TornadoREST
TornadoREST is the base class for your RESTful API handlers.
It directly inherits from tornado.web.RequestHandler
- class DIRAC.Core.Tornado.Server.TornadoREST.TornadoREST(application, request, **kwargs)
Bases:
BaseRequestHandler
Base class for all the endpoints handlers.
### Example In order to create a handler for your service, it has to follow a certain skeleton.
Simple example:
from DIRAC.Core.Tornado.Server.TornadoREST import * class yourEndpointHandler(TornadoREST): def get_hello(self, *args, **kwargs): ''' Usage: requests.get(url + '/hello/pos_arg1', params=params).json()['args] ['pos_arg1'] ''' return {'args': args, 'kwargs': kwargs}
from diraccfg import CFG from DIRAC.Core.Utilities.JDL import loadJDLAsCFG, dumpCFGAsJDL from DIRAC.Core.Tornado.Server.TornadoREST import * from DIRAC.WorkloadManagementSystem.Client.JobManagerClient import JobManagerClient from DIRAC.WorkloadManagementSystem.Client.JobMonitoringClient import JobMonitoringClient class yourEndpointHandler(TornadoREST): # Specify the default permission for the handler DEFAULT_AUTHORIZATION = ['authenticated'] # Base URL DEFAULT_LOCATION = "/" @classmethod def initializeHandler(cls, infosDict): ''' Initialization ''' cls.my_requests = 0 cls.j_manager = JobManagerClient() cls.j_monitor = JobMonitoringClient() def initializeRequest(self): ''' Called at the beginning of each request ''' self.my_requests += 1 # In the annotation, you can specify the expected value type of the argument def get_job(self, jobID:int, category=None): '''Usage: requests.get(f'https://myserver/job/{jobID}', cert=cert) requests.get(f'https://myserver/job/{jobID}/owner', cert=cert) requests.get(f'https://myserver/job/{jobID}/site', cert=cert) ''' if not category: return self.j_monitor.getJobStatus(jobID) if category == 'owner': return self.j_monitor.getJobOwner(jobID) if category == 'owner': return self.j_monitor.getJobSite(jobID) else: # TornadoResponse allows you to call tornadoes methods, thread-safe return TornadoResponse().redirect(f'/job/{jobID}') def get_jobs(self, owner=None, *, jobGroup=None, jobName=None): '''Usage: requests.get(f'https://myserver/jobs', cert=cert) requests.get(f'https://myserver/jobs/{owner}?jobGroup=job_group?jobName=job_name', cert=cert) ''' conditions = {"Owner": owner or self.getRemoteCredentials} if jobGroup: conditions["JobGroup"] = jobGroup if jobName: conditions["JobName"] = jobName return self.j_monitor.getJobs(conditions, date) def post_job(self, manifest): '''Usage: requests.post(f'https://myserver/job', cert=cert, json=[{Executable: "/bin/ls"}]) ''' jdl = dumpCFGAsJDL(CFG.CFG().loadFromDict(manifest)) return self.j_manager.submitJob(str(jdl)) def delete_job(self, jobIDs): '''Usage: requests.delete(f'https://myserver/job', cert=cert, json=[123, 124]) ''' return self.j_manager.deleteJob(jobIDs) @authentication(["VISITOR"]) @authorization(["all"]) def options_job(self): '''Usage: requests.options(f'https://myserver/job') ''' return "You use OPTIONS method to access job manager API."
Note
This example aims to show how access interfaces can be implemented and no more
This class can read the method annotation to understand what type of argument expects to get the method, see
_getMethodArgs()
.Note that because we inherit from
tornado.web.RequestHandler
and we are running using executors, the methods you export cannot write back directly to the client. Please see inline comments inBaseRequestHandler
for more details.- BASE_URL = None
- DEFAULT_AUTHENTICATION = ['SSL', 'JWT', 'VISITOR']
- DEFAULT_AUTHORIZATION = None
- DEFAULT_LOCATION = '/'
- METHOD_PREFIX = None
- SUPPORTED_METHODS = ('GET', 'HEAD', 'POST', 'DELETE', 'PATCH', 'PUT', 'OPTIONS')
- __init__(application, request, **kwargs)
- activityMonitoringReporter = False
- add_header(name: str, value: bytes | str | Integral | datetime) None
Adds the given response header and value.
