[cgiapp] [OT] CGI::Session is good, but we can do better (a new project is born?)

[Mark Stosberg <suppressed>]

I've had a number frustrations with CGI::Session and am considering
creating yet another alternative. What I have liked about CGI::Session
is the general interface. While I'm at home writing custom SQL, I liked
having the session code wrapped up in a neat little object, fairly
separate from the rest of the database logic. 

However, it has an overly complex structure that has made it hard to 
debug session related problems. It shouldn't be required to have a
driver for every database backend when it's mostly doing simple
operations on one table. It's unhelpful that it dumps the whole session
object into one database column. This limits the usefulness of access to
the data almost any other way but through the session interface. 

I have a vision for a highly compatible interface with these improvements:

 - A lightweight code base. The code will focus on session-specific
   logic. The concepts of Serializers will be banished.

 - The storage focus will database-centric, not file-centric. Use
   DBD::SQLite if you don't want/have a real DB. This will make it more
   natural and uniform to implement solutions to expire all sessions
   based on a criteria, and implement other logic related to sets of
   sessions. 

 - Support custom ID generators via callbacks. I like the idea of custom
   ID generators, but the current API requires creating your own package
   for this. I would additionally support a callback interface for
   quickies:
      id => sub { int rand(100) }, # a bad example? 

Class::DBI seems like a natural foundation for this. Although I haven't
( yet ) implemented an application with Class::DBI, this might be it. 
I've made a little chart of the key methods of CGI::Session, and how
they might be implemented in a Class::DBI-derived application. 

You can see that several methods will come for "free" just be virtue
of having the database columns named the same way. A few others
are just thin wrappers. That leaves only new() and expire() with much
customized logic, some of which can be lifted from CGI::Session. 

CGI::Session  | DBI::Session  ( not firm about a name choice yet )
----------------------------------------------------------------------
 new()         | Needs to copy simple logic from _init to decide whether to
               | open an existing session or create a new one.
               | Call create() to create a new
               | one. Also handles ID generation, which can be customized
               | with a callback.

 param()       | Thin wrapper: param( year => 1981 ) becomes year('1981');
 clear()       | Thin wrapper to update to set specific fields to undef
 close()       | Thin wrapper: calls update()
 expire()      | Similar: use expire(), but pass in DB format times.
                  (Compatibility for CGI.pm cookie style
                   could be ripped from CGI::Session).

 delete()      | free: delete()
 id            | free: id()
 atime         | free: atime()
 ctime         | free: ctime()
 remote_addr   | free: remote_addr()
 error         | Not needed, but could be emulated with eval() and suppressed
 dump          | Not needed, but could be emulated easily

This weekend I have about 10 hours of laptop-time in the car, maybe I'll
try to hack up a first draft of this. 

Are others interested in helping? At this point it seems more attractive
to me than updating my driver and code to work with CGI::Session 4.x.

    Mark

-- 
http://mark.stosberg.com/ 


---------------------------------------------------------------------
Web Archive:  http://www.mail-archive.com/suppressed/
              http://marc.theaimsgroup.com/?l=cgiapp&r=1&w=2
To unsubscribe, e-mail: suppressed
For additional commands, e-mail: suppressed