Form separation in Tapestry

In this post I want to talk about separation of form data between sections, why it may be necessary to and how to implement it in tapestry5. Firstly lets think about why we can decide to separate our forms into sections.

1. We may need some organization of form data by logical sense.
2. We may need some separate validation for each group of form data.
3. We may need some validation highlighting for sections with errors.
4. We may have a very long form and want to extract some data into separate components.

All of this is possible. So lets look at this issues step by step.

Tapestry Fixed Control Name Fixin

Have you ever had a problems with Tapestry5 ValidationTracker service? When after zone update inside a form you are trying to submit this form, validation fails and all specified form values inside updated zone disappear? No? Then try this demo, choose country, then city(name is empty), submit => validation fails, city value is missed.

Tapestry Render Deferred Fixin

Tapestry5 pages consists of a set of components placed on this page. When client request comes to the server this components will render themselves in the same order they was placed on the page. The rendering of each component is divided into a number of phases (Component Rendering) but all this phases are triggered within its component rendering. So, what if there is a dependency of component-A in some setup logic of component-B? No problem, when their order is <component-B> => <component-A>. But what will happen if their order is <component-A> => <component-B>? Component-A will have invalid data from component-B(it hasn't initialized itself yet). There is a solution in Label component from tapestry-core. It defers "for" attribute rendering using Heartbeat service.

Tapestry Ajax Upload Fixin

Do you have problems with file uploading when using it with ajax requests?
The issue is that ajax file uploading isn't transparently supported. There are some approaches to solve this issue. I will use jQuery as client side framework and Tapestry5 as server side for all examples.

1. Using advantages of html5 http://www.w3.org/TR/XMLHttpRequest2/#interface-formdata

The main idea is to use special JS interface called FormData. We can create it from existing form element and it will copy all data from it or we can create empty FormData and fill it from scratch. Then we can use it in ajax request and it will work.

... in almost all modern browsers: Chrome 7+, FF 4.0, IE 10+(really?), Opera 12+, Safari 5+. But what about old browsers?

2. Using usual form submission in iframe.
The idea is to emulate asynchronous request via form submission in separate iframe. We just need to create iframe and form targeted to this iframe, attach file inputs to newly created form, copy input values from original form to new as hidden fields, and submit this form as usual. Response from server will be automatically loaded in iframe body.


In this case we should also improve server logic to think about such request as ajax request. And don't forget about escaping.

Custom OAuth API with SpringSocial. Google OAuth2.

In my previous article I described how to begin friendship of spring-social and tapestry:
SpringSocial and Tapestry. Let's be connected.
There are 2 implementations of Twitter and Facebook templates in spring-social library. They are for OAuth1 and OAuth2 protocols respectively. But what about other APIs that also works with OAuth protocol?
Lets look on new Google OAuth 2 API. You can play with it here:
OAuth 2.0 Playground
Firstly we should decide what we need. In this article I will provide information mostly about Google user profile.

Secure application pages with tapestry5. Rethinking.

Continuing the theme started in my previous topic:
Secure application pages with tapestry5
Just rethink page security and marked some interesting moments.
Like in previous article let's imagine that we have some application with authentication and users separation by their authorities. There are also a set of allowed pages and a set of allowed actions on this pages for every such authority. So we can keep in mind such statements:

• All security checks for pages should happen before any business logic will take effect. So this business logic will always be protected from unauthorized access and we can sleep peacefully. The best place for that in tapestry5 applications is just before page activation.
• All security checks for page actions should happen after security checks for containing pages (as user to be authorized for page action should also be authorized for page containing this action) and before any business logic will take effect.

Let's start with page security.

SpringSocial and Tapestry. Let's be connected.

I've been working with connecting my applications to social services for last week. Didn't here anything about its APIs before. So, I started to look up for information about this and found this posts:

• http://tawus.wordpress.com/2011/08/14/tweeting-with-tapestry/
• http://tawus.wordpress.com/2011/08/15/tapestry-facebook-integration/

Good articles I want to say. And scibe-java library is a good choice for your application. It is very simple, has a lot of supported APIs and is very flexible(you can generated all needed requests by your own).
But there is an another choice - spring-social. It has not only request-response logic implementation but also full-featured facebook and twitter APIs. E.g. to update facebook status we just need do this:


The only thing we need is to get OAuth access token for needed social service. The way to do this is during application authorization process. All technical details you can find on oauth.net.

Secure application pages with tapestry5

Let's imagine that we have some application with auhentication and users separation by their authorities. There are also a set of allowed pages for every such authority.
E.g. we have such roles: anonymous, user and administrator. Anonymous is unauthorized user and can see only home page, user can see home and some other read-only pages, and administrator can see all pages. But how we can implement such logic to be sure that everybody can acces only allowed pages?
Let's create @Allow annotation that will define all necessary user authorities to access the page.


So our pages will look like this one:


Now the only thing we need is to throw security exception when user tries to acces page that are not allowed for him.

Thinking about jQuery-UI. Rendering buttons as is with Tapestry5.

Have you ever use a nice js library called jQuery-UI on your applications? Yes, it is realy easy to make some draft markup and then create all needed widgets using this library. For example:


This example will render button, submit and link and then will create ui-button widgets from it using js. As result we will see three pretty-styled buttons. But is everything clear in this example? Let's make some changes that will emulate slow page rendering.


As result we have three unstyled buttons that then flashes to jquery-ui styles(look). Is it so pretty now? And do you think such behavior is correct or you agree with opinion that all page elements should be rendered as is from the beginning? And if you have chosen the second variant let's continue.