At its most simple level, clients need a way of being able to take an existing resource with defined link relations and zoom (or expand) the current resource to include them in the response. This is primarily to avoid a second round trip to the server in order to retrieve the resource representation that the client is interested in seeing.

To illustrate the problem, I have provided an example (for the sake of brevity, I have only included relevant parts of the resource representation).

{
    "_links": {
        "http://.../rels/detail": {
            "href": "/example/1/detail"
        },
        "http://.../rels/misc": {
            "href": "/example/1/misc"
        },
        "self": {
            "href": "/example/1"
        }
    }
}

In the above example, imagine a scenario where the client that has requested this representation is actually interested in the resource found at the ‘http://…/rels/detail’ link relation. The client now has to make a second request to the server in order to get at the data it needs.

We can alleviate this by using a feature of the media type known as embedding – however it is impractical to embed every linked resource every time. We must provide a way of allowing the client to specify the resource it is interested in – and this is ‘Zoom’.

If we allow the ‘zoom’ (or ‘z’) parameter in the query string to be reserved for this purpose, we can request that the server embeds the link relation by performing a GET request on ‘http://…/example/1?zoom=http://…/rels/detail’. The server would then be given the instruction to embed the resource and return it all in the response.

{
    "_embedded": {
        "http://.../rels/detail": [
            {
                "_links": {
                    "self": {
                        "href": "/example/1/detail"
                    }
                },
                "firstname": "Ben",
                "lastname": "Longden"
            }
        ]
    },
    "_links": {
        "http://.../rels/detail": {
            "href": "/example/1/detail"
        },
        "http://.../rels/misc": {
            "href": "/example/1/misc"
        },
        "self": {
            "href": "/example/1"
        }
    }
}

If we wanted to embed two items, the zoom query parameter may accept multiple link relations separated by commas, i.e., http://…/example/1?zoom=http://…/rels/detail,http://…/rels/misc.

The HAL format also supports CURIE style links to shorten the length of link relations and abbreviate the link down to a ‘x:detail’ or ‘x:misc’ format. There is no reason to not support these shorter syntax link rels, if the CURIE can be resolved. Here is an example of ‘http://…/example/1/?zoom=x:detail’.

{
    "_embedded": {
        "x:detail": [
            {
                "_links": {
                    "self": {
                        "href": "/example/1/detail"
                    }
                },
                "firstname": "Ben",
                "lastname": "Longden"
            }
        ]
    },
    "_links": {
        "curies": {
            "href": "http://.../rels/{rel}",
            "name": "x",
            "templated": true
        },
        "self": {
            "href": "/example/1"
        },
        "x:detail": {
            "href": "/example/1/detail"
        },
        "x:misc": {
            "href": "/example/1/misc"
        }
    }
}

The above examples and narrative cover zoom at it’s most basic implementation – and this will fit many situations fairly well. However, this idea of partially embedding sub resources is not new – what we are seeking is a unified way of following this pattern so that a common approach can be applied to any media type that has the ability to embed resources.

Implementations of this pattern can be found ‘in the wild’ in a number of places – to varying levels of completeness. From simply being able to embed a resource in a representation through to being able to specify a DSL to allow clients to query data that’s returned (specifying a limit to the number of resources in an embedded collection, or filtering by values in an embedded collection.

I’ll write up some thoughts around querying and limiting embedded data in a future post – i’d like to keep things relatively simple for now, and dive deeper into what the possibilities are later!

Comments more than welcome below.

Before attending the conference I had always advocated taking an existing hypermedia type (for the examples here I will use application/hal+json) and trying to represent a resource using that. More often than not, I would require some affordances that are not defined in the spec – so extending it and creating my own vender specific mime type (which defines what base type it extends) made a lot of sense to me.

Now that various media types are become ubiquitous amongst API designers (Hal and collection+json amongst others), it’s made me see the advantage of sticking to the base type whilst negotiating with the server on what content you receive. The reason? Because other clients that understand these hypermedia types are staring to emerge – much like the web browsers in which we browse the text/html hypermedia type today.

Like HTML, hypermedia types are created with the understanding that if an element exists that the client is not able to assign meaning to (an affordance that is not part of the spec, or not implemented by the client), then it can simply ignore it as if it was never there. This is quite powerful – it allows you to define optional extensions to a hypermedia type whilst maintaining compatibility with clients and intermediaries which already understand your base type.

