amps s/b created before roles

[mustard57]

Roles contain amps, so s/b created first

--- a/deploy/lib/xquery/setup.xqy
+++ b/deploy/lib/xquery/setup.xqy
@@ -460,13 +460,13 @@ declare function setup:do-setup($import-config as element(
{
setup:create-ssl-certificate-templates($import-config),
setup:create-privileges($import-config),

• setup:create-amps($import-config),
  setup:create-roles($import-config),
  setup:create-users($import-config),
  setup:create-mimetypes($import-config),
  setup:create-forests($import-config),
  setup:create-databases($import-config),
  setup:attach-forests($import-config),
• setup:create-amps($import-config),
  setup:apply-database-settings($import-config),
  setup:configure-databases($import-config),
  setup:create-appservers($import-config),

[dmcassel]

To create an amp, the role and the database should already exist. I believe the current order is correct. Can you provide a test case where this doesn't work?

[grtjn]

Maybe circular references?

Sent from Samsung Mobile

[dmcassel]

sec:create-role() does not have a parameter for amps, but sec:create-amp() does have a parameter for roles. Seems to me that roles must come before amps.

[dmcassel]

In the absence of a test case, I'm closing this. If a test case can be provided, I'm happy to reopen it.

[mustard57]

Both

Take a look at setup:create-roles ( which Dave - maybe you wrote! ).

In create-roles

let $amps as element(sec:amp)* := $role/sec:amps/* ( line 3579 )
...
for $amp in $amps ( line 3687 )

     sec:amp-add-roles($namespace, $local-name, $document-uri,

$database, $role-name)', ( line 3698 )
(xs:QName("namespace"), $amp/sec:namespace,
xs:QName("local-name"), $amp/sec:local-name,
xs:QName("document-uri"), $amp/sec:document-uri,
xs:QName("database"), if ($amp/sec:database-name eq "filesystem")
then 0 else xdmp:database($amp/sec:database-name),
xs:QName("role-name"), $role-name),

Thus all the amps in

are being associated with the role, so all amps contained in the role
specification need creating before create-roles runs.

I would say that the documentation on sec:amp-add-roles

"Adds the roles ($role-names) to the list of roles granted to the amp
($namespace, $local-name, $document-uri)"

does not actually describe what this function does terribly well.

So in view of the above you do, in my view need to do sec:create-amps prior
to sec:create-roles

Note however that when defining an amp, you can define the roles with which
it runs, so arguably neither way round is perfect. However in practice, you
are more likely to allocate amps to roles ( in my opinion ) rather than the
other way round, at the application build level.

Ken

On 8 July 2014 16:35, David Cassel notifications@github.com wrote:

Closed #259 #259.

—
Reply to this email directly or view it on GitHub
#259 (comment).