Hi Rocky,
There is definitely a lot here to cover. To start, take a look at https://docs.q2developer.com/guides/networking/web_requests.html#third-party-services .
I will address most of your points with my understanding of using the Q2 ecosystem thus far. Heads up, lots of docs incoming...
- Yes, the docs linked above are a great starting point, then https://docs.q2developer.com/tutorials/online_banking/q2_requests.html?highlight=q2_requests for an implementation example, and finally, https://docs.q2developer.com/api_references/q2_sdk/core/q2_requests.html?highlight=q2_requests#module-q2_sdk.core.q2_requests for module docs. Definitely take note of the "Allow list" notes in the docs. Basically, you need to let Q2 know what endpoints your logic plans to hit in production if it is an external resource, everything is blocked by default.
q2_requestsshould handle this for you. It is built on top of https://docs.python-requests.org/en/master/- The requests library should support this: https://2.python-requests.org/en/master/user/advanced/#ssl-cert-verification and q2 provides Vault storage: https://docs.q2developer.com/guides/performance_and_security/vault.html?highlight=vault
- https://2.python-requests.org/en/master/user/advanced/#timeouts provides some "best practice" for timeouts using the library.
- Sorry, I don't have a definitive answer on this one. Someone from Q2 may be able to answer this definitively.
- Q2 has a built in memcache service baked in: https://docs.q2developer.com/tutorials/online_banking/caching.html?highlight=cache that you could leverage for this perhaps, using the online user id as part of the key and having it live for a short duration then check it on POST?
I hope that this helps you on your journey. Honestly, the fact that you are asking these questions is great, and you are on the right track to secure and efficient extensions. Good luck!
Dan's answer is excellent. For number 5, I suppose you come from a C# .NET background. Python does support cancellation of async functions. It works a bit different from C#, so I suggest reading up on how aync functions work in Python to understand this, I would start here and continue looking through the documentation to find what you are looking for: https://docs.python.org/3/library/asyncio-task.html
That's not entirely true, if you were running a bunch of simultaneous async tasks with something like asyncio.gather(), you could indeed call .cancel on the remaining tasks in the list. It's just that level of optimization is not something we typically deal with at our level. If you run into a use case that needs it, please ask another question here!
—I couldn't post this as a comment, since I exceeded 600 character, so writing this as an answer instead to Trey Teter's answer.
"Python does support cancellation of async functions," does that mean Q2 already make use of cancelling async functions for extensions? If so, do I need to write code in such ways to allow that to happen to my extension code so my extension code doesn't need to continue if its been cancelled? Or does Python already take care of that for us?
I plan to have some extension that may have various requests to vendor parties, that could take several seconds to complete.
Like I say I create an extension with python code as following (not using asyncio.gather)
async def default(self):
await DO_REALLY_TIME_CONSUMING_REQUEST1() #take 53 second to complete. Has 2 more child tasks.
await DO_REALLY_TIME_CONSUMING_REQUEST2() #take 85 second to complete, depends on #1 to be completed. Has 2 more child tasks and one grand-child task in one of the child task.
await DO_REALLY_TIME_CONSUMING_REQUEST3() #take another 53 second to complete, depends on #2 to be completed.
await DO_REALLY_TIME_CONSUMING_REQUEST4() #take 5 minute to complete, depends on #3 to be completed.
My question is, would those tasks at the scope AND all of their child tasks in those methods be cancelled automatically if default() was given asyncio.cancel?
Going to make up a scenario, If I make a request to that endpoint, Q2 then calls that extension method, my browser thinks one minute is too long and it decides to times out the network request which ultimately cancels the request- does Q2 or Python AUTOMATICALLY cancel those pending await calls thats not yet completed, even their child tasks? Does Python automatically cancel the cascading those asyncio-tasks all the way to their children tasks, or do I need to use a token cancellation variable to cancel their child tasks if parent task got cancelled?