Unlike set_header, add_header may be called multiple times to return multiple values for the same header.
- check_etag_header()
Checks the
Etag
header against requests’sIf-None-Match
.Returns
True
if the request’s Etag matches and a 304 should be returned. For example:self.set_etag_header() if self.check_etag_header(): self.set_status(304) return
This method is called automatically when the request is finished, but may be called earlier for applications that override compute_etag and want to do an early check for
If-None-Match
before completing the request. TheEtag
header should be set (perhaps with set_etag_header) before calling this method.
- check_xsrf_cookie()
Verifies that the
_xsrf
cookie matches the_xsrf
argument.To prevent cross-site request forgery, we set an
_xsrf
cookie and include the same value as a non-cookie field with allPOST
requests. If the two do not match, we reject the form submission as a potential forgery.The
_xsrf
value may be set as either a form field named_xsrf
or in a custom HTTP header namedX-XSRFToken
orX-CSRFToken
(the latter is accepted for compatibility with Django).See http://en.wikipedia.org/wiki/Cross-site_request_forgery
Prior to release 1.1.1, this check was ignored if the HTTP header
X-Requested-With: XMLHTTPRequest
was present. This exception has been shown to be insecure and has been removed. For more information please see http://www.djangoproject.com/weblog/2011/feb/08/security/ http://weblog.rubyonrails.org/2011/2/8/csrf-protection-bypass-in-ruby-on-railsChanged in version 3.2.2: Added support for cookie version 2. Both versions 1 and 2 are supported.
- clear()
Resets all headers and content for this response.
- clear_all_cookies(path='/', domain=None)
Deletes all the cookies the user sent with this request.
See clear_cookie for more information on the path and domain parameters.
Similar to set_cookie, the effect of this method will not be seen until the following request.
Changed in version 3.2: Added the
path
anddomain
parameters.
- clear_cookie(name, path='/', domain=None)
Deletes the cookie with the given name.
Due to limitations of the cookie protocol, you must pass the same path and domain to clear a cookie as were used when that cookie was set (but there is no way to find out on the server side which values were used for a given cookie).
Similar to set_cookie, the effect of this method will not be seen until the following request.
- clear_header(name)
Clears an outgoing header, undoing a previous set_header call.
Note that this method does not apply to multi-valued headers set by add_header.
- compute_etag()
Computes the etag header to be used for this request.
By default uses a hash of the content written so far.
May be overridden to provide custom etag implementations, or may return None to disable tornado’s default etag support.
- property cookies
An alias for self.request.cookies <.httputil.HTTPServerRequest.cookies>.
- create_signed_value(name, value, version=None)
Signs and timestamps a string so it cannot be forged.
Normally used via set_secure_cookie, but provided as a separate method for non-cookie uses. To decode a value not stored as a cookie use the optional value argument to get_secure_cookie.
Changed in version 3.2.1: Added the
version
argument. Introduced cookie version 2 and made it the default.
- create_template_loader(template_path)
Returns a new template loader for the given path.
May be overridden by subclasses. By default returns a directory-based loader on the given path, using the
autoescape
andtemplate_whitespace
application settings. If atemplate_loader
application setting is supplied, uses that instead.
- property current_user
The authenticated user for this request.
