• Altes System
• fehleranfällig

• Selbstpflege durch den Kunden
• Integration in Systeme der Kunden
• Kürzere Wartezeiten
• Geringerer Aufwand

• Auf Basis des Relationenmodells
• REST-Schnittstelle
• JSON Format
• Verschiedene Möglichkeiten: GET, POST, PUT, DELETE
• Beispiel:

  GET api.mailpen.de/list/:listId/subscribers

// Group: list
$app->group('/list', $checkAuthentication, function () use ($app, $checkList) {

  // Route: list info
  $app->get('/:listId/', $checkList, function ($listId) use ($app) {
    echo "List info";
  });

  // Route: list change
  $app->put('/:listId/', $checkList, function ($listId) use ($app) {
    echo "List change";
  });

  [...]

});
						

• Klassen für Objekte
• Middleware zur Absicherung/Kontrolle
• Einbindung in die API-Routen

class NLList {
  // .. Variablen
  // Konstruktor
  public function __construct ($listId = null) {
    $this->_db = DB::getInstance();
    if ($listId) $this->find($listId);
  }
  // Liste suchen
  public function find ($listId) {
    // check id
    if (is_numeric($listId)) {
      // fetching data
      $listData = $this->_db->get(Config::get('db_tables/lists'), array('id', '=', $listId));
      // check if there is any data
      if ($listData->count()) {
        [...]

$checkList = function ($route) use ($app) {
  // get listId
  $listId = $route->getParams()['listId'];
  // create instance of list
  $list = new NLList($listId);
  // check if list exists
  if ($list->exists()) {
    // fetch data
    $listData = $list->getData();
    if ($listData['user_id'] != $app->loginData->id) {
      // no permission to access that info
      $errorMsg = array('ErrorMsg' => 'No permission');
      $app->halt(401, json_encode($errorMsg));
    }
  } else { [...]
  }
};
							

$app->delete('/:listId/', $checkList, function ($listId) use ($app) {
  // create instance
  $list = new NLList($listId);
  // try deleting list
  try {
    $list->delete();
  } catch (Exception $e) {
    // cannot delete
    $errorMsg = array(
        'ErrorMsg' => 'Cannot delete list',
        'Exception' => $e
    );
    $app->halt(500, json_encode($errorMsg));
  }
});
							

function getList(listId) {
  // handle success
  function getListSuccess(response) {
    return response;
  }
  // handle failure
  function getListFailed(response) {
    // Log error
    logError(response.status, 'Loading list - failed', response.data);
    // return response
    return response;
  }
  // request
  return $http.get(apiUrl + '/list/' + listId, getAuthHeaders())
    .then(getListSuccess)
    .catch(getListFailed);
}
						

• Probleme mit CORS (Cross-Origin Resource Sharing)
• Fehler:

  Origin <Domain> is not allowed by Access-Control-Allow-Origin        

• Preflight Anfragen werden nicht beantwortet

if ($_SERVER['REQUEST_METHOD'] == 'OPTIONS') {
  // return only the headers and not the content
  if (isset($_SERVER['HTTP_ACCESS_CONTROL_REQUEST_METHOD'])) {
    header('Access-Control-Allow-Origin: *');
    header('Access-Control-Allow-Headers: x-requested-with');
  }
  exit;
}
							

• Erfolgreich
• Lessons-Learned
  • Behandeln von unerwarteten Problemen
  • Recherche von Fehlern
• Zeit eingehalten jedoch Anpassungen zwischen Phasen

• https://auth0.com/blog/2014/01/07/angularjs-authentication-with-cookies-vs-token/