[pubcookie-dev] login CGI templates

[Steve Losen]

I would like to suggest an enhancement for a future major release of
pubcookie.

I'm sure we all agree that the login cgi templates for the
login page, pinit response, status, etc., are rather clunky.
I think that with a little work, we could clean this up a lot.

In the login_templates directory we could coalesce lots of little
html "shreds" into just a few template files that are more
flexible and easier to maintain.

I did a project in perl a while back that used the HTML::Template
module.  Perhaps we could implement something similar in C for the
login CGI.  I would be willing to take a crack at coding it.

For those unfamiliar with HTML::Template, it uses syntax 
like this in its template files:

<TMPL_VAR name="variablename">

This corresponds to the pubcookie %variablename% syntax. In the
above example the value of variable "variablename" replaces the
TMPL_VAR tag.

The HTML::Template module also has some simple flow control tags:

<TMPL_IF name="varname">
  The value of varname is
  <font color="red"><TMPL_VAR name="varname"></font>
<TMPL_ELSE>
  This appears because varname has no value.
</TMPL_IF>

In the above example, if variable "varname" exists and is not the
null string, then the text between the TMPL_IF and TMPL_ELSE
tags is output, otherwise the text between TMPL_ELSE and </TMPL_IF>.
The else clause is optional.  These can be nested, of course.

You can include other template files with the
<TMPL_INCLUDE name="filename"> tag.

The perl module also has a TMPL_LOOP tag, for outputting the
rows of a table or items in a list.  I don't think that pubcookie
needs this functionality.  Besides, it depends heavily on perl data
structures.  In perl you pass the loop data as an array of hashes,
not an easy feat in C.

For our purposes, the variable names and values could be passed as
a variable length parameter list, like the current template expander,
or else passed as a "char **argv" style vector.

HTML::Template only lets you test if a variable exists and its value
is non-null.  I think that pubcookie templates need to also test
if a variable is equal to a particular string.  I propose this
optional extension to the TMPL_IF tag:

<TMPL_IF name="varname" value="testvalue">

With this capability we could put all of the error messages into a
template and print the correct one depending on the value of a variable.
I also suggest that we add a TMPL_ELSIF tag.  Here is how we could
clean up error messages:

<TMPL_IF name="error" value="BAD LOGIN">

  You entered an incorrect user name or password.
  Please try again and get it right this time.

<TMPL_ELSIF name="error" value="COOKIE EXPIRED">

  Your login cookie has expired.
  Don't you ever exit your browser?

<TMPL_ELSIF name="error" value="FORM EXPIRED">

  You didn't submit the login form quick enough.
  I haven't got all day, you know.

<TMPL_ELSIF name = "error">

  Oh my, a new pubcookie error.  Too bad I don't
  know what it means.

<TMPL_ELSE>

    Welcome to the pubcookie login service!

</TMPL_IF>

Here is another useful application.  In some cases we already know
the username field and do not want the user to be able to change it.
We want a hidden form field rather than a text field.

<TMPL_IF name="user">
  <input type="hidden" name="user" value="<TMPL_VAR name="user">">
  User name: <TMPL_VAR name="user">
<TMPL_ELSE>
  User name: <input type="text" name="user" size="20">
</TMPL_IF>

We could implement custom application login messages much more
cleanly.  We could pass the appid and appserver to each template
so that something like the following would be possible:

<TMPL_IF name="appid" value="MySpecialApp">
  Welcome to the special app.
<TMPL_ELSE>
  Welcome to Pubcookie.
</TMPL_IF>

Or if the custom page needs to be radically different:

<TMPL_IF name="appid" value="MySpecialApp">
  <TMPL_INCLUDE name="special.tmpl">
<TMPL_ELSE>
  <TMPL_INCLUDE name="standard.tmpl">
</TMPL_IF>

The point is, if we have slightly more intelligent templates and
we pass more information to them, then we won't need nearly as many
template files and most, if not all, of the logic can be specified
in the templates rather than in the CGI code.

We should be able to make these improvements:

o  move all the login_whatever shreds into the login template

o  coalesce the status template, pinit_response1, and pinit_response2
   into one template, since the pinit response and the status are
   very similar.

o  coalesce all the logout_whatever shreds into a single logout template

o  Eliminate the current support for custom application messages
   because the new template package would provide that functionality.

I'm willing to code this if there is any interest.  (Actually, after
thinking about it some I couldn't resist playing around with it a
little and I've gotten pretty far along.)

Again, this would be for a future major release.

Steve Losen   scl at virginia.edu    phone: 434-924-0640

University of Virginia               ITC Unix Support