The sickness of Zope


Wed 27 April 2005 By nuxeo

Zope is great, but there are some things that
are seriously annoying. Much of it comes from things showing their age.
There is lots of code that does things in particular and complicated ways
because of the need to behave the way things have always behaved, even if
that no longer makes much sense. Also, CMF has a couple of basic design
flaws, the biggest of them being portal_skins. So in this way, Zope3 will be
very welcome, as it rewrites things from the start, and does thing The Right
Way (tm).



But there is one thing that is not going to automatically be solved with
Zope 3: Peoples tendency in the Zope community to first of all do things
their own way, and secondly, not move these "own ways" into the common code
base, even if they could be of use to others.



I was hit by one of the more typical examples of this today: I need to have
permissions that i check dynamically. Usually in Zope, you protect methods
or objects with permissions, using the
"security.declareProtected(permission_name, method_name)" call. But
sometimes, which permission you want to check is dynamic. This is quite
possible to do, but first you then need the permission to exist, so you can
set up a role to permission mapping, and then check for the permission based
on what roles the user has.



And, it turns out, Zope has no method for creating permissions that are not
connected to a method or object or a class. I tried various ways and looked
through the code, and found nothing. I turned to Florent, and he pointed out
that there is a method to do this. In CMF....



CMF is, just like Zope, created and maintained by Zope Corp. And still,
this method, that belongs somewhere in the AccessControl module, is located
in CMFCore, where is has no business at all.



The examples of are numerous. The fact that most people use DCWorkflow as
the workflow with CMF wasn't reflected until recently, when CMF 1.5 came
out, and finally included DCWorkflow. And after much nagging (mostly from us
here at Nuxeo) Zope corp decided to include Stefan H Holeks excellent
ZopeTestCase product in Zope 2.8, so that is no longer is a pain in the ass
to write unit tests for Zope. Another good example are the almost infinite
number of user folders that exist. Only last year did Zope corp update come
up with a new user folder, instead of the default (and pretty much useless)
user folder. The new user folder is PAS, a pluggable, extensible user
folder.



And, if you expect it to be included in 2.8....ha! No, it's a separate
product. Of course. Meaning that every time somebody needs to use it, they
need to send an email to the Zope list and ask which of the different
extensible user folders they are supposed to use, since they found at least
4 of the when googling...



This all means that when you use Zope, you have to look all over the place
for the little thing that does what you want. There is no coherence, just a
sprawling spaghetti, and this in turn has the effect that the learning curve
for Zope never ends.



I don't know how to make sure this doesn't happen for Zope3, I guess we all
have to just make an extra effort to identify the things that are useful to
all, and make sure they end up in a place where everybody can find and use
them. codespeak.net has a z3-base
which is one effort to have a place for the things that are useful for many,
but shouldn't be in Zope3 itself. Having a place like that from the start
will at least help a bit. But the rest is up to us.




(Post originally written by Lennart Regebro on the old Nuxeo blogs.)


Category: Product & Development