Collection+json supports this idea quite well, and the author (Mike Amundsen) accepts additional patches to define extensions as part of the specification – extensions that one day could form part of a revised version of the specification for everyone to use, but exist as extensions that can be understood by any third party client that support them.

It is now my opinion that the creation of custom mime types (without registering them with IANA) actually harm the interoperability of the web – and close down a hypermedia API to clients which have specifically been created for your own hypermedia type.

Perhaps a missing piece of the puzzle right now is a way of being able to declare which extensions your document is actually making use of (if this is even needed once the extensions become part of the specification). Using a Link header (http://www.w3.org/wiki/LinkHeader) is potentially a good way of achieving this, though exactly how this works in practice is still being considered.

Comments encouraged!

API designers can spend a lot of time ensuring that their responses to you are perfectly well formed and self describing – but unless you pay attention to what it is that those messages are telling you, all that information is simply being thrown away.

Connection Negotiation

The very first thing your HTTP client will send to the server is the Request headers. Within that request, more often than not, you will send the Accept header and a list of media types that your client can support – and the order of preference within which you would like to see them. Chrome 20.0.1132.47 sends the following Accept header.

Accept:text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8

Obviously this is a web browser, so it’s preference is going to be for text/html or application/xhtml+xml. Failing that, we can also take application/xml. If the server still can’t handle the request – then we’ll take anything at all (*/*).

The web server will make a decision based on what your client has asked for. From that point on one of 3 things can happen. 1) You get back one of the media formats that you asked for. 2) You receive a 406 response (Not Acceptable). 3) You get back something you didn’t ask for at all (this is allowed as per RFC2616 – the server SHOULD only respond with a 406).

This means that unless you’re explicitly checking what the response is after the request comes back – you could find yourself only assuming that the server is behaving as you think it is.

The Accept header becomes very useful when you separate out a normal response from an error response. In the situation where a server error is causing a problem, you are likely to receive a 5xx response code from the server with little or no meaningful body (text/plain). Where an application error has occured you should also receive a 5xx (or a 4xx) code from the server – however having declared you are able to handle a more specific media type (application/vnd.error+xml for example), you are able to present more information to the user than you would otherwise be able to.

Take the situation where you are consuming an API which serves up application/hal+xml and text/plain (hal for the resource representation, and a plain text for an error). The server is free to be able to add support for representing errors in application/vnd.error+xml without affecting any existing client – as long as the server continues to serve text/plain unless the new media type is deemed as acceptable to the client. Once the client is updated to add support for the new media type, it can take advantage of the additional information that can be provided.

Cache

A RESTful API will contain explicit directives that declare if and for how long the response body can be cached for. This information is contained across Cache-Control / Vary headers or Expires header. If the response to your request comes back from the server and declared itself as being able to be cached (only Cache-Control: no-store is excluded from user-agent caches) then you should store it locally and serve up the cached response as long as it’s valid.

There are of course already libraries you can use in your projects that will handle cacheing for you. If you usually use PHP for this stuff (I do), then I highly recommend you take a look at Guzzle to handle this for you.

URLs

Yeah i’m going to talk about it again. Hypertext as the engine of application state. Golden rule #1, never construct links in code (unless you’re following a URI Template) – follow them from the links given to you in the resource. This means that when these links change – you don’t have to worry about your app breaking. #2, use the defined link relations of the hypermedia type to navigate through the application (ie, HTML’s ‘rel’ attribute on the link tag). That’s about it. Don’t assume anything if it’s not defined by the media type rules and the representation you receive and you can’t go wrong.

Hating XML is rather fashionable these days, so many API’s are appearing that are JSON representation only even when XML really is a better fit for purpose. When you’re designing a hypermedia API you’re not simply serialising an object. There are media types that add semantic meaning to JSON (application/hal+json, my own application/vnd.error+json (draft) and others) but really, XML is so much more expressive that using JSON actually makes your clients have to work harder to understand the meaning you’re trying to convey using an object serialisation format over a markup language.

XML gives you some stuff for free – ‘xml:lang’ for one. Put this on any element of your document and just the fact that your document is XML means that you can express elements in different (human) languages without having to update your media type.

Consider how this actually looks in XML vs JSON representation.

<error id="6">
    <message>Something bad happened</message>
</error>

{
    "error": {
        "id": 6,
        "message": "Something bad happened"
    }
}

This looks easy, right? Consider a future version of the api where we add support for multiple languages.

