Injecting dependencies into a JPA EntityListener

It is not possible to inject spring managed beans into a JPA EntityListener class. This is because the JPA listener mechanism should be based on a stateless class, so the methods are effectively static, and non-context aware.

In Hibernate at least this is not strictly true, since if you were (and you shouldn’t) to record an entity in a field of this in a method, it’s sat there next time the method comes along.

public class EntityListener {
   private Entity entity;

   @PostUpdate
   public void doStuff(Entity entity) {
       // don't try this at home, it is a BAD THING
       this.entity = entity;
       ...
   }
}

This is more than a little daft, what with the lingering reference, and the concurrency nightmare that would no doubt ensue.

No amount of AOP will save you, nothing gets injected to the ‘object’ representing the listener, because the implementations don’t actually create instances, but uses the class method. This is a perfectly reasonable approach based on the JPA spec, so is not really a bug, but does mean that there is no bean to inject dependencies to. If you were crazy, you could pointcut each method of your listener, but by that point, you’ve probably lost the plot you were pursuing in the first place, and you might as well just do the whole thing with a pointcut on your target entity (this is debatable, but I will not debate it just yet).

This is certainly the case for Hibernate, and appears to be for at least two of the other major providers (Open JPA, eclipse – ok, so I tested the effect, but didn’t read all the source code for those, because life is too short, and I’d already spent too long reading most of Hibernate).

Of course you could provide access to services through static methods, or a singleton of some sort, but we’re all convinced that’s an anti-pattern, right?

Anyway, this post is running out of time, and will be updated when I get round to cleaning up the rest of the test code.

Share:
  • Digg
  • StumbleUpon
  • Facebook
  • Twitter
  • Google Bookmarks
  • DZone
  • email
  • LinkedIn
  • Slashdot
Posted in Technology | Leave a comment

OS X for the Coding. Linux for deploying.

I just came across an excellent article on setting up Xcode, and a generally mac environment to point at an SSHFS disk within a VMWare Fusion box. All this was to the end of using a nice interface to code against a nice clean unix platform, laudable goals indeed.

This works on the assumption that you want the target and the code to be stored on the VM. However, this is not always the case. I much prefer the vagrantvm approach, which is essentially the same thing, the other way around. In vagrant, the Mac’s file system is used to store the code, and the VM gets access to it through shared folders. The main advantage of the vagrant approach is that it’s just so easy to trash and restore your target virtual machine without losing your working copy.

Of course it does also arguably mean you’re not getting authentic file system behaviour and performance within your VM, but unless you’re doing very specific things, this is probably not going to matter very much to you, and certainly not as much as the fact that it’s a VM on your laptop of something in any case.

Share:
  • Digg
  • StumbleUpon
  • Facebook
  • Twitter
  • Google Bookmarks
  • DZone
  • email
  • LinkedIn
  • Slashdot
Posted in Technology | Tagged , , , | 1 Comment

Cloud security and management portals

There’s a lot of talk these days about cloud security. The usual, sensible, and frankly right answer is, don’t be silly. With the right combination of VLANs firewalls, proper machine isolation in the hypervisor, and all the normal sort of things you should be doing with a server anyway (hardening, patching, and those other things sysadmins like spending their evenings and weekends on)… yeah, all that stuff. We’re covered (well, close enough)

But…

There’s a whole bunch of new vendors springing up every five seconds, trying to sell new, or port old, systems management, help desk, monitoring and whatever else tools to the new smaller private cloud vendors. A lot of them are shiny, they’re all lovely, and many many of them haven’t the slightest idea how to maintain web security. I recently discovered (with a quick look at the page source, and some playing around) that one such white-labelled, make-it-easier-for-the-help-desk system was a litany of everything you can get wrong with web security.

Some hints:

Don’t store an admin user’s password in plain text in a cookie. Especially not when you’re more than happy to send that cookie back and forth a few thousand times a day over unencrypted http.

Client state is not where you keep security. Clients should be aware of security. This is a UX thing, ie, if the user doesn’t have the permission, they shouldn’t see / be able to push the button (unless you’re trying to upsell the function to them, or something of the sort, but that’s a whole other debate). Permissions need to be enforced on the server.

Permissions do not just apply to pages / actions / end-points. Always check the permissions on the parameters, the filters you’re applying to aggregated data etc. This is particularly relevant if you want to sell a multi-tenant system. Ideally there should be full separation of per-tenant databases, with proper database level permissions. Hey, I know not every junior web dev has this sort of thing at front of mind, and it’s real tempting to just assume you can get away with a few where clauses, and a single jndi reference for your data source (the unnamed victim of this rant looked like a cobbled together bunch of technical debt denominated in struts)… but at least make sure you consistently apply your where clause (try aspects if you’re worried about the junior guys forgetting). I really should not know as much about my cloud provider’s other customers as I now do.

