounts below id 5
           return query.filter(Account.id < 5)

   class AccountResource(SingleResource):
       model = Account

       def get_filter(self, req, resp, query, *args, **kwargs):
           # Only allow getting accounts below id 5
           return query.filter(Account.id < 5)

       def patch_precondition(self, req, resp, query, *args, **kwargs):
           # Only allow setting owner of non-owned account
           if 'owner' in req.context['doc'] and req.context['doc']['owner'] is not None:
               return query.filter(Account.owner == None)
           else:
               return query

       def delete_precondition(self, req, resp, query, *args, **kwargs):
           # Only allow deletes of non-owned accounts
           return query.filter(Account.owner == None)

Note that there is an opportunity for a race condition here, where
another process updates the row AFTER the check triggered by
patch_precondition is run, but BEFORE the row update. This would leave
inconsistent data in your application if the other update would make the
precondition no longer hold.

To prevent this, you can simply add a `versioning
column <http://docs.sqlalchemy.org/en/latest/orm/versioning.html>`__ to
your model. When your model contains such a column, then as long as you
have a precondition to check for the correct conditions before updating,
you will be guaranteed that if another process changes the row in the
meantime, you will fail to update, and a 409 response will be returned.
This doesn’t necessarily mean the row no longer conforms to the
precondition, so you can try the update again, and it will update if the
precondition still holds.

This versioning only helps you on an UPDATE, not a DELETE, so if you
want a delete_precondition to be protected, you will need to use
mark_deleted to update the row (see “not really deleting”, next),
instead of doing a true delete.

Not really deleting
~~~~~~~~~~~~~~~~~~~

If you want to just mark a resource as deleted in the database, but not
really delete the row, define a ‘mark_deleted’ in your SingleResource
subclass:

::

   class AccountResource(SingleResource):
       model = Account

       def mark_deleted(self, req, resp, instance, *args, **kwargs):
           instance.deleted = datetime.utcnow()

This will cause the changed instance to be updated in the database
instead of doing a DELETE.

Of course, the database row will still be accessible via GET, but you
can automatically filter out “deleted” rows like this:

::

   class AccountCollectionResource(CollectionResource):
       model = Account

       def get_filter(self, req, resp, resources, *args, **kwargs):
           return resources.filter(Account.deleted == None)

   class AccountResource(SingleResource):
       model = Account

       def get_filter(self, req, resp, resources, *args, **kwargs):
           return resources.filter(Account.deleted == None)

       def mark_deleted(self, req, resp, instance, *args, **kwargs):
           instance.deleted = datetime.utcnow()

You could also look at the request to only filter out “deleted” rows for
some users.

Joins
~~~~~

If you want to add query parameters to your collection queries, that do
not refer to a resource attribute, but which refer to an attribute in a
linked table, you can do this in get_filter, as with the below example.
Ensure that you remove the extra parameter value from req.params before
returning from get_filter, as bionic-falcon will try (and fail) to look
up the parameter in the main resource class.

::

   class Company(Base):
       __tablename__ = 'companies'
       id          = Column(Integer, primary_key=True)
       name        = Column(String(50), unique=True)
       employees   = relationship('Employee')

   class Employee(Base):
       __tablename__ = 'employees'
       id          = Column(Integer, primary_key=True)
       name        = Column(String(50), unique=True)
       company_id  = Column(Integer, ForeignKey('companies.id'), nullable=True)
       company     = relationship('Company', back_populates='employees')

   class EmployeeCollectionResource(CollectionResource):
       model = Employee

       def get_filter(self, req, resp, query, *args, **kwargs):
           if 'company_name' in req.params:
               company_name = req.params['company_name']
               del req.params['company_name']
               query = query.join(Employee.company).filter(Company.name == company_name)
           return query

Alternatively, for arguments that are part of the URL you may use
lookup_attr_map directly (note that attr_map is now deprecated - see
below):

::

   class CompanyEmployeeCollectionResource(CollectionResource):
       model = Employee

       lookup_attr_map = {
           'company_id':   lambda req, resp, query, *args, **kwargs: query.join(Employee.company).filter(Company.id == kwargs['company_id'])
       }

This is useful for the following sort of URL:

::