<error id="6" xml:lang="en">
    <message>Something bad happened</message>
    <message xml:lang="de">Etwas schlimmes ist passiert</message>
</error>

{
    "id": 6,
    "messages": [
        { "lang": "en", "message": "Something bad happened" }
        { "lang": "de", "message": "Etwas schlimmes ist passiert" }
    ]
}

An alternative could be to key the message objects by language;

{
    "id": 6,
    "messages": { 
        "en": "Something bad happened",
        "de": "Etwas schlimmes ist passiert"
    }
}

You can see in both scenarios that “messages” has become an different type (string to array of objects, or string to object). We’ve changed the structure of the document and introduced an almost certain backwards compatibility (BC) break in our interface – all our clients now need to be updates to follow suit. We could leave “message” as it was, and add “messages” for the multilang version of the API but then we’re duplicating data and / or making the client have to work harder.

The XML version can continue as is and the client can simply ignore the additional languages until they’re updated to support them (if they ever need to).

Then there’s just the matter of basic human readability. It’s clear to see what’s going on in XML and not so much in JSON. This is a fairly simplistic example but extrapolate that out over a fairly complex representation of an object and you can see how JSON really isn’t always the best choice for representing resources.

Imagine the scenario where we had used the second option above as our JSON representation and we wanted to add in another attribute for each of the messages. See the problem? Anything we choose to do will cause a BC break and require clients to update (or result in duplication of elements to ‘version’ the api), meaning it’s very difficult to evolve the clients and servers independently.

So i’m not saying that JSON simply ‘sucks’. I’m just saying that when considering the formats you use for representing data in an API (when it comes to selecting the media type you want to use), think hard before just going with something based on JSON by default because it’s ‘easy’. It probably isn’t.

Because of this, several people have come together and put together a proposal for the application/vnd.error media type. It has been documented over on Github and the mime type has been submitted for approval by IANA.

The intention for this media type is that it should be used when a client has made a request, however the server is unable to fulfil the request to to either a server side error (a code 5xx) or a problem with the client request (a code 4xx).

Although the client does NOT have to state that it explicitly will accept the application/vnd.error+xml or json mime type (via the ‘Accept’ header in the request), it makes a lot of sense to do so if the client can understand that response type. However, RFC2616 section 10 states:

HTTP/1.1 servers are allowed to return responses which are not acceptable according to the accept headers sent in the request. In some cases, this may even be preferable to sending a 406 response. User agents are encouraged to inspect the headers of an incoming response to determine if it is acceptable.

It is up to the implementor to decide whether the api should return a 406 (Not Acceptable) response if the client states it will not accept application/vnd.error+xml or json and an error is triggere, or if it should return the application/vnd.error+xml or json response anyway.

The specification for application/vnd.error is draft – if you have comments / suggestions or enhancements to the media type, let’s talk (comments on this blog, issues on github, twitter etc).


wget http://silex.sensiolabs.org/get/silex.phar
php -S localhost:8080


Create an index.php in the current directory (there’s an example app on the Silex home page). That’s it. Go play. :)

My problem is that I trust my developers to do the right thing. Ok, so that’s not a problem – it’s actually a really nice place to be. I see code review as a learning exercise for good developers, but I don’t see is as a blocking part of the development cycle. Too many times I have seen code reviews as a blocking step in a software release cycle end up just being a formality to get through.

With that scene set i’ve been thinking of using a karma based code review system. Developers have karma (per project) and can give out positive and negative karma to other developers. At a certain level of karma, the number of reviews required on commits starts to drop off so that eventually a commit by a developer with high karma will not generate a code review (or the percentage of commits submitted for review will be very low). As a project progresses, hopefully this leads to a place where developers who will learn more from having reviews done will have the benefit, while the developers who are well established on the project are able to get code into the project repository without a blocking code review process. Improvement can be measured by karma increasing over time.

Do you have experience with code reviews on projects? (open source vs closed source / colo teams vs non-colo / blocking vs non blocking)… Interested to hear others success and failure stories!

And soon the problems start coming up. At the end of the first sprint the client raises a few bugs with the software delivery… We didn’t account for those in the plan! And we can’t estimate them – we don’t know the size of the problem. That’s why it’s a bug… So we allocate some time in the next sprint to work on the top priority bugs and commit to developing fewer features.

