Planet CakePHP

I went out today and ended up in a Barnes And Nobel. I wandered through the store and after thinking about reading boring books I went to the section that fascinates me -- the computer section. I glanced through the books they offered and landed on one in particular. That book is RESTful Web Services - Web services for the real world By Leonard Richardson, Sam Ruby. There was one section that I skimmed where the author talked about how every web page was in fact a web service. No matter what. If you don't provide an API people will build one or scrape your data. If you obfuscate your data someone will reverse engineer it and scrape it. If it is published, it's useful, and it's online, it is a webservice. If it's a webservice, why not just open it up?

"That's hard" -- Anyone who has ever tried to write a RESTful service from scratch

Not with cake. We have these beautiful things called views, and not the kind that jump to your mind. Normally when you talk about CakePHP views you think about the display component of your program (usually located in /app/views/:controller/:action.ctp) but I mean the MVC definition of a view. The file that manages the rendering of the user interface. In the case of CakePHP this file is called view.php (containing a class called View) located at /cake/libs/view/view.php.

I had someone ask me in IRC once, “When did I set it to use that view," well you didn't really. It was automatically set in the Controller class with the $view variable. It is by default set to “View" which makes perfect sense in the sense of a regular website, but we want to be new age-e and fancy with our RESTful interface. It is a well known fact that I'm incredibly lazy and would rather write code that writes code or something so generic that it can be reused over and over again. In this case though I'm particularly proud of how well my solution worked. And how simple it was to code. Granted I wrote it at 3:30 am and it isn't perfect but it is a start. With no more than a new file in your view folder, a single line in your routes.php file and few lines in either beforeFilter or beforeRender you have turned your entire site into a restful interface. It even makes Julian fries!

So without any further adieu, I give you the XmlView and the code required to turn it on. Create a file in /app/views/xml.php and put this in there.

<?php
App::import('View', 'Theme');
class XmlView extends ThemeView {
/**
* Render the current view variables as xml data
*
* @return string Rendered Element
*/
function render($action = null, $layout = null, $file = null) {
if ($this->hasRendered) {
return true;
}

header("Content-type: text/xml");

App::import('Xml');
$xml = new Xml($this->viewVars);
return $xml->toString();
}
}
?>

Put a line in your routes.php file that says (if you don't have one already of course)
Router::parseExtensions();

And finally put this in one of your beforeFilter/beforeRender calls
if ($this->params['url']['ext'] == 'xml') {
$this->view = 'Xml';
}

I now would like you to visit any page on your site but append .xml to the end of the url. You should see a nicely formatted XML output. It isn't as good as if you wrote one by hand for each page but it will freaking do. If you want to see what it looks like but don't want to put it on a site check it out, my blog is now restful! I'm not sure what good that does anyone, but you can at least look at it. There are a few warnings though I must say.

1: The output may include information you don't want to make public if you haven't been good about using containable and pulling only the data you want to the view. For most sites this means including the hashed password for your users table (if thats viewable publicly) as well as any links made to any user in specific. I firmly believe that if you are using auth component you could publish your passwords table and no one would ever have their account compromised, but it isn't really something you want to test. So for me I put this in the after find for my user controller.

function afterFind($results) {
if (strtolower(substr($_GET['url'], 0, 5)) != "users") {
foreach($results as &$result) {
unset($result['User']['password']);
unset($result['User']['auth_token']);
}
}
return $results;
}

That way I don't even have to think about what I make public from the user's profile (which is always good.)

2: This is FAR from being foolproof. I really mean that in the most amazingly big bolt text I can do. You WILL expose data that you don't want to at some point if you aren't REALLY careful. Do not think this is a no brainer

3: I'm not freaking kidding, this is giving the keys out to the castle. Do not do it if you're an idiot and think there is a chance of you giving away anything you don't want to on your site. (This is the implied waiver of liability.) Now for a formal one! If you do something stupid with this at my request I take no responsibility for it. I don't care how many people have their SSN published, I didn't force you to do this and it is your fault and your fault alone.

Super bonus round!

I've been using this technique to make writing stuff that is Ajax much easier. I just created another view and used return json_encode($this->viewVars); instead of the XML return statement and now I don't have to write a JSON interface to my code either! Isn't life wonderful.

PS: You can see samples of that here here and here. That last one has a really funny url if you want to look at it.

Sincerely,~Andrew Allen