Building an UI

[bobmulder]

Hi guys,

First of all, thank you for all this stuff ;).

I would love to build an UI which is able to require dependencies, and update composer. I've done some research but can't find out how to do that... Can you inform me about:

• Is it possible to do this?
• Is it recommended to do this (or do you say it's a waste of time)?
• Are there currently people working on it?
• Are there people who would like to join?

Kind regards,

Bob

[alcohol]

What kind of UI? Like, ncurses, for CLI? Or a web based UI?

Assuming web based; while it sounds appealing to less tech-savvy users, it is not really a great idea. Composer works on a filesystem level, which is not something you really want to expose to the web. The permissions involved are too risky. I would definitely not recommend this on a production environment, ever. And for development, well, honestly I just don't really see any additional value here.

Maybe if you could elaborate a bit more on the use-case you have in mind, we might be able to provide more concrete feedback though?

[bobmulder]

@alcohol, thanks for your reply!

I'll explain my thoughts. I've been working with the php framework CakePHP. For that I am working on an admin-panel (plugin). From there you can manage your website (like crud stuff, settings, etc).
I was thinking (or dreaming) about a way to install CakePHP Plugins (dependencies loaded via Composer) via the browser. It's something like wordpress plugins. You want to install them within 1 mouseclick.

While realizing this, I would like to work on a tool that is allowed for all web based applications at first...

I really see your point about security... And it should be mainly used at production level, so that will be risky...

I would like to hear from you how you think about it ;)

If anything isn't clear, feel free to ask!

[alcohol]

Well first of all, I think it's smart asking for feedback rather than just diving in blind, so kudos for that.

I think often people, when trying to build implementations similar to what you are suggesting, they end up extending Composer. While initially this might seem like the best idea, I personally disagree. The internal API, while documented and somewhat stable, is not set in stone. Nor is it something you really want to depend on I think.

I personally believe it would be much safer to simply run Composer as a binary in the background, much like how other similar applications, such as cPanel, run Linux tooling. As a process. Wrap it using Symfony/Process for example. It's just a tool in your toolbox. They are just commands you want to fire off. You could even push them onto a message queue, and then have a server side process pick it up and execute it. This could help mitigate potential security risks, maybe. Also, since these can be long running processes, you most likely will want to run them in the background anyway.

[bobmulder]

Thank you very much! I think github / open source is meant for talks like these.

I see your point of executing a command instead of extending composer itself. However, in case we will execute commands including variables, we have to secure that as well.
Am I right you are refering me to the Simfony/Process-repo to use? I think it could be very helpfull...

What will we do? I can set up a project to try to achieve a basic code which can add dependencies, and from there we can look further?

You know, I think a feature like this could give a great pulse to composer and it's use. I agree it should be used mainly as development tool (so use it command-line), but I think this would be very useful to extend the use of it...

[bobmulder]

@alcohol I've put something on GitHub to test with processes, and using dependencies. What do you think about this?

https://github.com/bobmulder/composer-ui

It just works, but I haven't done anything regarding to security, docs or tests, so don't blame me for this ;).

I would like to get some feedback or directions, and I'll continue this prototyping.

The idea is that I'll start working on the helper, so the main actions (like update, require, remove) are available. After that I'll work on the UI itself. Maybe we should split the helper from the ui in future...

I'm looking forward to your feedback!

[Seldaek]

Closing as this isn't really an issue, but feel free to continue discussing if needed.