The second sprint finishes, and more defects are raised in the software – some of them can be attributed to requirements not been defined clearly enough, but some of them are just code that we don’t understand how it even worked in development! Did someone actually test it before it went into the main development branch?! (how many people can honestly say they have never heard that one before…?)

Pretty soon you’re way behind the plan. The number of bugs that we cannot estimate and didn’t plan for are sucking up too much time and we don’t know how long it’s going to take to get back to a point where we know how long the project is going to take.

So what’s to be done? Bugs throughout the development life cycle are inevitable – but because we cannot know how many there will be and how long they will take to fix, we need to be able to minimise the number that crop up.

Some research done by microsoft (http://research.microsoft.com/en-us/groups/ese/nagappan_tdd.pdf) has shown that spending 15-35% extra development time on adopting test driven development resulted in a pre-release defect density decrease of 40-90%.

The ideal is when we can plan, develop and release software that contains no defects in a timescale that everyone agrees on. This wont happen any time soon – but an increase of 15-35% development time for up to a 90% decrease in the number of defects has *got* to be worth it by anybody’s standards.

Have you used TDD (or BDD) and experienced similar results? Comments encouraged!

Enjoy!

How pages are cached

The Magento enterprise page cache module observes several events that are fired during the course of dispatching your controller and sending a full page in the response. I’m going to dive into only a few of them – the main observers that actually cause your content to end up in the page cache, and then exactly how Magento gets it back out again.

The first thing we’re going to look at is how Magento caches pages, and that starts with the observation of the ‘controller_action_predispatch’ event – triggered before a request is dispatched (but after we have determined we will not be fulfilling the request from the cache). It’s here that the PageCache module will determine if the request that’s about to be dispatched is to be cached for subsequent requests. There are many things that will prevent a page from being cached and we can start by looking at these.

Examine the processPreDispatch method in Enterprise_PageCache_Model_Observer. This is the event that is fired on the controller_action_predispatch event. All the handlers first check to ensure that the page cache is enabled before doing anything else. Then we examine the no cache cookie and set a flag (memorize_disabled) in the session.

$this->_processor->canProcessRequest($request) && $this->_processor->getRequestProcessor($request)

The first of the above two condiditions does some basic validation on the request. $this->_processor will normally be an instance of ‘Enterprise_PageCache_Model_Processor’ by this point (it’s instantiated by the ‘enterprise_pagecache/processor’ model here so can be overridden), and here we will find the canProcessRequest method. First, we dip into the isAllowed method where we check that we’ve generated a requestId during the construction of this object. The requestId will become important later on in the process as it provides the key into your cache storage backend for the page content and needs to be reliably recreated based on the request parameters. We then check that the request is not over https, the no cache cookie (NO_CACHE) is not present, the no_cache GET variable is not present and that full page caching is enabled. If any of these checks fail we do not process this request any further in the full page cache module.

Assuming we pass, we move onto checking the configuration. We inspect the page depth parameter (the number of variations a page can have based on the number of variables in the query string). If we’re over the limit, the page is not cached. Then we check the cache settings for pages that are not in the default currency (system/page_cache/multicurrency = 0 and the presence of the CURRENCY cookie in the request).

The second of the two checks above is where we examine how the page is going to be cached. This is configured in ‘frontend/cache/requests’ and the defaults are found in app/code/core/Enterprise/PageCache/etc/config.xml in the following section of XML. By default all cms, catalog/category and catalog/product pages have a processor configured.

<frontend>
    ...
    <cache>
        <requests>
            <cms>enterprise_pagecache/processor_default</cms>
            <catalog>
                <category>
                    <view>enterprise_pagecache/processor_category</view>
                </category>
            </catalog>
            <catalog>
                <product>
                    <view>enterprise_pagecache/processor_product</view>
                </product>
            </catalog>
        </requests>
    </cache>
</frontend>

getRequestProcessor is where this configuration is examined and we we use the request data to attempt to construct a processor for the target page. Assuming one is configured, Magento is now ready to cache the page for the next request.

If at this point it looks as though we’re going to cache the page, the independent block cache is disabled and the first peice of setting up the cache is complete.

The next time we’re back in the PageCache code is once the request has been handled and we’re about to send the response. This is accomplished by hooking into the controller_front_send_response_before event and executing the ‘cacheResponse’ method on the observer. We very quickly end up back in the processor and in the processRequestResponse method.

