问:
What architecture should I use for my game entities?
I am working on my final year project and making a multi player game. It's a tank battle game.

In the client basically we will have 2 types of Tank. One will be controllable by the keyboard and other will be the one's which are enemy tank's and not controllable. Enemy tank's position will change depending on when it gets data from the server about change in position.

Every tank will have a Turret which will be used to fire Bullets and missile. It will also store ammunition details. Now for the user's tank we will need turret which can be rotated by the keyboard independently as well as it will move when the tank moves. Enemy tank's turret can't be controlled by us obviously and will only rotate and move when we get update from the server to do so.

Now this brings me to a lot of confusion about how to go on designing this. My current model design is as follows.

I have done a UML Diagram after a long time so there may be some errors.

One of the problem I am having is with the turret. A turret on enemy tank should effectively now have all those firePrimary(), fireSecondary() methods as we will never invoke them. If an opponent fires a bullet server will send a message and I will just spawn a missile.

A turret on user tank should have all these methods as we should be able to fire bullets from it. Now my confusion is if I implement shootable on Turret base class then I will get those methods like firePrimary() and fireSecondary() on EnemyTank which will be useless. If I rather than implementing the Shootable interface compose the UserTurret with Shootable then it will break my architecture of having an abstract class Turret in Tank and passing in either UserTurret or EnemyTurret.

BasicShootable and HeavyShootable implementations are mainly for spawning different kinds of bullets.

If this is not correct what can be the best way to do it so that I don't have useless methods in various classes and I can expand the game entities further if I want adding more behaviour to my tanks or turrets on the fly.

Note: this is a follow-on to my previous question: Should I use strategy design pattern or something else?

答:
This is a follow-on to your previous question, and this is a case for using a strategy. Your tanks should all expose the same functionality, but use a different driver or input. Player tanks would use user input, while enemy tanks would use AI.

Turrets can have different capabilities as well, and I believe your design captures this correctly. You have a common interface or parent class, with the player subclass offering the extra complexity of having additional child components.

There are several ways to implement this, but the general idea looks something like this:

```<code>class TankDriver {
  abstract void move(Tank t);
}

class PlayerTankDriver {
  ...
}

class AiTankDriver {
  ...
}

class Tank {
  TankDriver driver;

  Tank(TankDriver d) {
    driver = d;
  }

  void move() {
    d.move(this);
  }
}
</code>```

The general use case is you specify the driver strategy when you construct a tank, then keep a reference around for the tank. When it is the tank's turn to move, you tell it to move: it delegates to its strategy, which is implementation-defined. It is flexible because it can further query the user or use any AI you want: one enemy tank could be very aggressive, another could be more risk-adverse. One might use a lookahead algorithm with a very deep tree, another might just look ahead one move (i.e. the difficulty is different).

The point is, you still only need a single tank class because the pluggable logic is in in other classes that have a laser focus on one aspect of what it means to be a tank.

Finally, there is the issue that the turret on a player tank may have different methods exposed than on an AI-controlled turret. This can get into a weird three-way dependency that is a bit tightly coupled, and there are multiple ways to address it.

This is a tough nut to crack in a way that keeps your design reasonable while also satisfying your professor's goal of having a "proper" OO design.

I think the best way to accomplish this in a true OO fashion is to keep the design you have with the turret belonging to the tank, and to expose a subset of turret functionality on the tank itself which it then forwards to the actual turret. This is not how I would design it in a real-world scenario most likely, but it has advantages:

It satisfies the Law of Demeter which basically states you have driver → tank → turret, and driver should not "reach through" tank to get at turret.

It avoids a messy triangle issue where the driver, tank and turret have a nonlinear dependency which can complicate construction, usage, and referential integrity. For example, you might have a driver have a tank and turret, and the tank has a different turret than the driver. This would be a bug.

It avoids or simplifies generics/templates which may be employed to allow the tank to tell its driver what type of turret to expect, given that tank is a general-purpose class.

But wait, now the tank has to know the turret's interface and expose only those methods that make sense! That goes against the point of using composition like this!

I recommend exposing all turret methods and have nonsensical ones simply do nothing. Again, not quite ideal, but it will make your professor happy because of the Law of Demeter.

Pseudocode for forwarding turret requests through the tank:

```<code>interface Turret {
  void firePrimary();
  void fireSecondary();
  // and the other methods in your diagram.
}

class Tank {
  Turret turret;

  Tank(Turret t) {
    turret= t;
  }

  void firePrimary() {
    t.firePrimary();
  }

  void fireSecondary() {
    t.fireSecondary();
  }
}
</code>```

You could have Tank implement the Turret interface, that is up to you. It can be convenient, but can potentially allow Tank to be misused:

Tank has-a turret, so it makes sense from an OO perspective that you can tell a tank to do "turret stuff" and it will pass those commands through.

One could misuse tank by adding another tank as its turret: tank → tank → turret, which is nonsensical. Having compile-time protection against this misuse by using the static type system is a good thing.