   GET /companies/{company_id}/employees

Mapping
~~~~~~~

Mapping used to be done with attr_map. This is now deprecated in favour
of lookup_attr_map and inbound_attr_map (since attr_map was used for two
different purposes before).

To look up an entry via part of the URL:

::

   GET /companies/{company_id}/employees

Use the name of the column to map to:

::

   class CompanyEmployeeCollectionResource(CollectionResource):
       model = Employee

       lookup_attr_map = {
           'company_id': 'coy_id'
       }

Or use a lambda to return a modified query:

::

   class CompanyEmployeeCollectionResource(CollectionResource):
       model = Employee

       lookup_attr_map = {
           'company_id': lambda req, resp, query, *args, **kwargs: query.join(Employee.company).filter(Company.id == kwargs['company_id'])
       }

You may use inbound_attr_map to specify mappings to place the value from
a URL component into another field:

::

   class CompanyEmployeeCollectionResource(CollectionResource):
       model = Employee

       inbound_attr_map = {
           'company_id': 'coy_id'
       }

Both lookup_attr_map and inbound_attr_map may have a mapping value set
to None, in which case the mapping key in the URL component is ignored.

Sorting
~~~~~~~

You can specify a default sorting of results from the collection search.
The below example sorts firstly by name, then by salary descending:

::

   class EmployeeCollectionResource(CollectionResource):
       model = Employee
       default_sort = ['name', '-salary']

The caller can specify a sort (which overrides the default if defined):

::

   GET /path/to/collection?__sort=name,-salary

Paging
~~~~~~

The caller can specify an offset and/or limit to collection GET to
provide paging of search results.

::

   GET /path/to/collection?__offset=10&__limit=10

This is generally most useful in combination with \__sort to ensure
consistency of sorting.

Limiting response fields

You can limit which fields are returned to the client like this:

::

class EmployeeCollectionResource(CollectionResource): model = Employee response_fields = ['id', 'name']

Or you can limit them programmatically like this:

::

class EmployeeCollectionResource(CollectionResource): model = Employee

   def response_fields(self, req, resp, resource, *args, **kwargs):
       # Determine response fields via things such as authenticated user
       return fields

Creating linked resources

The collection POST method allows creation of linked resources in the
one POST call. If your model includes a relationship to the linked
resource, you can include the attributes to use in the new linked
resource, and the link will be automatically made in the database:

::

   class Company(Base):
       __tablename__ = 'companies'
       id          = Column(Integer, primary_key=True)
       name        = Column(String(50), unique=True)
       employees   = relationship('Employee')

   class Employee(Base):
       __tablename__ = 'employees'
       id          = Column(Integer, primary_key=True)
       name        = Column(String(50), unique=True)
       company_id  = Column(Integer, ForeignKey('companies.id'), nullable=True)
       company     = relationship('Company', back_populates='employees')

   class CompanyCollectionResource(CollectionResource):
       model = Company
       allow_subresources = True

::

   cat post.json
   {
     name: "Initech",
     employees: [
       {
         name: "Alice"
       },
       {
         name: "Bob"
       }
     ]
   }

   cat post.json | http POST http://localhost/companies

This will create a company called Initech and two employees, who will be
linked to Initech via Employee.company_id. Note the that
CollectionResource subclass must have the attribute allow_subresources
and set it to True, for this feature to be enabled.

Bulk operations
~~~~~~~~~~~~~~~

You can bulk add entities using a PATCH method to a collection. If the
collection is defined in the standard way, you are limited to adding to
only that model:

::

   class EmployeeCollectionResource(CollectionResource):
       model = Employee

To add to the employee collection, each operation’s path must be ‘/’:

::

   echo '{"patches": [{"op": "add", "path": "/", "value": {"name": "Jim"}}]}' | http PATCH http://localhost/employees

If you would like to be able to add to multiple types of collection in
one bulk update, define the path and model for each in a special
collection:

::

   class RootResource(CollectionResource):
       patch_paths = {
         '/employees': Employee,
         '/accounts':  Account,
       }

   app.add_route('/', RootResource(db_engine))

To add to the collections, each operation’s path must be in the defined
patch_paths:

::

   cat patches.json
   {
     "patches": [
       {"op": "add", "path": "/employees", "value": {"name": "Jim"}}
       {"op": "add", "path": "/accounts", "value": {"name": "Sales"}}
     ]
   }
   cat patches.json | http PATCH http://localhost/employees

All the operations done in a single PATCH are performed within a
transaction.