This is set in one of two ways:
A subclass may override get_current_user(), which will be called automatically the first time
self.current_user
is accessed. get_current_user() will only be called once per request, and is cached for future access:def get_current_user(self): user_cookie = self.get_secure_cookie("user") if user_cookie: return json.loads(user_cookie) return None
It may be set as a normal variable, typically from an overridden prepare():
@gen.coroutine def prepare(self): user_id_cookie = self.get_secure_cookie("user_id") if user_id_cookie: self.current_user = yield load_user(user_id_cookie)
Note that prepare() may be a coroutine while get_current_user() may not, so the latter form is necessary if loading the user requires asynchronous operations.
The user object may be any type of the application’s choosing.
- data_received(chunk)
Implement this method to handle streamed request data.
Requires the .stream_request_body decorator.
- static decode(encodedData)
Decode the json encoded string
- Parameters:
encodedData – json encoded string
- Returns:
the decoded objects, encoded object length
Arguably, the length of the encodedData is useless, but it is for compatibility
- decode_argument(value, name=None)
Decodes an argument from the request.
The argument has been percent-decoded and is now a byte string. By default, this method decodes the argument as utf-8 and returns a unicode string, but this may be overridden in subclasses.
This method is used as a filter for both get_argument() and for values extracted from the url and passed to get()/post()/etc.
The name of the argument is provided if known, but may be None (e.g. for unnamed groups in the url regex).
- async delete(*args, **kwargs)
Method to handle incoming
DELETE
requests.
- detach()
Take control of the underlying stream.
Returns the underlying .IOStream object and stops all further HTTP processing. Intended for implementing protocols like websockets that tunnel over an HTTP handshake.
This method is only supported when HTTP/1.1 is used.
Added in version 5.1.
- static encode(inData)
Encode the input data into a JSON string
- Parameters:
inData – anything that can be serialized. Namely, anything that can be serialized by standard json package, datetime object, tuples, and any class that inherits from JSerializable
- Returns:
a json string
- finish(chunk=None)
Finishes this response, ending the HTTP request.
Passing a
chunk
tofinish()
is equivalent to passing that chunk towrite()
and then callingfinish()
with no arguments.Returns a .Future which may optionally be awaited to track the sending of the response to the client. This .Future resolves when all the response data has been sent, and raises an error if the connection is closed before all data can be sent.
Changed in version 5.1: Now returns a .Future instead of
None
.
- flush(include_footers=False, callback=None)
Flushes the current output buffer to the network.
The
callback
argument, if given, can be used for flow control: it will be run when all flushed data has been written to the socket. Note that only one flush callback can be outstanding at a time; if another flush occurs before the previous flush’s callback has been run, the previous callback will be discarded.Changed in version 4.0: Now returns a .Future if no callback is given.
Deprecated since version 5.1: The
callback
argument is deprecated and will be removed in Tornado 6.0.
- async get(*args, **kwargs)
Method to handle incoming
GET
requests. .. note:: all the arguments are already prepared in theprepare()
method.
- getCSOption(optionName, defaultValue=False)
Just for keeping same public interface
- getProperties()
- getRemoteAddress()
Just for keeping same public interface
- getRemoteCredentials()
Get the credentials of the remote peer.
- Returns:
Credentials dictionary of remote peer.
- getUserDN()
- getUserGroup()
- getUserName()
- get_argument(name, default=<object object>, strip=True)
Returns the value of the argument with the given name.
If default is not provided, the argument is considered to be required, and we raise a MissingArgumentError if it is missing.
If the argument appears in the url more than once, we return the last value.
The returned value is always unicode.
- get_arguments(name, strip=True)
Returns a list of the arguments with the given name.
If the argument is not present, returns an empty list.
The returned values are always unicode.
- get_body_argument(name, default=<object object>, strip=True)
Returns the value of the argument with the given name from the request body.
If default is not provided, the argument is considered to be required, and we raise a MissingArgumentError if it is missing.
If the argument appears in the url more than once, we return the last value.
The returned value is always unicode.
Added in version 3.2.
- get_body_arguments(name, strip=True)
Returns a list of the body arguments with the given name.
If the argument is not present, returns an empty list.
The returned values are always unicode.
Added in version 3.2.