There are arguments for and against tank implementing turret, or having the tank return its turret for the driver to use. What you will learn is there is no one correct way to design and implement this: there are only tradeoffs. On one end of the spectrum you have "pure" OO which is what your professor is likely trying to teach you. On the other end of the spectrum are you "mostly" OO designs that have little fudges here and there to make life easier. This is a bit of a tangent, but I bring this up because this is an assignment and you will see real-world projects design more toward the "practical" end of the spectrum not the "theoretical" end.

I wrote up an answer to a different question which you might find helpful. The AI and user input approaches will necessarily require different inputs, making the example above a bit more complex (it is still a good start). If you look at the question/answer I linked you might learn a bit more about this approach.

Body:
This is a follow-on to your previous question, and this is a case for using a strategy. Your tanks should all expose the same functionality, but use a different driver or input. Player tanks would use user input, while enemy tanks would use AI.

Turrets can have different capabilities as well, and I believe your design captures this correctly. You have a common interface or parent class, with the player subclass offering the extra complexity of having additional child components.

There are several ways to implement this, but the general idea looks something like this:

class TankDriver {
  abstract void move(Tank t);
}

class PlayerTankDriver {
  ...
}

class AiTankDriver {
  ...
}

class Tank {
  TankDriver driver;

  Tank(TankDriver d) {
    driver = d;
  }

  void move() {
    d.move(this);
  }
}

The general use case is you specify the driver strategy when you construct a tank, then keep a reference around for the tank. When it is the tank's turn to move, you tell it to move: it delegates to its strategy, which is implementation-defined. It is flexible because it can further query the user or use any AI you want: one enemy tank could be very aggressive, another could be more risk-adverse. One might use a lookahead algorithm with a very deep tree, another might just look ahead one move (i.e. the difficulty is different).

The point is, you still only need a single tank class because the pluggable logic is in in other classes that have a laser focus on one aspect of what it means to be a tank.

Finally, there is the issue that the turret on a player tank may have different methods exposed than on an AI-controlled turret. This can get into a weird three-way dependency that is a bit tightly coupled, and there are multiple ways to address it.

This is a tough nut to crack in a way that keeps your design reasonable while also satisfying your professor's goal of having a "proper" OO design.

I think the best way to accomplish this in a true OO fashion is to keep the design you have with the turret belonging to the tank, and to expose a subset of turret functionality on the tank itself which it then forwards to the actual turret. This is not how I would design it in a real-world scenario most likely, but it has advantages:

It satisfies the Law of Demeter which basically states you have driver → tank → turret, and driver should not "reach through" tank to get at turret.

It avoids a messy triangle issue where the driver, tank and turret have a nonlinear dependency which can complicate construction, usage, and referential integrity. For example, you might have a driver have a tank and turret, and the tank has a different turret than the driver. This would be a bug.

It avoids or simplifies generics/templates which may be employed to allow the tank to tell its driver what type of turret to expect, given that tank is a general-purpose class.

But wait, now the tank has to know the turret's interface and expose only those methods that make sense! That goes against the point of using composition like this!

I recommend exposing all turret methods and have nonsensical ones simply do nothing. Again, not quite ideal, but it will make your professor happy because of the Law of Demeter.

Pseudocode for forwarding turret requests through the tank:

interface Turret {
  void firePrimary();
  void fireSecondary();
  // and the other methods in your diagram.
}

class Tank {
  Turret turret;

  Tank(Turret t) {
    turret= t;
  }

  void firePrimary() {
    t.firePrimary();
  }

  void fireSecondary() {
    t.fireSecondary();
  }
}

You could have Tank implement the Turret interface, that is up to you. It can be convenient, but can potentially allow Tank to be misused:

Tank has-a turret, so it makes sense from an OO perspective that you can tell a tank to do "turret stuff" and it will pass those commands through.

One could misuse tank by adding another tank as its turret: tank → tank → turret, which is nonsensical. Having compile-time protection against this misuse by using the static type system is a good thing.

There are arguments for and against tank implementing turret, or having the tank return its turret for the driver to use. What you will learn is there is no one correct way to design and implement this: there are only tradeoffs. On one end of the spectrum you have "pure" OO which is what your professor is likely trying to teach you. On the other end of the spectrum are you "mostly" OO designs that have little fudges here and there to make life easier. This is a bit of a tangent, but I bring this up because this is an assignment and you will see real-world projects design more toward the "practical" end of the spectrum not the "theoretical" end.

I wrote up an answer to a different question which you might find helpful. The AI and user input approaches will necessarily require different inputs, making the example above a bit more complex (it is still a good start). If you look at the question/answer I linked you might learn a bit more about this approach.


问:
How do I manage state better in front-end tests
I write a lot of front-end tests, and the tests fail really often. To be honest, they're hard for me to write. I feel like I have to do a lot of work keeping track of the state of the page. It seems like every function I write is the opposite of a pure function. There are so many side-effects. I get stale reference exceptions and null pointer exceptions all the time.

