Getting Started

• ScriptAuth, a new scriptable authentication feature

Minor Enhancements and Changes

• added executeFFDL to server-side JavaScript
• iOS SDK: NSCoding compliance for FFUser, FFUserGroup, and FFGeoLocation, and FFMetaData Tests for NSCoding compliance
• data browser support for login with console credentials

Bug Fixes

• fixed critical bug related to dynamic execution of FFDL
• fixed bug in data browser which was preventing using the data browser to connect to apps running on localhost port 8080
• when executing server-side getObjFromUri with ‘asUserGuid’ set to ‘anonymous’, permissions were not being applied in the same way as from client-side anonymous user
• fixes to server-side JS API getBlob, saveBlob, plus ensuring updatedBy is correctly set when using the asUserGuid parameter
• fixed RingoJS/contextClassLoader memory leak

FatFractal Platform Release v1.0.5

Purpose

This is the fifth major release of the platform.

Version Tracking
Note: The corresponding file revision.manifest contains version numbers for every artifact in the package.

Minimum Requirements

****Previous versions of the FatFractal Framework and Engines and all client-side SDKs must be replaced with current versions. Some of the method signatures have changed and this may impact your application so please make sure you rebuild it as well. FFDL files and server extensions should not be impacted.

****This release has been certified with OpenJDK Runtime Environment (IcedTea6 1.11.3)
Browsers Tested and Results

Installation

Please follow the instructions provided at the following link to reinstall the FatFractal Engine and SDKs.
http://fatfractal.com/prod/docs/getting-started/update/

New Features and Improvements

• New ‘depthRef’ and ‘depthGB’ URL parameters, enabling you to greatly reduce the chattiness of your app’s API
• New server-side JS functions: registerUser, getAppMetaData, grabBagCountObjects, getUpdateEventHandlerData
• New type of event handler for Grab bag events (add and remove)
• Console: now shows app logs
• Support for Google Cloud Messaging (GCM)
• Apps may now perform validation on user passwords based on a regex pattern using FFDL SET parameters PasswordValidation, PasswordPattern, and PasswordMessage.
• Enhanced security settings with SET parameters AllowAnonymousGets, AllowInactiveGets, AllowedGetPattern, and DisallowedGetPattern
• iOS, Android: Queued operations can now be saved to a local SQLite database, allowing them to survive app restarts
• Added imgscalr library for server-side image scaling (classic use case: creating thumbnail images). Amendments to EngineSecurityManager and template.fatfractal.xml as a result.
• BLOB processing server-side: Added getBlob and saveBlob methods to server-side JS SDK.
• Added ReferentialIntegrityActionOnDelete – can be one of NONE (do nothing), PREVENT (disallow if there are back references to the object which is being deleted). Another option, SET_NULL, will be implemented in a future release, which will set references to this object to null, remove it from grab bags etc
• Added new FFDL command – DROP COLLECTION /collectionName – for now, doesn’t actually drop the collection from the database, just removes it from the app’s metadata

Minor Enhancements

• New behavior added for PERMIT object.<something> – if <something> is a reference to a single FFUser, then if the current user == that user, the permission is allowed. This is in addition to the current <something> is an FFUserGroup and <something> is a grab bag of FFUsers
• Change to how NoServer handles exceptions which are thrown from Javascript code, whether that be in an event handler or in a server extension, allowing statements such as “throw {statusCode:403, statusMessage:’Bad Stuff’};”
• Enhanced CORS behavior to echo back as Access-Control-Allow-Headers exactly what was sent from the client as Access-Control-Request-Headers (assuming CORS has been enabled for this request Origin)
• An UPDATE Event Handler can now call ff.getUpdateEventHandlerData() which gives a map like this: {old:{… … … }, new:{… … … } } so can do comparisons of old vs new
• Added MaintainCreatedUpdatedBackReferences SETting. When true, back references will be created to FFUser objects from other objects based on their createdBy and updatedBy values.
• Added support for queries to treat createdBy and updatedBy as references – for example GET /Profile/abcde/updatedBy will retrieve the FFUser who last updated the Profile with guid abcde
• For all server-side Javascript functions which interact with the data store, added an optional parameter (asUserGuid) which when set will make the operation be executed as if it were that user. When not set, the operation executes as if it were the system user (current behavior)
• New ‘always’ modifier for PERMIT statements – see http://fatfractal.com/prod/docs/permissions/#declarative-default-oap for more details
• Echoed data from create/update requests are now applied to the objects on the client side in ios and android sdks (as they already were in the Client-side JS SDK). For example, if an event handler, which executes server-side, modifies a newly-created object, then that modification is echoed back to the client in the HTTP response.
• Allow guids (and other metadata)  to be members of iOS client-side objects so that one can (a) supply a guid if one wishes for object creation (b) access the guid (or other properties) directly rather than having to go through the object metadata. (This was already the case in the Android SDK)
• Improved parsing of SET commands in FFDL so that parameter values can be free form including spaces etc
• Added multi-line support for application.ffdl commands by using a trailing backslash (‘\’)
• Data browser: html landing page now accepts a ‘baseUrl’ parameter to set the base URL
• Change to server-side JS registerUser – now returns the newly-created FFUser object
• iOS, Android: After they are executed, queued operations contain resulting metadata
• Amended ordering of generated FFDL so that event handlers are placed directly underneath the collections they pertain to

