mORMot Open Source

Thanks, what would be the correct way of setting the session timeout?
I am not using orm, just my own services, so will have to set it manually.

Perfect, thanks.  I now no longer get the 500 error, but noticed something strange.  Given the example above, after logging in using any string as a password, the sesion authenticates and I get the message that I successfully logged in.  but using any functions returns 403 Forbidden.

However, using abc as a password, I still get the message that I successfully authenticated, but my functions are able to be called.  So it looks like, at some stage when checking if a function can be executed, my checkpassword function is ignored and a direct compare is done between the PasswordPlain value set and that sent to log in.  So does that mean that I need to also override another function to compute the hash, or should I expect the example above to work as-is?

Does the implimentation you provided above also mean that I can no longer set the session timeout value?  Trying to set Result.GroupRights.SessionTimeout results in an access violation.

Thanks.  As per my test code, I already use TSQLRestServerFullMemory.  How does that bring the connection to the interfaces?  Is there a property that I need to access in the interface's functions?

I tried creating a class from which all my instances can inherit, but it doesn't look as if the connection is available when used in the TStaff class.  Would this be the correct way to access a specific created instance?  The Get call currently generates an access violation.

TMyInterface = class(TInterfacedObject)
private
public
  DBConnection: TSQLDBConnectionProperties;
end;

TStaff = class(TMyInterface, IStaff)
private
public
  function GetNickname(const aUserID: string):string;
  function WhoAmI: string;
end;

function TStaff.GetNickname(const aUserID: string): string;
var
  Res : ISQLDBRows;
begin
  Result := '';
  Res := DbConnection.Execute('select nickname from tblstaff where UserID=? ', [aUserID] );
  if Res.Step then
    Result := Res['nickname'];
end;

//This looks like it creates a copy of the interface and does not return the instance in the server,
//so setting properties here leave them nil in the server instance
if aRestServer.Services['Staff'].Get(obj) then
begin
  TMyInterface(obj).DBConnection := aConnection;
  showmessage(TStaff(obj).GetNickname('0')); //this works, but not when calling from ajax, since dbconnection then is nil
end;

//this does not bring the server instance back either, just give an AV
for I := 0 to aRestServer.Services.Count -1 do
  if aRestServer.Services.Index(I).Get(obj) then  //Access Violation here
    TMyInterface(obj).DBConnection := aConnection

//this works, but requires me to do for every service, no for loop
TMyInterface(aRestServer.Service<IStaff>).DBConnection := aConnection;

Now a more basic question remains: how to end a session from ajax?  I currently do the auth? call to authenticate, but what do I call to log out and ensure that a session can't be re-used? This always returns 400 Bad Request but does seem to kill the session (all calls after that returns 403 Forbidden):

http://localhost:8080/root/auth?session=184464650&UserName=admin&session_signature=0afeb50a0003f9f9d88a6677

Yes, squirrels and marmots often share food

To pass on the connection, I followed something done by a user in one of the forum posts and created this little test:

  aConnection := TODBCConnectionProperties.Create('',ConnectionStr,'','');
  aRestServer := TSQLRestServerFullMemory.Create(aModel, false);
  aRestServer.AuthenticationRegister([TMyAuthentication]);
  aRestServer.ServiceDefine(TSales.Create(aConnection),[ISales]);
  aRestServer.ServiceDefine(TStaff,[IStaff], sicShared);

My auth for this test is also currently as simple as possible:

  TMyAuthentication= class(TSQLRestServerAuthenticationDefault)
  protected
    function CheckPassword(Ctxt: TSQLRestServerURIContext; User: TSQLAuthUser; const aClientNonce, aPassWord: RawUTF8): boolean; override;
  end;

  function TMyAuthentication.CheckPassword(Ctxt: TSQLRestServerURIContext; User: TSQLAuthUser; const aClientNonce, aPassWord: RawUTF8): boolean;
  begin
    result := aPassword = 'abc';
  end;

I then defined a WhoAmI function in Both TSales and TStaff.  When calling the Sales.WhoAmI function, it always returns 403 Forbidden, but Staff.WhoAmI always works as expected, depending on whether the authentication passed or failed. The WhoAmI function is also basic and doesn't perform any logic:

function TStaff.WhoAmI: string;
begin
  result := 'I am Somebody';
end;

Not sure if this is relevant, but I'm testing using Ajax, but will use the exact same function calls from a Delphi client.

Any advice would be super helpful.  I'm still finding my feet, but the more I see, the more I like it.

1) For future readers:  It seems that the field that replaces ID is not allowed to be part of the TSQLRecord definition.  If it is, it correctly creates the table and then try to add it on again after creating the table.  After removing the TeamId field from the TSQLRecord class it works as expected.

2) Are there any options for statically linking the 64bit in the exe as well?  Do 64bit obj files need to be generated, or is this not possible / available?