- get_browser_locale(default='en_US')
Determines the user’s locale from
Accept-Language
header.See http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.4
- get_cookie(name, default=None)
Returns the value of the request cookie with the given name.
If the named cookie is not present, returns
default
.This method only returns cookies that were present in the request. It does not see the outgoing cookies set by set_cookie in this handler.
- get_current_user()
Override to determine the current user from, e.g., a cookie.
This method may not be a coroutine.
- get_login_url()
Override to customize the login URL based on the request.
By default, we use the
login_url
application setting.
- get_query_argument(name, default=<object object>, strip=True)
Returns the value of the argument with the given name from the request query string.
If default is not provided, the argument is considered to be required, and we raise a MissingArgumentError if it is missing.
If the argument appears in the url more than once, we return the last value.
The returned value is always unicode.
Added in version 3.2.
- get_query_arguments(name, strip=True)
Returns a list of the query arguments with the given name.
If the argument is not present, returns an empty list.
The returned values are always unicode.
Added in version 3.2.
- get_secure_cookie(name, value=None, max_age_days=31, min_version=None)
Returns the given signed cookie if it validates, or None.
The decoded cookie value is returned as a byte string (unlike get_cookie).
Similar to get_cookie, this method only returns cookies that were present in the request. It does not see outgoing cookies set by set_secure_cookie in this handler.
Changed in version 3.2.1: Added the
min_version
argument. Introduced cookie version 2; both versions 1 and 2 are accepted by default.
- get_secure_cookie_key_version(name, value=None)
Returns the signing key version of the secure cookie.
The version is returned as int.
- get_status()
Returns the status code for our response.
- get_template_namespace()
Returns a dictionary to be used as the default template namespace.
May be overridden by subclasses to add or modify values.
The results of this method will be combined with additional defaults in the tornado.template module and keyword arguments to render or render_string.
- get_template_path()
Override to customize template path for each handler.
By default, we use the
template_path
application setting. Return None to load templates relative to the calling file.
- get_user_locale()
Override to determine the locale from the authenticated user.
If None is returned, we fall back to get_browser_locale().
This method should return a tornado.locale.Locale object, most likely obtained via a call like
tornado.locale.get("en")
- async head(*args, **kwargs)
Method to handle incoming
HEAD
requests.
- initialize(**kwargs)
Initialize the handler, called at every request.
It just calls
__initialize()
If anything goes wrong, the client will get
Connection aborted
error. See details inside the method.- ..warning::
DO NOT REWRITE THIS FUNCTION IN YOUR HANDLER ==> initialize in DISET became initializeRequest in HTTPS !
- classmethod initializeHandler(componentInfo: dict)
This method for handler initializaion. This method is called only one time, at the first request. CAN be implemented by developer.
- Parameters:
componentInfo – infos about component, see
_getComponentInfoDict()
.
- initializeRequest()
Called at every request, may be overwritten in your handler. CAN be implemented by developer.
- isRegisteredUser()
- property locale
The locale for the current session.
Determined by either get_user_locale, which you can override to set the locale based on, e.g., a user preference stored in a database, or get_browser_locale, which uses the
Accept-Language
header.
- log = <DIRAC.FrameworkSystem.private.standardLogging.Logging.Logging object>
- log_exception(typ, value, tb)
Override to customize logging of uncaught exceptions.
By default logs instances of HTTPError as warnings without stack traces (on the
tornado.general
logger), and all other exceptions as errors with stack traces (on thetornado.application
logger).Added in version 3.1.
- on_connection_close()
Called in async handlers if the client closed the connection.
Override this to clean up resources associated with long-lived connections. Note that this method is called only if the connection was closed during asynchronous processing; if you need to do cleanup after every request override on_finish instead.
Proxies may keep a connection open for a time (perhaps indefinitely) after the client has gone away, so this method may not be called promptly after the end user closes their connection.
