1

I'm a front-end web developer and currently facing a situation where I have one form with few parameters of one object and to save them I should make few requests to few different API endpoints. As I'm used to REST ideology I suppose to have only one API to save one resource.

There is some entity, some object with huge number of different properties and to update them I have about 10 different API endpoints for each property groups. This lead to situations where I have one form with few parameters of one object and to save them I should make few requests to few different API endpoints and my nature resists to what seems to me a chaos.

As I have talk with my colleagues they explained that this is done due to security reasons - so that some users can access some API endpoints to update some objects properties groups. However I still disagree with situation where I should make few requests to update single object.

so here is my questions:

  1. I have heard about ACLs but as far as I understand they are to control access to objects, not to individual object's properties. If I'm wrong then how can ACLs' be used in such situation?
  2. Why can't be there single API and then server would decide which of properties from request should be updated and which not. So that whole that process would be transparent for me - client side developer?
  3. If not ACL then what are the architectures/techniques/approaches should be used in this situation (in web development)
  • 2
    REST is not an ideology. It's an architectural style, and not even a tightly-defined one at that. It's not even a protocol; that's what HTTP is. If you need to communicate with three endpoints or ten endpoints to get this done, then that's what you have to do. – Robert Harvey Nov 3 '16 at 23:32
1

I have heard about ACLs but as far as I understand they are to control access to objects, not to individual object's properties. If I'm wrong then how can ACLs' be used in such situation?

Access Control List's control access to resources. Those resources can be files folders, printers, registry keys, services, and yes objects.1

Individual object properties are, well, resources. Even the commands you use to retrieve them are resources. So it's not that you can't control things this finely. It's if you can expose the property as a resource.

Why can't be there single API and then server would decide which of properties from request should be updated and which not. So that whole that process would be transparent for me - client side developer?

There can. If it doesn't already exist someone will have to build it. No reason that someone can't be you. Otherwise you're asking someone else to solve your problems. If your problems aren't their problems why should they care?

If not ACL then what are the architectures/techniques/approaches should be used in this situation (in web development)

If you insist on sticking exclusively to web development then you're stuck with whatever access to the backend the backend guys feel like exposing. You could try to work with them but if that fails and you wont do it then you're stuck with the API you have.

What you can do is abstract the API so you have a simple way to use it. Web languages can do amazing things. Doing this well will be a challenge if you're not used to it. You shouldn't assume performance will be a problem until it is a problem. This doesn't let you avoid dealing with the ugly API. It lets you put the part of the API you need in an easy to use box. You just have to build the box.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.