Add ISessionAttributeProvider interface

[Ryan J Ollos]

It was described in comment:15:ticket:11612 how arbitrary data can be stored in session attributes by editing the client-side JavaScript in the browser. The proposed solution is to add a new interface for registering session attributes:

class ISessionAttributeProvider(Interface):

    def get_session_attribute_names():
        """Return a list of supported names in session attribute."""

    def validate_session_attribute(name, value):
        """Validate the given attribute.""""

[Ryan J Ollos]

Narrowing focus for 1.1.4.

[Ryan J Ollos]

Milestone renamed

[Ryan J Ollos]

Two design considerations:

• The ExtensionPoint needs to be called on a Component class.
• The ISessionAttributeProvider needs to be implemented on a class in session.py to declare the basic fields such as name, email, and default_handler (though maybe default_handler should be moved to RequestDispatcher).

Which class is appropriate? The only Component class in session.py is SessionAdmin​. Adding the ExtensionPoint or implementing ISessionAttributeProvider on that class doesn't seem conceptually correct. Maybe it is okay for now though, until the session module grows additional functionality? We could add a new class, but what would it be called and what would be additional future responsibilities? Should it be SessionSystem?

[Ryan J Ollos]

Narrowing focus for milestone:1.2. Please move ticket to milestone:1.2 if you intend to fix it.

[Ryan J Ollos]

TODO look at whether we could expand the TracAdmin session set command to cover all session attributes. Maybe that will be easier to do by adding the right interface.

[Peter Suter]

(Another use case could be configuring XMPP addresses.)

[Ryan J Ollos]

Milestone renamed