Product architecture question (long)
I've been using Zope (w/Plone) for some time now and am still trying to understand how best to architect the solution for my site. I'm presuming I need to create a Product for the new types of objects/files I want, but even on that topic I'm not completely convinced. My objectives and constraints are: - The primary purpose for the site's existence is to manage some content files (text/ml) and allow a workflow process on those. The workflow will likely change and hopefully will have minimal programming changes when it does. - Users will have one of several roles: Author, Reviewer (of which there are currently two types), and Editor. - I do not want ANY access by unauthorized users. Obviously they must be able to reach a login page, and get instructions on how to request an account, password reset, etc. - Here's the complication -- each file will have potentially multiple versions in process at once. Each version of a file may have a different state, and I'd like to have a history of all changes to each version as they go through the workflow. - Once a file/version is submitted for review, any of the reviewers may work on it, it is not necessary that one role preceded the other, but it is required that a user in each role approve the file. - The workflow is subject to change (the real one that the humans use), so this could precipitate changes to the Zope workflow: - The users' roles may change (easy), - There might be another type of Reviewer created that gets grafted into the review process, - There might be other steps ("states") added to the workflow, and corresponding changes to the process. - We need to have good automated backup solution for the content (as in mirroring the content on another host). - And, of course, I'm under pretty extreme time pressure. =============== So my questions are: 0) Is DCWorkflow and a new Product [document type(s)] the way to go? 1) Is there a product that does something similar that I could use or adapt? 2) Barring that, is there a product that would be a good starting point? 3) Is there something that manages a file history (like CVS, etc.) that can be easily used within Zope? 4) How does one secure a Zope+Plone site? I'm running on FC3, Zope 2.7.6-final, Plone 2.0.5, Python 2.3.4 Thanks in advance! Nikko
Nikko Wolf wrote:
I've been using Zope (w/Plone) for some time now and am still trying to understand how best to architect the solution for my site.
I'm presuming I need to create a Product for the new types of objects/files I want, but even on that topic I'm not completely convinced.
My objectives and constraints are:
- The primary purpose for the site's existence is to manage some content files (text/ml) and allow a workflow process on those. The workflow will likely change and hopefully will have minimal programming changes when it does.
- Users will have one of several roles: Author, Reviewer (of which there are currently two types), and Editor.
- I do not want ANY access by unauthorized users. Obviously they must be able to reach a login page, and get instructions on how to request an account, password reset, etc.
- Here's the complication -- each file will have potentially multiple versions in process at once. Each version of a file may have a different state, and I'd like to have a history of all changes to each version as they go through the workflow.
what happens to the different versions. are they merged ??
- Once a file/version is submitted for review, any of the reviewers may work on it, it is not necessary that one role preceded the other, but it is required that a user in each role approve the file.
- The workflow is subject to change (the real one that the humans use), so this could precipitate changes to the Zope workflow:
- The users' roles may change (easy), - There might be another type of Reviewer created that gets grafted into the review process, - There might be other steps ("states") added to the workflow, and corresponding changes to the process.
- We need to have good automated backup solution for the content (as in mirroring the content on another host).
- And, of course, I'm under pretty extreme time pressure.
=============== So my questions are: 0) Is DCWorkflow and a new Product [document type(s)] the way to go?
DCWorkflow can handle your scenario. why do you need a new product?/document type? You need scripts / products to handle the multiple states.
1) Is there a product that does something similar that I could use or adapt? 2) Barring that, is there a product that would be a good starting point? 3) Is there something that manages a file history (like CVS, etc.) there are several products that do that. we have one (called RedRevision) it is not very sophisticated but might be enough. then there is CMFEdition which is still in developpement but much more powerful.
Robert
On 6/7/05, Nikko Wolf <nikko-wolf@earthlink.net> wrote:
1) Is there a product that does something similar that I could use or adapt? 2) Barring that, is there a product that would be a good starting point? 3) Is there something that manages a file history (like CVS, etc.) that can be easily used within Zope?
The CPS content management system has a workflow based on DCWorkflow and a versioning system. I would think it would be an excellent base for this project. http://www.cps-project.org/ -- Lennart Regebro, Nuxeo http://www.nuxeo.com/ CPS Content Management http://www.cps-project.org/
Nikko Wolf wrote at 2005-6-7 14:25 -0600:
... - The primary purpose for the site's existence is to manage some content files (text/ml) and allow a workflow process on those. The workflow will likely change and hopefully will have minimal programming changes when it does.
Look for "DCWorkflow" (distributed together with Plone)
- Users will have one of several roles: Author, Reviewer (of which there are currently two types), and Editor.
No problem...
