Securing a Breeze.js-based REST service?

Jul 14, 2014 at 8:16 AM
Hi!

I just stumbled across VITA and it looks very promising.
However, I wonder if you can use VITA to secure a Breeze.js powered REST service.
This is because Breeze.js provides a APS.NET WebAPI controller which relies on an entity framework datacontext. (http://www.breezejs.com/documentation/web-api-controller)

So is this possible? If not - would it be relatively easy to achieve?

Another alternative for us would be JayData, and as it just requires a basic WCF Data Service, I hope it would be usable with VITA - am I right?
Coordinator
Jul 14, 2014 at 5:54 PM
VITA is for the most part server-side thing, but it has a Web library, just as an add-on, bunch of useful code for Web/REST/pages construction; so nothing against using it with any JS framework. Will look at Breeze, and see if I can provide out-of-the-box integration. Thanks for the tip!
Roman
Coordinator
Jul 14, 2014 at 8:27 PM
as for implementing a specific controller using VITA - for authentication - of course it is doable, no problem swapping EF for VITA.
As for more general question, supporting back-end service for Breeze - as far as I can see, Breeze is based on OData; this is not supported out of the box, and I'm not sure I can promise it will be. OData does not seem to get a lot of traction so far. I will look at providing some generalized Web/REST based facility that will support all basic operations from JS client through REST/JSon, working on it, just not sure it will be OData based.
Jul 15, 2014 at 7:35 AM
"OData does not seem to get a lot of traction so far" - hmmm I don't know how you come to this conclusion but anyways, OData is a big point for me.
That is mainly because of the frameworks you can use with it:
  • Breeze.js
  • JayData
    As modern web applications tend to be single plage applications, those frameworks help a lot at getting the data to the client. You should take a look at them ;-)
What DOES get a lot of traction so far is Web API, and as Breeze.js needs "just a Web API controller", I wonder what the problems would be to use it with VITA.
What WOULD be required in order to make VITA OData-capable? Could you give me a short overview?
Coordinator
Jul 15, 2014 at 6:34 PM
What would require to support OData.
The Breeze doc page about Api controller says that it is 'just an API controller', but it mentions [BreezeController] attribute that you slap on the controller. With VITA, there's no problem exposing IQueryable<T> entity set. The trouble might be in translation engine - the incoming query comes as a string, then it is translated into Linq query over the IQueryable<T> returned by the method. I'm afraid this translation is heavily geared towards EF db context; for SaveChanges method, this is for sure, there's expectation that the underlying framework is EF. So to support OData I need to write the query translation engine; this might be easier than it might seem, something might work with little or no changes, just working with IQueryable, but I would not expect everything to work out-of-the box.
Don't get me wrong, I understand why are you leaning towards Breeze and the way it handles the data. Querying various complex objects and submitting multi-object structs for update without any specific code on the server for each kind of query/save call is a huge win. I was thinking about this scenario too - how to make it easier. Maybe Breeze way/protocol is the answer - we'll see. I will definitely look at it more.
Aug 4, 2014 at 1:35 PM
Hi! Just wanted to let you know that Breeze.js seems to not require OData.
Here is an example of using it with a poco in-memory collection: http://www.breezejs.com/samples/nodb

The negative implication is that you need to define the client-side entities yourself, as automatic metadata is only provided by an ef context. ;-)
Coordinator
Aug 4, 2014 at 5:51 PM
thanks, that looks really interesting, will look at it