mORMot Open Source

hi gcarreno,

Append `/json` at the end of the url to see what happen   (it was primarly made for debugging purpose, but it can be consumed as is too).

I wrote some parts of rock migration, a module used by ProcessWire community (I am pretty sure you know it) so I can clearly see what you have in mind. As you already mentioned, things turn a bit different with a compiled approach but not that much I think.

I've just published a very minimal example here showing how to compare current model table with external table fields to remove orphaned columns. Then, imagine you set up a proper ci/cd pipelnie for example with jenkins and fpc, you could write migration files to be consumed by your flow, compile, deploy. And as mormot is able to serialize any class/record into a json object, writing a migration module similar to what you’d have on cakephp to keep or rollback your db/api definition should be ok. Anyway, nothing native yet  

Hope this points you in more or less the right direction

Idk if the following is related and could give some hints. I have the same issue on Windows 7; Recently, we switched new deployed computers on Windows 10 and the same issue is happening.

The current http server is apache reverse proxy for a specific reason using a Sectigo RSA certificate. Actually, I havn't tried to fix it, but I observed the following:
- on my own computer, the error isn't triggered.
- some months ago, I could fix it on Windows 7 by registering missing certs on the local certificate store.

So on my side, I suspect a problem on the certificate chain. I will have more info in the next day as we have renewed the certificate and I will update the server conf.

25/06/2025 07:49:02.464	Enter	73	 mormot.rest.http.client.TRestHttpClientSocket(77b1a0).CallBackGet api/timestamp
25/06/2025 07:49:02.464	Enter	73	    mormot.rest.http.client.TRestHttpClientSocket(77b1a0).InternalUri GET
25/06/2025 07:49:03.560	Exception	73	       ESChannel {Message:"<the.domain.fr>: HandshakeStep returned 8009030F [SEC_E_MESSAGE_ALTERED], System Error 5 [ERROR_ACCESS_DENIED]"} [] at 01285bdf mormot.net.sock.windows.inc TSChannelNetTls.ESChannelRaiseLastError (1927)   {65529.79 4.99 12 0.8GB/2GB 1db10a01}
25/06/2025 07:49:03.560	Exception	73	       ESChannel {Message:"recv: Handshake aborted"} [] at 01285d26 mormot.net.sock.windows.inc TSChannelNetTls.FreeAndCheckSocket (1948)   {65529.79 4.99 12 0.8GB/2GB 1db10a01}
25/06/2025 07:49:03.560	Exception	73	       ESChannel {Message:"recv: Handshake aborted"} [] at 01285d26 mormot.net.sock.windows.inc TSChannelNetTls.FreeAndCheckSocket (1948)   {65529.79 4.99 12 0.8GB/2GB 1db10a01}
25/06/2025 07:49:03.560	Client	73	       mormot.rest.http.client.TRestHttpClientSocket(77b1a0) GET api/timestamp status=666 len=0 state=0
25/06/2025 07:49:03.560	Leave	73	    01.102.694
25/06/2025 07:49:03.560	Enter	73	    mormot.rest.http.client.TRestHttpClientSocket(77b1a0).InternalUri GET
25/06/2025 07:49:04.720	Client	73	       mormot.rest.http.client.TRestHttpClientSocket(77b1a0) GET api/timestamp status=200 len=12 state=0
25/06/2025 07:49:04.720	Leave	73	    01.173.370
25/06/2025 07:49:04.720	Service return	73	    mormot.rest.http.client.TRestHttpClientSocket(77b1a0) 135919590467
25/06/2025 07:49:04.720	Leave	73	 02.276.213

The issues I'm aware of (using ssl tools):
- The chain doesn't contain any intermediate certificates

This is beyond the scope of jwt thing, you didn't described how you are adding user and I then assume you are adding manually an user into the external auth user table: if ORM cache is enabled, then this behavior is expected. You could read that you are hitting orm cache on the console by enabling server logs (and by reading the manual).

Thats said, set db.usecache to false or write a small rest client tool for adding your users..

I see, your file is probably missing something or contain a bad formatting. Swagger doesn't care about the server itself, it's about the file definition.

Yes I've read your comment (I edited it on the PR )  It was not really a bug but a change on the framework implementation. I didn't had the time to push my changes and merging @koraycayiroglu code.

Yes you can, just register your service with bypassauthentication true. On the initial sample they were implemented as service methods as I think it fit better to access service context. You can mix both interface/service methods without problem.