- I do not want ANY access by unauthorized users. Obviously they must be able to reach a login page, and get instructions on how to request an account, password reset, etc.
Put all content in a subfolder of your site and remove "View" and "Access contents information" from "Anonymous".
- Here's the complication -- each file will have potentially multiple versions in process at once. Each version of a file may have a different state, and I'd like to have a history of all changes to each version as they go through the workflow.
Indeed, a bit more complex. I would model a "file" as a folder like structure containing the various versions and give it the "right" behaviour.
- Once a file/version is submitted for review, any of the reviewers may work on it, it is not necessary that one role preceded the other, but it is required that a user in each role approve the file.
What does that mean? Do you have "technical reviewer", "style revierwer", "aestetic reviewer", ... and require that at least one from each role approves? I do not think that you will find an out of the box solution for something like this. But, it is implementable with DCWorkflow...
... - We need to have good automated backup solution for the content (as in mirroring the content on another host).
There is a commercial Zope.com solution. We use mirrowed disks and a high availablity cluster.
... =============== So my questions are: 0) Is DCWorkflow and a new Product [document type(s)] the way to go?
I think so...
4) How does one secure a Zope+Plone site?
One uses HTTPS and standard authentication. One tells the users that good passwords are essential. One does not store clear text password. -- Dieter
Dieter Maurer wrote:
Nikko Wolf wrote at 2005-6-7 14:25 -0600:
- I do not want ANY access by unauthorized users. Obviously they must be able to reach a login page, and get instructions on how to request an account, password reset, etc.
Put all content in a subfolder of your site and remove "View" and "Access contents information" from "Anonymous".
I have a Plone instance named "/Home" -- do you mean that or a subfolder of it? But of course, this killed my entire Plone installation. I did as you suggested but (in hindsight stupidly!) did not ensure that anyone else had permissions to "View" and "Access contents information" -- so even logged in as a Manager I could not access the "/Home" folder -- including the Security tab where I would go to fix the problem. Which seems like a design flaw, but.... Fortunately, http://www.zope.org/Documentation/Misc/SECURITY.txt/view explains about using the emergency user via "zpasswd.py" script, so I fixed things but not until after a good bit of elevated blood pressure and a lot of profanity. But this brings me to an issue I found weeks ago. Whilst trying to restrict access, I find that with an non-manager user: http://myhost.com:8080/Home/ --- shows the root Plone page just as desired http://myhost.com:8080/Home --- shows an "insufficient privileges" page (note the lack of a trailing slash). Any one have ideas why this is, or how to fix this? Regards, Nikko
Nikko Wolf wrote at 2005-6-8 17:22 -0600:
... I did as you suggested but (in hindsight stupidly!) did not ensure that anyone else had permissions to "View" and "Access contents information" -- so even logged in as a Manager I could not access the "/Home" folder -- including the Security tab where I would go to fix the problem. Which seems like a design flaw, but....
Fortunately, http://www.zope.org/Documentation/Misc/SECURITY.txt/view explains about using the emergency user via "zpasswd.py" script, so I fixed things but not until after a good bit of elevated blood pressure and a lot of profanity.
Thus, you now learned that any security breakage can be fixed with a single concept: the "Emergency user"... -- Dieter
Dieter Maurer wrote:
Nikko Wolf wrote at 2005-6-7 14:25 -0600:
- I do not want ANY access by unauthorized users. Obviously they must be able to reach a login page, and get instructions on how to request an account, password reset, etc.
Put all content in a subfolder of your site and remove "View" and "Access contents information" from "Anonymous".
See previous post. Is there a current, good tutorial for securing Plone from unauthorized use (SSL notwithstanding)?
- Here's the complication -- each file will have potentially multiple versions in process at once. Each version of a file may have a different state, and I'd like to have a history of all changes to each version as they go through the workflow.
Indeed, a bit more complex.
I would model a "file" as a folder like structure containing the various versions and give it the "right" behaviour.
Currently, I've implemented scripts to do part of this -- although I would not say I've "modeled" anything as much as simply "implemented" scripts & ZPT to allow access in the manner needed. The issue is that there is no separation of workflow and content view/actions, and there should be, since the workflow may change and I'd like to use the workflow interface to handle those changes (if possible).
- Once a file/version is submitted for review, any of the reviewers may work on it, it is not necessary that one role preceded the other, but it is required that a user in each role approve the file.
What does that mean?
Do you have "technical reviewer", "style revierwer", "aestetic reviewer", ... and require that at least one from each role approves?
Something like that: someone from each role must approve the version before it can be submitted for final editor approval (not exactly footnotes to a bibliography added by different roles / experts in a field, but that's similar). Hence, they will actually make minor changes/additions before they approve.