The first two calls will be familiar. The same methods (canProcessRequest and getRequestProcessor) are called again – however the processor for this request already exists so the second method returns immediately. We delegate to the configured processor (configured above) at this point and call the ‘allowCache’ method with the Request object as a parameter. A number of further checks are done which could prevent the request from being cached – the presence of ‘___store’ or ‘___from_store’ in the query string (for the default processor) or the presence of the no cache flag in the session data.

Finally we’re actually ready to cache the response. Some filtering occurs to strip out blocks and replace them with placeholders (blocks can be cached independently from the page – to allow for independant cache rules – like the navigation menu which can persist across multiple pages). The placeholder configuration is stored in app/code/core/Enterprise/PageCache/etc/cache.xml and is structured like the following (this is a real example for the catalog/navigation block).

<config>
    <placeholders>
        <catalog_navigation>
            <block>catalog/navigation</block>
            <name>catalog.topnav</name>
            <placeholder>CATALOG_NAVIGATION</placeholder>
            <container>Enterprise_PageCache_Model_Container_Catalognavigation</container>
            <cache_lifetime>86400</cache_lifetime>
        </catalog_navigation>
    </placeholders>
</config>

The above peice of XML declares the catalog/navigation block to be cached separately to any page that is appears on with CATALOG_NAVIGATION as the placeholder. It specifies the container class (used during storing and extracting the block) and the lifetime in seconds for the cached block.

Blocks are marked up at the time they are rendered and you can view them in the HTML source code between comment blocks that consist of the placeholder value defined in cache.xml, and a hash that is made up by the md5 sum of the results of calling the getCacheKey. They look something like the following (again, using CATALOG_NAVIGATION as an example).

<!--{CATALOG_NAVIGATION_a61df2dc9b9e5868f17a56461177d8c4}-->
<p>some html</p>
<!--/{CATALOG_NAVIGATION_a61df2dc9b9e5868f17a56461177d8c4}-->

This functionality gives you the ability to be able to cache blocks separately to the full page – with their own rules on how long they stay in the cache for (and independently of the page that they are on). This means that blocks can be made to be cached across pages rather than within them – meaning that blocks such as catalog/navigation need only be generated once – and served up from the cache for every request after that regardless of if the page itself is being served from the cache.

How pages are served up from the cache

Rather unlike how pages end up in the cache (using observers to watch for specific points in the dispatch process for a request), the method by which Magento retrieves information from the cache is somewhat more hard coded. Before dispatching the front controller in Mage_Core_Model_App::run (one of the very first methods that gets called in fulfilling a request) a check is done to see if the current request can be served up from the pages in the cache. This happens inside Mage_Core_Model_Cache::processRequest where we immediately check to see if there is a request processor configured that we can check the request against. The request processors are configured inside app/etc/enterprise.xml – the default one is set to Enterprise_PageCache_Model_Processor (predictably the same class used to cache the results of a dispatched request).

This is quite important – if you have a reason to extend the logic in Enterprise_PageCache_Model_Processor (like adding data that forms part of the cache id for a page), you not only have to extend it and rewrite ‘enterprise_pagecache/processor’, but also make sure that it’s added to this list of request processors so that Magento has a chance of being able to retrieve your items back out of the cache again.

Magento then loops through all the configured request processors, and calls extractContent on each of them. The first thing that this function does is create the cache id based on the request parameters (this happens when the processor is constructed, when the _createRequestIds method is called – as we saw earlier when the content was being cached in the first place). We check to see if any design changes have been cached for the current page, and then check the configured cache storage to see if we can retrieve the full page content for this request. If we do not get a match at this point, the request is considered a cache miss – and we return to the run method and start the process of dispatching the request (and potentially populating the cache with the results).

Assuming that we have a cache hit, we decompress it (content will be gzipped whenever possible in the cache storage to minimise space), and the content is processed by _processContent to replace all of the placeholders with separate cached blocks (ie, the catalog/navigation block that we cached separately when putting the page into the cache in the first place).

When writing about how pages are served up from the cache I referred to the configured cache storage. Prior to Magento EE 1.11, the full page cache simply used what you configured in the section in app/etc/local.xml. From 1.11 this has changed and you must now also have a section in your local.xml configuration (it uses exactly the same options as the config).

The aim of this post is to give an overview of how page caching works in magento and I am intending on following it up with some more detailed investigations into how more areas of cacheing work. If you have a specific request for more information, please do leave a comment and it may form part of a future blog post.