Bug Fixes

• Amended algorithm which generates ETags so that if a query is issued which requests references etc then if the references have changed, the ETag will change
• Server-side JS as per the following example will now work as expected ff.getArrayFromUri(‘/SomeCollection?sort=createdAt desc’)
• Can now search for strings which contain quotes, using escape sequence \’ (bug #115)
• Fix to engine to deal with network i/o shortcoming of Java 1.7 on Mac OS X
• PEM creation bug fixed (bug #106)
• fatfractal.xml is now (re-)generated at deploy time (bug #114)
• AppLoader will now fail if a name for an event handler / extension / scheduled task used in the ffdl more than once (bug #117)
• Added learn mode support for arrays
• iOS: Bug fix for when a given requested object A refers to object B which refers to object A, and the client has autoLoadRefs == YES and neither A nor B have previously been fetched
• Server-side JS: Bug fix to registerUser function
• Client-side JS: Fixed isArray bug for Internet Explorer
• All SET commands from previous version of an app are now executed on startup. (Previously only those contained in application.ffdl were executed.) This is to ensure that SETtings that were amended dynamically are preserved by the backend. plus added method for dynamic FFDL execution
• Amended regex for collection / object type / member / handler / extension / etc names
• Guids must match a regular expression which specifically disallows spaces, brackets, semicolons and colons

Adds GeoLocation support: iOS and Android SDKs include the FFGeoLocation class; new FFDL member backend DATATYPE GEOLOCATION; new distance() operator in the query language

Adds support for offline operations: If the network is unavailable, iOS and Android SDKs can now queue CRUD operations to be executed when it becomes available again.

Adds PRE and POST event handlers: Event handlers are now configurable to run PRE (i.e. before the datastore has been updated – ideal for validation) or POST (after the datastore update, but before the response is sent to the client) as well as the existing ASYNC event handlers (which run asynchronously after the response has been sent to the client).

Adds HTTP caching: ETag response headers are now added when requests are made for specific objects or BLOBs

Adds Facebook integration: Users can register and login using their Facebook credentials. (iOS and Android SDKs)

Adds scheduled task (aka “cron”) integration: Serverside JavaScript can now be executed on a scheduled basis on your app’s backend – ideal for clearing out old data, running reports and so on.

Enhanced server-side javascript: Serverside JavaScript now CommonJS-compliant. Added functions to change passwords, send HTML email, add references, retrieve references. Native objects being passed between Java and JavaScript worlds rather than JSON resulting in a significant performance improvement.

Console: FIRST RELEASE of Console with functionality to allow users to administrate their domains and applications, as well as invite team members and issue/track support requests.

Data Browser: FIRST RELEASE of data browser with functionality to allow users to access their applications through a browser context, locally or in the cloud, to view, add, change and delete model components and data across collections and objects.

Minor Enhancements

Enhances security: Tightened up on password storage; even in local engine, passwords now stored as strong salted hashes.

Enhanced PERMIT command: PERMIT command syntax extended to make securing hierarchical object models a snap. Additionally, new keyword ‘loggedin’ added – for example you may wish to have some data visible to everyone on the Web, but some only visible to authenticated users of your app.

Adds configurable session timeout: User sessions can now be timed out after a certain interval.

Enhanced default validation and Learn Modes: AllowNewCollections, AllowNewObjectTypes, AllowNewMembers; member validation is done against everything which was defined in FFDL; members which have been “learned” will not be validated.

Enhanced FFDL: GRABBAG and REFERENCE members may now be constrained to be objects in specific collections (as opposed to any collection).

Added ‘can edit’ flag in responses: Allows clientside code to be aware if a particular object is modifiable by the current logged-in user.

Adds Cross-Origin-Resource-Sharing: Can now specify that Access-Control-Allow-Origin headers be sent in your HTTP responses.

Bug Fixes

A significant number of bugs that were reported internally and by our community (we thank you!) have been resolved with this release.