Developing Web Applications with Quixote

PyCon 2004
March 24, 2004

A.M. Kuchling
www.amk.ca
amk @ amk.ca

Overview

Quixote is a Web development framework written in Python.

Some of Quixote's goals:

• Simplicity
• Familiar to Python programmers
• Encourages good design (in several senses)
• Easy to use with other Python libraries

Related tools:

• Sancho: unit testing
• Dulcinea: various ZODB and Quixote-related utility classes

Sites/Applications using Quixote

Sites:

• MEMS Exchange (www.mems-exchange.org)
• Linux Weekly News (lwn.net)

Applications:

• Cartwheel (cartwheel.caltech.edu)
• PyCon conference registration (being packaged for release)

The Quixote Toolkit

• Publisher: maps URLs to Python code
• HTTPRequest, HTTPResponse classes
• Web server interfaces for CGI, FastCGI, SCGI, mod_python
• Python Templating Language (optional)
• Form framework (optional)

How Quixote Works: The basic idea

• Take the URL path and split it apart:

  http://example.com/catalog/item/details 
  
      → ['catalog', 'item', 'details']
  

• Starting at a configured root package (e.g. 'store.web'),
  follow the URL path down:

    http://example.com/   →    store.web._q_index()
  
    http://.../catalog/   →    store.web.catalog()  
                          or    store.web.catalog._q_index
  
    /catalog/item/        →    store.web.catalog.item()
                          or    store.web.catalog.item._q_index()
  

• Call it and send the output to the client:

  output = store.web.catalog(request)
  

Simple example

From quixote/demo/__init__.py:

# Every publicly accessible attribute has to be listed in _q_exports.
_q_exports = ["simple"]  

def simple (request):
    # This function returns a plain text document, not HTML.
    request.response.set_content_type("text/plain")
    return "This is the Python function 'quixote.demo.simple'.\n"

How Quixote Works: Special names

_q_index: If traversal ends up at an object that isn't callable, this name is checked for and called.

_q_lookup: if an attribute isn't found, this name is checked for and called with the attribute.

_q_access: at every step, this name is checked for and called to perform access checks.

_q_resolve: like a memoized version of _q_lookup (rarely used)

How Quixote Works: _q_lookup example

This example handles URLs such as /whatever/1/, .../2/, etc.

def _q_lookup (request, component):
    try:
        key = int(component)
    except ValueError: 
        raise TraversalError("URL component is not an integer")

    obj = ... database lookup (key) ...
    if obj is None:
        raise TraversalError("No such object.")

    # Traversal will continue with the ObjectUI instance
    return ObjectUI(obj)

How Quixote works: _q_access example

_q_access is always called before traversing any further.

This example requires that all users must be logged in.

from quixote.errors import AccessError, TraversalError

def _q_access (request):
    if request.session.user is None:
         raise AccessError("You must be logged in.")

    # exits quietly if nothing is wrong


def _q_index [html] (request):
    """Here is some security-critical material ..."""

How Quixote works: The HTTPRequest class

• .response -- a HTTPResponse instance
• .session -- a Session instance
• request.get_environ('SERVER_PORT', 80)
  -- various standard CGI environment vars
• request.get_form_var('user') -- get form variables
• request.get_cookie('session') -- get cookie values
• request.get_url(n=1)
  -- get URL of request, chopping off n pieces
• request.get_accepted_types()
  -- get a dict mapping {MIME type: quality value}
• browser, version = request.guess_browser_version()
• return request.redirect('../../catalog')
  -- redirect to the specified URL

How Quixote works: The HTTPResponse class

• .headers -- dict of HTTP headers
• .cache -- number of seconds to cache response
• .set_content_type('text/plain')
  -- specify MIME content type of the response
• .set_cookie('session', '12345', path='/')
  -- return a Set-Cookie header to the client
• .expire_cookie('session')
  -- delete cookie from the client

How Quixote works: Enabling sessions

Instead of Publisher, use SessionPublisher:

from quixote.publisher import SessionPublisher
app = SessionPublisher('quixote.demo')

The request will then have a .session attribute containing a Session instance.

Two other classes:

• SessionManager -- stores/retrieves sessions
• Session -- can hold .user attribute

Running Quixote applications

Several options:

• CGI (slow, not recommended)
• FastCGI (fast and scalable; Apache mod_fastcgi possibly buggy)
• Apache + mod_scgi (fast, scalable; recommended for high traffic)
• Pure Python web server (slower, not many features, but useful for standalone applications).

Running Quixote applications: CGI/FastCGI

demo.cgi:

#!/www/python/bin/python
# Example driver script for the Quixote demo: 
# publishes the quixote.demo package.

from quixote import Publisher

# Create a Publisher instance, giving it the root package name
app = Publisher('quixote.demo')

# Open the configured log files
app.setup_logs()

# Enter the publishing main loop
app.publish_cgi()

Running Quixote Applications: Stand-alone

Running a server on localhost is really easy:

import os, time 
from quixote.server import medusa_http 
 
if __name__ == '__main__': 
    s = medusa_http.Server('quixote.demo', port=8000) 
    s.run() 

PTL: Overview

PTL = Python Templating Language

example.ptl:

# To callers, templates behave like regular Python functions 
def cell [html] (content):
    '<td>'         # Literal expressions are appended to the output
    content        # Expressions are evaluated, too.
    '</td>'

def row [html] (L):
    # L: list of strings containing cell content
    '<tr>'
    for s in L:
        cell(s)
    '</tr>\n'

def loop (n):  # No [html], so this is a regular Python function
    output = ""
    for i in range(1, 10):
        output += row([str(i), i*'a', i*'b'])
    return output

PTL: Using templates

Templates live in .ptl files, which can be imported. To enable this:

import quixote ; quixote.enable_ptl()    # Enable import hook

Templates behave just like Python functions:

>>> import example
>>> example.cell('abc')
<htmltext '<td>abc</td>'>
>>> example.loop()
<htmltext '<tr><td>1</td><td>a</td><td>b</td>...</tr>\n'>

PTL: Comparison with other syntaxes

PTL: Automatic escaping

def no_quote [plain] (arg):
    '<title>'
    arg              # Converted to string
    '</title>'

def quote [html] (arg):
    '<title>'
    arg              # Converted to string and HTML-escaped
    '</title>'

>>> no_quote('A history of the < symbol')
'<title>A history of the < symbol</title>'
>>> quote('A history of the < symbol')
<htmltext '<title>A history of the &lt; symbol</title>'>

By using '[html]' instead of '[plain]', string literals are compiled as htmltext instances. When combined with regular strings using a + b or '%s' % b, htmltext HTML-escapes the regular string.