Personal taste, I feel more comfortable using IDocDict/List. Maybe take a look at this blog post if it helps (check the advanced features: filtering, searching):

https://blog.synopse.info/?post/2024/02 … hi-and-FPC

Hi @ab, I did some testing - Delphi 12.3 and FPC - and then:

- without rsoPerConnectionNone, client auth is fine (this was failing).
- enabling rsoPerConnectionNone, client fail at CheckPassoword()

fServer.fOptions:

[rsoNoInternalState,rsoNoTableURI,rsoMethodUnderscoreAsSlashUri,rsoPerConnectionNonce]

srvr       mormot.rest.server.TRestServerRoutingRest(0334c340)   Method GET root/auth?username=Admin=200 out=77 B in 3.09s
ret         ServerApiHost.TAppServer(033e9f40) Method len=77 {"result":"bd1a5ead8e255448fd09484e56e33a66ea8cefc3f6d3804735cb6cf7a46881c0"}
[debug] GET /root/auth?username=Admin&password=e23f6a5756da303c6b36de49077cb51d6828768a2763b0b82678122deba05ac8&clientnonce=58671B01_0fb7691644db0de2e1bd776ed8466eb2
[BeforeBody][aInHeaders]: 
  - X-Real-IP: 127.0.0.1
  - X-Forwarded-For: 127.0.0.1
  - X-Forwarded-Proto: https
  - X-Conn-ID: 17
  - Accept: */*

I will look at it, the nginx config was kept minimal with a simple proxy_pass for testing. The demo program return both 200 OK (direct and nginx) if the server is compiled on last commit before 65e4597. Once I compile the server starting on commit 65e4597, then it fail on nginx only..

I will try again with a minimal server and report it here.

I have provided you with examples there last day: D-H-R/mormot_json/issues/1

I admit I feel like the more thinking they try to do, the more they tend to hallucinate...

Why your function returns False
•  Assumes signature is always raw 64 bytes (R||S)
•  Your check Length(...) <> SizeOf(TEccSignature) exits early for any DER signature. OpenSSL (and many toolchains) output DER. So you never reach Verify for DER input.
•  Public key format mismatch
•  lCertificate.GetPublicKey returns the X.509 SubjectPublicKey (SPKI) in ASN.1. TCryptAsym.Verify expects EC public key in one of a few raw/PEM/DER encodings it can parse; SPKI isn’t always accepted directly by its low-level PemDerRawToEcc(). You either need to rewrap the SPKI to the EC compressed key DER, or use ICryptCert.Verify (which does that internally).
•  Data bytes/encoding

---

read code in gist

credit: gpt

ps: I tested the code

@ab: do you think the ai-model hallucinated?

You are missing the object creation that will trigger an AV and use ObjectToJson, not JsonEncode.

function TUtilisateursService.GetUtilisateur(aID: TID): RawJSON;
var
  obj: TOrmUtilisateurs;
begin
  obj := TOrmUtilisateurs; // <- missing create
  try
    if not fClientDB.Orm.Retrieve(aID, obj) then 
      raise ERestException.Create('404 - Utilisateur non trouvé');

    Result := ObjectToJson(obj); 
  finally
    obj.Free;
  end;
end;

ou

function TUtilisateursService.GetUtilisateur(aID: TID): RawJSON;
var
  obj: TOrmUtilisateurs;
begin
  obj := TOrmUtilisateurs.Create(fClientDB.Orm, aID);
  try
    if ID = 0 then
      raise ERestException.Create('404 - Utilisateur non trouvé'); 

    Result := ObjectToJson(obj); 
  finally
    obj.Free;
  end;
end;

read there: SAD1.18 5.2. Working with Objects

If it helps you find the way, on my side, I use TWebSocketProtocol.UpgradeBearerToken for that: read more there

don't be fooled ..

.. and it's not the only data source; You know.. personal privacy.. checkbox.. big-data, etc...

The main issue, IMO, comes from when most datasets were built. The first public release of mormot v2 was around late 2020 (first commit in march 2020), but by then the models had already ingested mormot v1 source code. That’s why on gpt-3, gpt-4 (and even gpt-5!), you often get v1-based code in the answers - I'am quite sure you got the TSqlModel instead of TOrmModel things, etc.  which is why the “big prompt” is actually useful.

Also, if you let your tools adapt to your own habits, you’ll naturally get better results. On my side, no matter what I ask, I always end up with a marmot somewhere in the answer

No. At this moment, the mcp-delphi server only allows AI agents to use your IDE to compile your project (Delphi, Lazarus, or FPC directly) and get the output, nothing more. That said, if your coding tool supports "auto-mode", you can let the agents create, compile, and fix the project for you - while you’re cooking, for example I tried it with gpt-5, project built successfully and potatoes where not burnt lol.

