What you see is what you REST

[ctrekker]

Watch the presentation!

https://www.youtube.com/watch?v=xsxJt4prFG4

Try it out!

julia> ]
pkg> activate --temp
pkg> add https://github.com/ctrekker/Pluto.jl#wysiwyr2
julia> import Pluto; Pluto.run()

[lungben]

Awesome!

With this, one could build powerful micro-services with very little effort. Thinking about use cases e.g. in financial industry, it would be important to protect the notebooks, so that the user of the API cannot modify the notebook (i.e. the running microservice) itself.
For this, the following features would be great in my opinion:

1. The notebook should define which variables are modifyable with the API and which variables should be requestable. Possible syntax:

@listen a, b
@publish y, z

Variables not explicitly defined should not be accessible from the API. Maybe the default could be to listen / publish all variables, unless @listen / @publish is explicitly written in the notebook?

2. It should be possible to allow users access of the API without allowing them to open the notebook itself. This could e.g. be archieved by using different secrets.

[ctrekker]

Your first point makes a lot of sense! Not only would explicitly defining which variables users can change via the API (in production/deployment settings) enhance notebook protection, but it would also allow for further optimization since execution plans can be computed beforehand and only once.

For your second point, I was thinking about adding a configuration option which would allow users to run Pluto in an "API only" mode which would disable notebook editing and access features, restricting use to the API only. Perhaps this mode will also default to only serving "endpoints" defined by the @listen and @publish macros mentioned earlier and will otherwise fall back to serving all variables but give a warning message in the console about notebook security.

[lungben]

Is there a significant performance impact of having the REST API enabled?
Otherwise, I would suggest to enable it as default.

[ctrekker]

There isn't any performance impact, but right now there are zero security features at all. It's probably not a big deal though, so I will update that

[ctrekker]

The client functionality is now in a separate package https://github.com/JuliaPluto/PlutoRESTClient.jl. I haven't published it nor removed the client code from the PR yet though

[fonsp]

@ctrekker frontend tests are fixed on main!!! ✅✅✅