- on_finish()
Called after the end of HTTP request. Log the request duration
- async options(*args, **kwargs)
Method to handle incoming
OPTIONS
requests.
- async patch(*args, **kwargs)
Method to handle incoming
PATCH
requests.
- async post(*args, **kwargs)
Method to handle incoming
POST
requests.
- async prepare()
Tornados prepare method that called before request
- async put(*args, **kwargs)
Method to handle incoming
PUT
requests.
- redirect(url, permanent=False, status=None)
Sends a redirect to the given (optionally relative) URL.
If the
status
argument is specified, that value is used as the HTTP status code; otherwise either 301 (permanent) or 302 (temporary) is chosen based on thepermanent
argument. The default is 302 (temporary).
- render(template_name, **kwargs)
Renders the template with the given arguments as the response.
render()
callsfinish()
, so no other output methods can be called after it.Returns a .Future with the same semantics as the one returned by finish. Awaiting this .Future is optional.
Changed in version 5.1: Now returns a .Future instead of
None
.
- render_embed_css(css_embed)
Default method used to render the final embedded css for the rendered webpage.
Override this method in a sub-classed controller to change the output.
- render_embed_js(js_embed)
Default method used to render the final embedded js for the rendered webpage.
Override this method in a sub-classed controller to change the output.
- render_linked_css(css_files)
Default method used to render the final css links for the rendered webpage.
Override this method in a sub-classed controller to change the output.
- render_linked_js(js_files)
Default method used to render the final js links for the rendered webpage.
Override this method in a sub-classed controller to change the output.
- render_string(template_name, **kwargs)
Generate the given template with the given arguments.
We return the generated byte string (in utf8). To generate and write a template as a response, use render() above.
- require_setting(name, feature='this feature')
Raises an exception if the given app setting is not defined.
- reverse_url(name, *args)
Alias for Application.reverse_url.
- send_error(status_code=500, **kwargs)
Sends the given HTTP error code to the browser.
If flush() has already been called, it is not possible to send an error, so this method will simply terminate the response. If output has been written but not yet flushed, it will be discarded and replaced with the error page.
Override write_error() to customize the error page that is returned. Additional keyword arguments are passed through to write_error.
- set_cookie(name, value, domain=None, expires=None, path='/', expires_days=None, **kwargs)
Sets an outgoing cookie name/value with the given options.
Newly-set cookies are not immediately visible via get_cookie; they are not present until the next request.
expires may be a numeric timestamp as returned by time.time, a time tuple as returned by time.gmtime, or a datetime.datetime object.
Additional keyword arguments are set on the cookies.Morsel directly. See https://docs.python.org/3/library/http.cookies.html#http.cookies.Morsel for available attributes.
- set_default_headers()
Override this to set HTTP headers at the beginning of the request.
For example, this is the place to set a custom
Server
header. Note that setting such headers in the normal flow of request processing may not do what you want, since headers may be reset during error handling.
- set_etag_header()
Sets the response’s Etag header using
self.compute_etag()
.Note: no header will be set if
compute_etag()
returnsNone
.This method is called automatically when the request is finished.
- set_header(name: str, value: bytes | str | Integral | datetime) None
Sets the given response header name and value.
If a datetime is given, we automatically format it according to the HTTP specification. If the value is not a string, we convert it to a string. All header values are then encoded as UTF-8.
- set_secure_cookie(name, value, expires_days=30, version=None, **kwargs)
Signs and timestamps a cookie so it cannot be forged.
You must specify the
cookie_secret
setting in your Application to use this method. It should be a long, random sequence of bytes to be used as the HMAC secret for the signature.To read a cookie set with this method, use get_secure_cookie().
Note that the
expires_days
parameter sets the lifetime of the cookie in the browser, but is independent of themax_age_days
parameter to get_secure_cookie.Secure cookies may contain arbitrary byte values, not just unicode strings (unlike regular cookies)
Similar to set_cookie, the effect of this method will not be seen until the following request.