Web development rules still apply when you’re making ‘intranets’. Clean, valid HTML, unobtrusive javascript, missing links, not using the mouseover attribute in anchor tags, clear, concise javascript which has at some point been aware of the concept of architecture. It’s all good stuff. Do it, even if your audience is a select group of highly technical IT managers and CTOs. We’re sometimes users too, and don’t want to have to break out the Greasemonkey just to make the tool work.

</rant>

Share:
  • Digg
  • StumbleUpon
  • Facebook
  • Twitter
  • Google Bookmarks
  • DZone
  • email
  • LinkedIn
  • Slashdot
Posted in Technology | Tagged , , , , , , | Leave a comment

Physical security matters!

Here is an account of some interesting experiments in using very sensitive microphones, or voltage meters to crack RSA.

So from this, it would be perfectly possible to build a plug in device which stole anything, even anything encrypted with a key held in RAM, given long enough to listen.

Scary stuff.

Share:
  • Digg
  • StumbleUpon
  • Facebook
  • Twitter
  • Google Bookmarks
  • DZone
  • email
  • LinkedIn
  • Slashdot
Posted in Technology | Leave a comment

Advice for AJAX programmers, the partners they love, and the browser they hate

I just came across this fantastic article, which has a number of things to contribute. Firstly, how to get that crock-of-browser IE to work.

Secondly, it has some lovely advice for partners on how to deal with us web developers when we’re not going to bed until this works.

Here it is: A Fun Little JSON Murder Mystery With IE9

I thought I’d also point out, partly for reminding me next time I am ripping hair out and depositing it in the gaps between the keys, and partly for the edification of others, that this is far from the only gotcha IE likes to throw up.

Every now and then your find yourself involved with the X-JSON header. This is usually if you’re still using a very old version of Rails, or have for some other reason decided to use a similarly old version of prototype.js. (I assume that if you’re doing this, you’re also battling a scriptaculous addiction – move on, there’s newer shinier stuff). Old version of prototype (1.5 ish) use a custom header to read JSON responses instead of response body, which means you are limited in certain browsers to a 168 characters. This is covered here. One ugly way to deal with this is to have your server pretend it’s sending Content-Type: text/plain, and manually decode the JSON. Or you could upgrade prototype to 1.7, or jQuery.

IE will also usually believe the Content-Length header you give with a JSON response, so make sure you get it right.

Some XMLHttpResquests, and some servers will also get very upset if you send and empty POST request. Always give it some content. Otherwise you probably mean GET, DELETE, HEAD or something like that. If you’re posting something, remember to put it in the envelope, and add the stamp.

Something else to be aware of on the other side of the transaction is dealing with things like Spring’s jackson backed message adapter. Always remember to set the Content-Type of the POST.

Well, I hope some of that will save me and hopefully some others a few late night ‘dur’ moments.

Share:
  • Digg
  • StumbleUpon
  • Facebook
  • Twitter
  • Google Bookmarks
  • DZone
  • email
  • LinkedIn
  • Slashdot
Posted in Technology | Leave a comment

How I learned to let go, and got back on the rails

Many many years ago I produce a website in Rails. It was OK. I certainly didn’t totally hate it. That was back in the very early days of Rails 1. The website did ticketing for a one off event and it ran quite nicely once I’d fought a bit with apache. Once the event was over, and the hangover cleared (I got paid in tickets) I put Rails back in a box marked ‘for hipsters and web-designers’ and went quietly on my way back to PHP, Java, and all that lot.

So several years passed by, and I found my self at a conference talking to people about actual proper development work involving large chunks of extremely sensitive and complex data (we’re not talking about tweets here). I was surprised to find out they were producing the whole thing with ruby on rails, and planning all sorts of fancy integration, even portlet spec stuff and thinking in enterprise scale reliability.

One of the things I like about rails, and also one of the things I hate about it is that it’s proponents just have to change everything. Coffee script is now a default, haml, sass, come on… these are solved problems! Or are they? I’ll hand it to them,

I know you’re not forced to do it their way all the time, which is nice, but let’s face it, framework users tend to tend to their defaults, unless they really really like spending their time making glue and fighting dependency battles.

In any case, with a few weeks back on the rails, I’m finding it to be one of the fastest prototyping framework I’ve found.

Share:
  • Digg
  • StumbleUpon
  • Facebook
  • Twitter
  • Google Bookmarks
  • DZone
  • email
  • LinkedIn
  • Slashdot
Posted in Technology | Tagged , , , | Leave a comment

Ruby on Rails and ExtJS 4 Data Model

I’ve been playing around a lot with rails 3 recently, and since I’ve spent many years working with the ExtJS platform from Sencha, and spend most of my working day with it, I thought it was about time I looked at combining the two. With the release of ExtJS 4, there are some extremely cool data and client side model tools.