Naive datetimes
~~~~~~~~~~~~~~~

Normally a datetime is assumed to be in UTC, so they are expected to be
in the format ‘YYYY-mm-ddTHH:MM:SSZ’, and are also output like that.

Sometimes (not often!) you need to store a “naive” datetime, where time
zone is not relevant (e.g. to store the datetime of a nationwide public
holiday, where the time zone is not relevant, and the “real” date/time
is simply in the local time zone, whatever that might be - i.e. the
client can treat is as being in their own localtime.

For cases such as this, set the naive_datetimes class variable as a list
of the column names to be treated as naive datetimes:

::

   class PublicHolidayCollectionResource(CollectionResource):
       model = PublicHoliday
       naive_datetimes = ['start', 'end']

These fields will then be parsed and returned in the format
‘YYYY-mm-ddTHH:MM:SS’, i.e. without the ‘Z’ suffix.

Additionally, when a numeric datetime is desired rather than a a
datetime string, you can similarly specify that the resource should
treat any input and output as a number representing milliseconds since
the Unix epoch.

::

   class DeadlineCollectionResource(CollectionResource):
       model = Deadlines
       datetime_in_ms = ['started_on', 'due_by']

Meta-information
~~~~~~~~~~~~~~~~

To add meta-information to each resource in a collection response,
assuming your models are:

::

   class Team(Base):
       __tablename__ = 'teams'
       id          = Column(Integer, primary_key=True)
       name        = Column(String(50))
       characters  = relationship('Character')

   class Character(Base):
       __tablename__ = 'characters'
       id          = Column(Integer, primary_key=True)
       name        = Column(String(50))

       team_id     = Column(Integer, ForeignKey('teams.id'), nullable=True)
       team        = relationship('Team', back_populates='characters')

Then include the following:

::

   catchphrases = {
       'Oliver':   'You have failed this city',
       'Cisco':    "OK, you don't get to pick the names",
   }

   class CharacterCollectionResource(CollectionResource):
       model = Character
       resource_meta = {
           'catchphrase':  lambda resource: catchphrases.get(resource.name, None)
       }

To add meta-information to the top level of a single resource response,
include the following:

::

   catchphrases = {
       'Oliver':   'You have failed this city',
       'Cisco':    "OK, you don't get to pick the names",
   }

   class CharacterResource(SingleResource):
       model = Character
       meta = {
           'catchphrase':  lambda resource: catchphrases.get(resource.name, None)
       }

You can join another table to get the meta information:

::

   class CharacterCollectionResource(CollectionResource):
       model = Character
       resource_meta = {
           'catchphrase':  lambda resource, team_name: catchphrases.get(resource.name, None),
           'team_name':    lambda resource, team_name: team_name,
       }
       extra_select = [Team.name]

       def get_filter(self, req, resp, query, *args, **kwargs):
           return query.join(Team)

   class CharacterResource(SingleResource):
       model = Character
       meta = {
           'catchphrase':  lambda resource, team_name: catchphrases.get(resource.name, None),
           'team_name':    lambda resource, team_name: team_name,
       }
       extra_select = [Team.name]

       def get_filter(self, req, resp, query, *args, **kwargs):
           return query.join(Team)

You can even use SQL functions to calculate the values in the
meta-information:

::

   from sqlalchemy import func

   class TeamCollectionResource(CollectionResource):
       model = Team
       resource_meta = {
           'team_size': lambda resource, team_size: team_size,
       }
       extra_select = [func.count(Character.id)]

       def get_filter(self, req, resp, query, *args, **kwargs):
           return query.join(Character).group_by(Team.id)

   class TeamResource(SingleResource):
       model = Team
       meta = {
           'team_size': lambda resource, team_size: team_size,
       }
       extra_select = [func.count(Character.id)]

       def get_filter(self, req, resp, query, *args, **kwargs):
           return query.join(Character).group_by(Team.id)

Or you can determine them entirely programmatically like this:

::

   class TeamCollectionResource(CollectionResource):
       model = Team
       def resource_meta(self, req, resp, resource, team_size, *args, **kwargs):
           return {
               'team_size': team_size,
           }
       extra_select = [func.count(Character.id)]

       def get_filter(self, req, resp, query, *args, **kwargs):
           return query.join(Character).group_by(Team.id)

   class TeamResource(SingleResource):
       model = Team
       def meta(self, req, resp, resource, team_size, *args, **kwargs):
           return {
               'team_size': team_size,
           }
       extra_select = [func.count(Character.id)]

       def get_filter(self, req, resp, query, *args, **kwargs):
           return query.join(Character).group_by(Team.id)

The advantage of using the above method is that the keys can also be
determined at runtime, and may change in difference circumstances
(e.g. according to query parameters, or the permissions of the caller).
To include NO meta at all for the resource, return None from
``resource_meta`` or ``meta`` functions.

Access to submitted data
~~~~~~~~~~~~~~~~~~~~~~~~

Note that the request body can be accessed (e.g. in pre-method
functionality function) either from ``req.context['doc']`` (as JSON), or
the original binary body content is available in
``req.context['request_body']`` if you specify that the HTTP method
should retain it:

::

   class TeamResource(CollectionResource):
     model = Team
     keep_request_body = ['POST']