Action transport options and explicit TMS publishing

Total.js 5 · total5@0.0.19 total5reference Executed against Total.js 5

In total5@0.0.19: NEWACTION() stores csrf, encrypt and compress in action metadata, but they do not establish the HTTP guarantees their names might suggest on HTTP routes:

csrf:true alone accepts a POST without a token. Use a middleware that calls DEF.onCSRFcheck() with secret_csrf configured, as in csrf-protection.
encrypt:true on a declared route adds @encrypt metadata, but this version still accepts plaintext JSON and returns plaintext JSON. Use HTTPS for transport.
compress:false does not disable ordinary HTTP gzip; response compression follows $httpcompress, the client's accepted encoding and response size. A large JSON response can be gzipped even when this action option is false.
publish declares a TMS topic/schema. Completing an action does not automatically publish its result. Call $.publish(value) explicitly and construct the public payload deliberately. Select the fields to publish before calling $.publish(value).

Configure the TMS token for your application. TMS messages go to subscribers of that topic; application permission and tenancy rules still belong in your code.

config

secret_csrf : local-csrf-fixture-only
$tms : true
secret_tms : local-tms-fixture-only
$httpcompress : true

definitions/transport.js

NEWACTION('Transport|csrf', {
	csrf: true,
	input: '*value:String',
	action: function($, model) { $.callback(model); }
});
NEWACTION('Transport|encrypted', {
	encrypt: true,
	route: 'POST /encrypted/',
	input: '*value:String',
	action: function($, model) { $.callback(model); }
});
NEWACTION('Transport|compressed', {
	compress: false,
	action: function($) { $.callback({ text: 'abcdefghij'.repeat(400) }); }
});
NEWACTION('Transport|notice', {
	publish: 'value:String',
	input: '*value:String',
	action: function($, model) {
		$.publish({ value: model.value });
		$.success();
	}
});

controllers/transport.js

exports.install = function() {
	ROUTE('POST /csrf-option/ @json --> Transport|csrf');
	ROUTE('GET /compression-option/ --> Transport|compressed');
	ROUTE('POST /notice/ @json --> Transport|notice');
};