Protected API endpoint for running ml5.js example upload script

[bomanimc]

Hi!

@catarak, thanks for your help reviewing and debugging #1762!

The majority of or ml5.js PR contributions are to our examples. Our examples are hosted on a custom website but are primarily viewed using the p5.js Web Editor. To support more rapid deployment of example changes, it'd be helpful to be able to update the public examples on the p5.js Web Editor as soon as we merge in new contributions. The upcoming Public API for the p5.js Web Editor will solve this, but until it's released, uploading new scripts to the p5js Web Editor requires someone from the ml5.js team typically will need to contact @catarak (or another person with server access to the p5.js web editor) to run the script on the production servers.

In the interim period prior to the launch of the Public API, one idea I wanted to propose was adding a password-protected endpoint to the p5.js Web Editor server (i.e. /upload-ml5-examples) that simply runs the upload script we revised in #1762. A few considerations I thought of regarding this approach:

Pros

• Give the ml5.js team a way to update the p5.js web editor scripts on a more frequent basis without adding more work to @catarak's plate!
• Fairly lightweight stop-gap solution that can easily be deleted when the Public API is released in the future since the endpoint will have very few users.

Cons

• It may be too much of a special case that potentially sets a precedent for an approach to running server-side scripts that would be best to avoid long-term.
• Possible risk of the endpoint credentials getting leaked and too many requests being sent to the p5 web editor servers that run this (presumably) heavy script.
  • This could be addressed by adding a rate limiter on the endpoint and ensuring that the credentials are only shared with a few primary software maintainers on the ml5.js team.

What do others think? The cons here are valid, so I totally understand if it'd be preferable not to move forward with this change. If this idea sounds good though, I'd be happy to submit a PR for this change!

[welcome]

Welcome! 👋 Thanks for opening your first issue here! And to ensure the community is able to respond to your issue, be sure to follow the issue template if you haven't already.

[catarak]

Thanks for the suggestion and thinking this through! I think this would be a great way to test the API in production, and get some feedback on the interface and its stability.

There's actually no code changes that would need to happen—I think that I would just need to generate an API token for you, which then could be revoked at any time, or I could generate a new one if need be. Sound good?

[bomanimc]

@catarak that sounds great to me!

[bomanimc]

@catarak Coming back around to this! To confirm, would the idea here be to hit some of the common endpoints that you've defined (like /sketches) and write code in the ml5.js repo that handles pulling the files down from GitHub, etc (similar to the code we have on the web editor). Initially, I had thought that for this issue a way to address this by adding an API route (something like /fetch-ml5-examples) that would run the script that's in the editor codebase from #1762, but I'm happy to go with the /sketches approach!

[catarak]

Sorry for the delay in getting back to you! I was on a GitHub hiatus but now I am back :) The idea is that you would hit the endpoints on the p5.js Editor API so that ml5.js team could manage updating the examples and the uploading script rather than me. Does that makes sense?