Changed in version 3.2.1: Added the
version
argument. Introduced cookie version 2 and made it the default.
- set_status(status_code, reason=None)
Sets the status code for our response.
- Parameters:
Changed in version 5.0: No longer validates that the response code is in http.client.responses.
- property settings
An alias for self.application.settings <Application.settings>.
- classmethod srv_getCSOption(optionName, defaultValue=False)
Get an option from the CS section of the services
- Returns:
Value for serviceSection/optionName in the CS being defaultValue the default
- srv_getFormattedRemoteCredentials()
Return the DN of user
Mostly copy paste from
DIRAC.Core.DISET.private.Transports.BaseTransport.BaseTransport.getFormattedCredentials()
Note that the information will be complete only once the AuthManager was called
- srv_getRemoteAddress()
Get the address of the remote peer.
- Returns:
Address of remote peer.
- srv_getRemoteCredentials()
Get the credentials of the remote peer.
- Returns:
Credentials dictionary of remote peer.
- static_url(path, include_host=None, **kwargs)
Returns a static URL for the given relative static file path.
This method requires you set the
static_path
setting in your application (which specifies the root directory of your static files).This method returns a versioned url (by default appending
?v=<signature>
), which allows the static files to be cached indefinitely. This can be disabled by passinginclude_version=False
(in the default implementation; other static file implementations are not required to support this, but they may support other options).By default this method returns URLs relative to the current host, but if
include_host
is true the URL returned will be absolute. If this handler has aninclude_host
attribute, that value will be used as the default for all static_url calls that do not passinclude_host
as a keyword argument.
- write(chunk)
Writes the given chunk to the output buffer.
To write the output to the network, use the flush() method below.
If the given chunk is a dictionary, we write it as JSON and set the Content-Type of the response to be
application/json
. (if you want to send JSON as a differentContent-Type
, call set_header after calling write()).Note that lists are not converted to JSON because of a potential cross-site security vulnerability. All JSON output should be wrapped in a dictionary. More details at http://haacked.com/archive/2009/06/25/json-hijacking.aspx/ and https://github.com/facebook/tornado/issues/1009
- write_error(status_code, **kwargs)
Override to implement custom error pages.
write_error
may call write, render, set_header, etc to produce output as usual.If this error was caused by an uncaught exception (including HTTPError), an
exc_info
triple will be available askwargs["exc_info"]
. Note that this exception may not be the “current” exception for purposes of methods likesys.exc_info()
ortraceback.format_exc
.
- xsrf_form_html()
An HTML
<input/>
element to be included with all POST forms.It defines the
_xsrf
input value, which we check on all POST requests to prevent cross-site request forgery. If you have set thexsrf_cookies
application setting, you must include this HTML within all of your HTML forms.In a template, this method should be called with
{% module xsrf_form_html() %}
See check_xsrf_cookie() above for more information.
- property xsrf_token
The XSRF-prevention token for the current user/session.
To prevent cross-site request forgery, we set an ‘_xsrf’ cookie and include the same ‘_xsrf’ value as an argument with all POST requests. If the two do not match, we reject the form submission as a potential forgery.
See http://en.wikipedia.org/wiki/Cross-site_request_forgery
This property is of type bytes, but it contains only ASCII characters. If a character string is required, there is no need to base64-encode it; just decode the byte string as UTF-8.
Changed in version 3.2.2: The xsrf token will now be have a random mask applied in every request, which makes it safe to include the token in pages that are compressed. See http://breachattack.com for more information on the issue fixed by this change. Old (version 1) cookies will be converted to version 2 when this method is called unless the
xsrf_cookie_version
Application setting is set to 1.Changed in version 4.3: The
xsrf_cookie_kwargs
Application setting may be used to supply additional cookie options (which will be passed directly to set_cookie). For example,xsrf_cookie_kwargs=dict(httponly=True, secure=True)
will set thesecure
andhttponly
flags on the_xsrf
cookie.