One of the lovely things I find about the rails system is its attitude to JSON serialisation configuration. When you have a complex domain object graph, based on deep, and bidirectional relationships, context aware JSON serialisation can be a bit of a pain. (Looking at you, and your message converters Spring Framework). However, there is a little bit of an oddity with the default way rails scaffolding suggests REST states vs the way ExtJS expects them. In short, when returning a single object, Rails very sensibly encourages you to JSON it as an object. However, if you’re trying to simplify the Ext model side, you need an array.

Essentially, the problem is neatly expressed (as is usually the case) at stack overflow: http://stackoverflow.com/questions/6074413/extjs4-json-data-store-and-rails/6125571#6125571

Oh, and my solution is there too. Basically, it is just “wrap objects in an array for ExtJS”.

Share:
  • Digg
  • StumbleUpon
  • Facebook
  • Twitter
  • Google Bookmarks
  • DZone
  • email
  • LinkedIn
  • Slashdot
Posted in Technology | Tagged , , , , | Leave a comment

Rails conf 2011

Streaming it live is great. Quite impressed at how well I can watch a conference in Baltimore from the corner of a desk in London and actually feel like its working.

There does seem to be a lot of quotation from ‘popular philosophy’. Do we have to pretend that post modernism has anything to do with web frameworks, just because we read a pithy quote about prepositions, that we thought defined post modernism? Or maybe we could have actually read some post modern philosophy, and wondered what on earth they are talking about. Oh, and inclusive attitude to dependencies and configuration replacing the original essence of convention. I see, well, that’s about as much about postmodernism as Alanis Morissette is about irony.

On the plus-side, I’m rewarming to rails, and while 3 is looking great, I’m interested to see 3.1, and rather hoping that it doesn’t disappear too much up its own behind. After all, contrary to the popular impressions, ruby on rails did not invent everything, and could do with a little bit more of a connection to the rest of the world’s frameworks. Hopefully keeping it anchored in the existing paradigm might just keep it learnable for experienced programmers coming from other worlds.

Share:
  • Digg
  • StumbleUpon
  • Facebook
  • Twitter
  • Google Bookmarks
  • DZone
  • email
  • LinkedIn
  • Slashdot
Posted in Technology | Leave a comment

Quick PhoneGap build gotcha

I will be blogging a lot more about mobile development it seems, having now ended up becoming both an overnight iOS and Android developer. Loving both platforms, but also for the simple stuff, loving PhoneGap, the sort of html and javascript with a library framework for both.

One quick Gotcha before I blog properly: the build script doesn’t work if you have spaces in your project path. To fix this, just wrap quotes round the line in the Copy PhoneGap Javascript build step.

Screenshot of build steps

PhoneApp Gotcha Build Steps

Change:
find ${PROJECT_DIR}/www | xargs grep 'src[ ]*=[ ]*[\\'\"]phonegap.*.*.js[\\'\"]' -sl | xargs -L1 sed -i "" "s/src[ ]*=[ ]*[\\'\"]phonegap.*.*.js[\\'\"]/src=\"phonegap.${pgver}.min.js\"/g"

To:
find "${PROJECT_DIR}/www" | xargs grep 'src[ ]*=[ ]*[\\'\"]phonegap.*.*.js[\\'\"]' -sl | xargs -L1 sed -i "" "s/src[ ]*=[ ]*[\\'\"]phonegap.*.*.js[\\'\"]/src=\"phonegap.${pgver}.min.js\"/g"

See that? Yep, just the quotes and you’ll be fine and get nice clean javascript output in the right place.

Hope that helps. There will be lots more on PhoneGap, iOS and Android coming shortly, both of the native and the html kludge variety. Oh, and for the pop quiz, do you think that maybe things like PhoneGap might not be why there is no Nitro in UIWebView. Discuss (actually, don’t it’ll just be a flamewar).

Share:
  • Digg
  • StumbleUpon
  • Facebook
  • Twitter
  • Google Bookmarks
  • DZone
  • email
  • LinkedIn
  • Slashdot
Posted in Technology | Tagged , , , , , | Leave a comment

Cambridge Startup Weekend Winners

So we’ve finally made it to the end of an intense weekend. There were some absolutely fantastic ideas, and some excellent presentations at the end of it all. With many very deserving winners, in all sorts of categories, I’m very pleased to announce that my team managed to scoop Best Healthcare Application.

Now to sleep.

Share:
  • Digg
  • StumbleUpon
  • Facebook
  • Twitter
  • Google Bookmarks
  • DZone
  • email
  • LinkedIn
  • Slashdot
Posted in swCamb | Leave a comment