- From: Jonas Sicking <jonas@sicking.cc>
- Date: Fri, 9 Aug 2013 14:02:49 -0700
- To: "public-script-coord@w3.org" <public-script-coord@w3.org>
Over the past few months a few of us at mozilla, with input from a lot of other people, has been iterating on a filesystem API. The goal of this filesystem API is first and foremost to expose a sandboxed filesystem to webpages. This filesystem would be origin-specific and would not allow accessing the user's OS filesystem. This avoids a lot of the security concerns around filesystem APIs. However it is expected that this API will eventually also be used for accessing real filesystems eventually, but there are a lot of security concerns that needs to be solved before we can create a real standard for that. Hence that is not the topic of this email. API summary: The proposed API introduces two new abstractions: A Directory object which allows manipulating files and directories within it, and a FileHandle object which allows holding an exclusive lock on a file while performing multiple read/write operations on it. The API intentionally reuses the already existing File abstraction as defined by [1] as we didn't want to have two different primitives for "a file". The File object has already been shipping in browsers for a while, so it's not an API that we expect to be able to make backwards incompatible changes to, which somewhat limits the design of the proposed filesystem API. Only adding two new abstractions was very intentional. We wanted to keep the API as small and simple as possible. So for example there is no abstraction for "a filesystem". Instead we simply let the root directory represent the filesystem. The API is entirely asynchronous since we don't expect implementations to be able to keep the whole filesystem in memory, and we don't want to force synchronous IO. But we've still tried to keep the API as friendly as possible. Detailed API: Apologies for using WebIDL here. I know it's not very popular with a lot of people on this list. And it's especially unfortunate in this API since the use of WebIDL to describe the API results in a lot of extra syntax in the description which doesn't actually affect the javascript that developers would write. Unfortunately I don't know of any other formal way of describing the API without spending tons of time typing up long descriptions of each function. partial interface Navigator { // This is what provides access to the sandboxed filesystem root. Promise<Directory> getFilesystem(optional FilesystemParameters parameters); }; interface Directory { readonly attribute DOMString name; Promise<File> createFile(DOMString path, CreateFileOptions options); Promise<Directory> createDirectory(DOMString path); Promise<(File or Directory)> get(DOMString path); AbortableProgressPromise<void> move((DOMString or File or Directory) path, (DOMString or Directory or DestinationDict) dest); AbortableProgressPromise<void> copy((DOMString or File or Directory) path, (DOMString or Directory or DestinationDict) dest); Promise<boolean> remove((DOMString or File or Directory) path); Promise<boolean> removeDeep((DOMString or File or Directory) path); Promise<FileHandle> openRead((DOMString or File) path); Promise<FileHandleWritable> openWrite((DOMString or File) path, OpenWriteOptions options); EventStream<(File or Directory)> enumerate(optional DOMString path); EventStream<File> enumerateDeep(optional DOMString path); }; interface FileHandle { readonly attribute FileOpenMode mode; readonly attribute boolean active; attribute long long? offset; Promise<File> getFile(); AbortableProgressPromise< ArrayBuffer> read(unsigned long long size); AbortableProgressPromise<DOMString> readText(unsigned long long size, optional DOMString encoding = "utf-8"); void abort(); }; interface FileHandleWritable : FileHandle { AbortableProgressPromise<void> write((DOMString or ArrayBuffer or ArrayBufferView or Blob) value); Promise<void> setSize(optional unsigned long long size); Promise<void> flush(); }; partial interface URL { static DOMString? getPersistentURL(File file); } // WebIDL cruft that's largely transparent enum StorageType { "temporary", "persistent" }; dictionary FilesystemParameters { StorageType storage = "temporary"; }; dictionary CreateFileOptions { CreateIfExistsMode ifExists = "fail"; (DOMString or Blob or ArrayBuffer or ArrayBufferView) data; }; dictionary OpenWriteOptions { OpenIfNotExistsMode ifNotExists = "create"; OpenIfExistsMode ifExists = "open"; }; enum CreateIfExistsMode { "replace", "fail" }; enum OpenIfExistsMode { "open", "fail" }; enum OpenIfNotExistsMode { "create", "fail" }; dictionary DestinationDict { Directory dir; DOMString name; }; enum FileOpenMode { "readonly", "readwrite" }; API Description: I won't go into the details about each function as it's hopefully mostly obvious. A few general comments: The functions on Directory that accept DOMString arguments for filenames allow names like "path/to/file.txt". If the function creates a file, then it creates the intermediate directories. Such paths are always interpreted as relative to the directory itself, never relative to the root. We were thinking of *not* allowing paths that walk up the directory tree. So paths like "../foo", "..", "/foo/bar" or "foo/../bar" are not allowed. This to keep things simple and avoid security issues for the page. Attempting to use a path that contains a segment that is equal to ".." or ".", or any path which starts with "/" will cause an error. This way we can add support for this later if desired. Likewise, passing a File object to an operation of Directory where the File object isn't contained in that directory or its descendents also results in an error. One thing that is probably not obvious is how the FileHandle.location attribute works. This attribute is used by the read/readText/write functions to select where the read or write operation starts. When .read is called, it uses the current value of .location to determine where the reading starts. It then fires off an asynchronous read operation. It finally synchronously increases .location by the amount of the 'size' argument before returning. Same thing for .write() and .readText(). This means that the caller can simply set .location and then fire off multiple read or write operations which automatically will happen staggered in the file. It also means that the caller can set the location for next operation by simply setting .location, or can check the current location by simply getting .location. Setting .offset to null means "go to the end". This is why there is no openAppend function. Calling openWrite and then setting .offset to null before writing results in an append. Note that getting or setting .offset does not need to synchronously call seek, or do any IO operations, in the implementation. Instead the implementation simply tracks .offset in the API implementation. Whenever a read or write operation is scheduled, the current .offset is sent along with the operation information to the IO thread and the seek can happen there. Many times the implementation can optimize out the seek entirely. The FileHandle class automatically closes itself as soon as the page stops posting further calls to .read/.readBinary/.write to it. This happens once the last Promise returned from one of those operations has been resolved, without further calls to .read/.readBinary/.write having happened. This is similar to IDB transactions, though obviously there are no transactional semantics here. I.e. there is no way to roll back any changes. Open Questions: There are a few things that we did have disagreements on and which would be worth debating. Is the setup around the FileHandle.offset attribute a good idea? Some people found it confusingly different from posix. Can we get rid of the the non-recursive remove() function. The removeRecusive() function has the same capabilities, except that removeRecusive doesn't produce an error if you attempt to delete a non-empty directory. Can we get rid of the copy() function? Copy operations are certainly common to expose in UIs, but they can be easily implemented programmatically, so having it in the API isn't strictly needed. Should we add an openAppend function which always appends for all writes. Note that since FileHandle always holds an exclusive lock on the file, there is no risk that other actors will append to the file as long as a FileHandle is being used. Finally, should we remove the Directory abstraction? It's not needed given that you can directly interact with files in subdirectories. But it does provide the ability to do some capability management. I.e. holding a Directory object enables you to interact with the files in that directory and its subdirectories, but there is no way to reach out to a parent directory. Directory objects also is a familiar concept in filesystem APIs, so it seems natural to have it even though it's not strictly needed. [1] http://dev.w3.org/2006/webapi/FileAPI/ / Jonas
Received on Friday, 9 August 2013 21:03:51 UTC