Then I thought it could be useful to have a dedicated MCP server for working with mormot. It would definitely reduce the number of tokens consumed, since the agents would be able to query a well structured knowledge base for the relevant part of the framework instead of injecting a huge prompt. I also believe the agents would "think" better as their memory context wouldn’t be overloaded.

Thanks! I’ll review it this weekend. Is it based on the latest mORMot update?

I published a MCP server for delphi and lazarus/fpc; I am working on a special setup focused on mormot2. I must say from my tests with gemini - and now gpt-5 included - it's quite amazing. Token usage will be reduced a lot compared to "the-big-prompt".

You can find it there: https://github.com/flydev-fr/mcp-delphi

at least I get some more doc to ingest.

Aw nasty. Thanks you ab

I just tested with `curl http://localhost:9088/api/main/UserService.ReadTest?user_uuid=3C28EA56-37FE-4ABC-A0B7-508D8C634E21` and I have the very same issue, result:

uuid is: 17868178-0000-0000-0000-000000000000

Then I have also compiled the server on ubuntu and same problem. FPC version on Ubuntu is 3.3.1. The lazarus project file is based on MVCServer.lpi with -Xm and compiled without optimization. I will test it with a simple and new project..

---

Edit: 

I have created a new simple project on ubuntu and compiled, result is the same, the guid is wrong.

Again, just a small question about TGUID as I’m hitting a cross-platform snag with FPC 3.2.2 but with TGUID defined as param on SOA:

IUserService = interface(IInvokable)
['...'] 
  function Read(const user_uuid: TGUID): TServiceCustomAnswer;
end;

- Win64 build (FPC 3.2.2): user_uuid arrives with the expected value.
- Linux x86-64 build (same sources & FPC version): user_uuid is always null.

Is this due to missing record RTTI for TGUID under FPC on Linux?
I can tackle the problem by passing it as RawUtf8, but I'am asking for my own knowledge.

thanks

@Alek, to force partial changes to be reloaded, apply theses modifications:

on mormot.rest.mvc.pas#L181 add:

FViewPath: RawUtf8;

and the public property:

property ViewPath: RawUtf8 read FViewPath write FViewPath;

on line mormot.rest.mvc.pas#L1245 add:

{$ifdef DEBUG}
fViewPartials.ViewPath := folder;
{$endif}

replace mormot.core.mustache.pas#L1317-L1332 with:

function TSynMustachePartials.GetPartial(
  const PartialName: RawUTF8): TSynMustache;
var
  i: PtrInt;
  Temp: TSynMustache;
begin
  if self=nil then begin
    result := nil;
    exit;
  end;
  i := fList.IndexOf(PartialName);
  if i<0 then
    result := nil
  else 
  begin
    // Partial files by default in mORMot are loaded just once and then cached which is very bad
    // during debugging when files are changed and it requires constant restart of the application.
    // With this change we're disabling cache in debugMode: -dDEBUG on fpc
    Result := TSynMustache(fList.Objects[i]);
    {$ifdef debug}
    begin
      Temp := TSynMustache.Parse(AnyTextFileToRawUTF8(UTF8ToString(MakePath([FViewPath, PartialName + '.partial'])), true));
      if Temp.Template <> '' then
        Result := Temp;
    end;
    {$endif debug}
  end;

@ab, any chance you consider adding it or similar - or did we missed something?

---
Edit: I missed last post of @ab - watching for files changes and triggering FlushAnyCache() should be the right way to do it while developping. Anyway, the method presented here still make getting partial markup changes easier.
---

I made a gist trying to explain it (should be correct), read there: https://gist.github.com/flydev-fr/e0f0a … c2ac78f2bc

Call FlushAnyCache when you change data in your model. If I am correct, on the blog sample, the default data is cleared and filled with new data again if empty on GetViewInfo(). The method is virtual so you can implement your own flush logic there.

I can't reproduce it - it work as expected at least on fpc 3.2.2.

edit: ... and mormot 2.3.10775

TRestClientDB use an hidden TRestServerDB; you could map to an external db for example this should work:

Props := TSQLDBZEOSConnectionProperties.Create(...);
Props.ThreadSafeConnection.Connect;
OrmMapExternal(aORMSQLModel, [TYourOrmMapped], Props);
ORMDB:= TRestClientDB.Create(aORMSQLModel, nil, ':memory:', TRestServerDB, False, StringToUtf8(aPassword));
TRestServerDB(ORMDB.Server).Server.CreateMissingTables(0, [itoNoAutoCreateUsers]);