- We need to have good automated backup solution for the content (as in mirroring the content on another host).
There is a commercial Zope.com solution.
We use mirrored disks and a high availablity cluster.
Ah, the drawback of an opaque (and custom) data store. Instead I've got a cron script that will shutdown zope and backup the entire directory tree. Soon I'll add a second script to pull these files back from the DMZ for archival/storage. However my question is this -- is it necessary for me to shutdown zope to snapshot the directory? Given the times of access, I'm *almost* guaranteed that it's been idle for 1+ hours when I do this (famous last words, though those may be). Knowing that zope is event-driven (and no sleeper thread): -- is there any consistency issues of backing up (Data.fs) without stopping? -- is there another feature of "zopectl" that would tell it to "sync" the DB to the file system? "help" gives: EOF fg kill quit run start test adduser foreground logreopen reload shell status wait debug help logtail restart show stop After some testing, I'll probably share the script & crontab entries.
4) How does one secure a Zope+Plone site?
One uses HTTPS and standard authentication.
One tells the users that good passwords are essential.
One does not store clear text password.
The content isn't important enough that I worry about anything that even simple passwords and SSL can't prevent. I've looked but found no Zope SSL capabilities, so does this requires placing Zope behind Apache, right? Ref: http://www.zope.org/Members/simonb/howtos/Set%20Up%20SSL Thanks in advance, Nikko
On Thu, Jun 09, 2005 at 11:34:31AM -0600, Nikko Wolf wrote:
However my question is this -- is it necessary for me to shutdown zope to snapshot the directory? Given the times of access, I'm *almost* guaranteed that it's been idle for 1+ hours when I do this (famous last words, though those may be).
Knowing that zope is event-driven (and no sleeper thread): -- is there any consistency issues of backing up (Data.fs) without stopping?
This should be interesting: http://www.plope.com/Members/chrism/repozo
-- is there another feature of "zopectl" that would tell it to "sync" the DB to the file system?
I don't know what you mean by "sync". Are you trying to extract data from zope and put it in some human-useful form on the filesystem? If so, I'd probably just use a script that calls wget or some other standard http client to extract the data I want. Or possibly look into using Ape, but I've never done that. http://hathawaymix.org/Software/Ape
I've looked but found no Zope SSL capabilities, so does this requires placing Zope behind Apache, right? Ref: http://www.zope.org/Members/simonb/howtos/Set%20Up%20SSL
Pound would do the job too. -- Paul Winkler http://www.slinkp.com
Nikko Wolf wrote at 2005-6-9 11:34 -0600:
...
I would model a "file" as a folder like structure containing the various versions and give it the "right" behaviour.
Currently, I've implemented scripts to do part of this -- although I would not say I've "modeled" anything as much as simply "implemented" scripts & ZPT to allow access in the manner needed.
"Modelling" describes the intellectual work before the implementation. It indentifies the major use cases, looks for the primary concepts and designs the outline of the necessary classes and their interactions. It is an essential preparation for the actual implementation -- for any non-trivial task...
The issue is that there is no separation of workflow and content view/actions, and there should be, since the workflow may change and I'd like to use the workflow interface to handle those changes (if possible).
It is the task of the modelling phase to answer such questions.
... However my question is this -- is it necessary for me to shutdown zope to snapshot the directory?
No, it is not necessary. You should read: http://zope.org/Wikis/ZODB/FileStorageBackup
Knowing that zope is event-driven (and no sleeper thread): -- is there any consistency issues of backing up (Data.fs) without stopping? -- is there another feature of "zopectl" that would tell it to "sync" the DB to the file system? "help" gives: EOF fg kill quit run start test adduser foreground logreopen reload shell status wait debug help logtail restart show stop
No, because it is not necessary.
... I've looked but found no Zope SSL capabilities, so does this requires placing Zope behind Apache, right?
It is the easiest and most standard solution. But there is also an SSL enabled ZServer (as a third party product). I do not know its name -- search for it if you mistrust Apache... -- Dieter
Dieter Maurer wrote:
Nikko Wolf wrote at 2005-6-7 14:25 -0600:
... - The primary purpose for the site's existence is to manage some content files (text/ml) and allow a workflow process on those. The workflow will likely change and hopefully will have minimal programming changes when it does.
Look for "DCWorkflow" (distributed together with Plone)
For the record/archive .. using "DCWorkflow" in Plone does not allow use of the "state:" menu that is standard in Plone. Instead use a "plone_workflow (Default Workflow [Plone])" which I presume is *derived from* DCWorkflow.
participants (5)
-
Dieter Maurer -
Lennart Regebro -
Nikko Wolf -
Paul Winkler -
robert rottermann