For example, I say comment.clickLike(), but I'm no longer on the page containing that comment (stale reference).

Or I'll say findElement(".comment:eq(0)").clickLike(), and I'll get a NPE because I'm no longer on the page so I end up not finding the comment.

There are other factors too. findElement(".comment:eq(0)").clickLike() could fail because one of the front-end devs decided to change the class of comments to post-comment or something.

What are some good practices to make the tests I write safer? Is there a way to design page-object interactions that makes them have less side effects? Is there a way to find objects on the page even if their selectors change over time?

答:
There are a number of possible strategies that you can employ.

Reset the page so that your test is always starting at the same page state.

Reduce the number of state transitions you make on the page.

Push as much application logic as you possibly can out of the page to somewhere else.

ContentLicense: CC BY-SA 3.0


问:
How do I balance 100 clients checking the same database table in a loop?

What I have

This is a prototype. I have a pool of 100 clients connected to the server via websockets reporting things and awaiting for commands. The server polls the commands database table of type MEMORY in a loop using a query with WHERE client_id=?. I can insert a combination of client_id+command to that table, and once I do that, the corresponding loop will match and SELECT it and pass it back to the client.

What's the problem

The approach sounds like it would work, but as far as I understand I'm talking about n simultaneous database connections and queries in an endless loop (n being the number of clients), which doesn't sound effective. It'd be much better to do one query in one loop and then somehow check the client_id, if any, and distribute the results to the corresponding clients.

This reminds me of the approach where you're selecting articles first and then for () {} the resultset and do separate queries to get the details foe each of the items, which results in n+1 queries being made. The solution to that is doing a big query with JOINs and also preloading the other data that doesn't fit into the main JOINed query. There should be the similarly more effective way to do the database polling too.

UPDATE: I found this answer in the related section, and it says pretty much the same thing:

Hammering your database isn't really a good idea. While I'm pretty sure you've realized this, others might not have. I remember a friend of mine tried to use a php script and a Javascript AJAX function in a loop for a semi-real time game. He very quickly realized that performance degraded as more people joined, simply because he was executing a ton of queries per second which hammered the database.

So polling the database for each client sounds as unscalable and ineffective as building an AJAX chat application.

What I'm asking for

I guess that every possible programming approach must have been named and covered by now, so what is this one called? What is the common advice/approach here?

答:
Ideally you should be pushing to your websocket (through a http request or any queue mechanism as mentioned in the other answers) server at the time the writes happen to the database. That way you can completely avoid polling the database.

If you have no other go but to use the database, then execute one query which will get the information for all the clients. This will help you avoid writing queries in a loop. In your application you can seperate out the data for each client and emit through websockets.


问:
Using ORMs in two separate programs which share a DB
I have an application that is divided into two main parts:

A web crawler written in Python

A REST API written in Golang

They share a MySQL database, which is mainly populated/updated by the web crawler, and then read from by the REST API.

I wanted to use an ORM on each side to make interacting with the database easier, but now I am not sure if this is a good approach.

On the Python side, I was looking at using peewee, and for Golang I will use gorm.

It doesn't seem like a good idea to maintain two sets of ORM model files, where I would have to change each set whenever I want to change some attributes of the database.  Additionally, I am worried that with two ORMs battling for structure of the database, that conflicts might arise, or the models might become out of sync with what the actual db structure is.

Is this a scenario where using an ORM will cause more trouble than its worth?  Or maybe I should use a single ORM (for either Python or Golang) and write raw queries for the other side.

答: I think it is okay to have two sets of ORM if you think it will make your life easier in terms of build the applications. Think of it this way without the ORM as well you will need to change the queries in both applications if you make some database schema changes etc. So I won't count that to be a huge issue. As long you as can gain productivity by using ORM on both applications it should be okay.</p>


答:
You have asked the wrong question. The right question is "Should I use a database table to implement a queue?" and the answer is NO. Use a robust distributed queueing implementation like Kafka.

Or your database may have a built-in queueing mechanism. Oracle does. Tom Kite devotes a page or two in one of his Oracle books describing why you should not use a database table as a queue.

Title: How do I balance 100 clients checking the same database table in a loop?

Body:
What I have

This is a prototype. I have a pool of 100 clients connected to the server via websockets reporting things and awaiting for commands. The server polls the commands database table of type MEMORY in a loop using a query with WHERE client_id=?. I can insert a combination of client_id+command to that table, and once I do that, the corresponding loop will match and SELECT it and pass it back to the client.

What's the problem

The approach sounds like it would work, but as far as I understand I'm talking about n simultaneous database connections and queries in an endless loop (n being the number of clients), which doesn't sound effective. It'd be much better to do one query in one loop and then somehow check the client_id, if any, and distribute the results to the corresponding clients.

This reminds me of the approach where you're selecting articles first and then for () {} the resultset and do separate queries to get the details foe each of the items, which results in n+1 queries being made. The solution to that is doing a big query with JOINs and also preloading the other data that doesn't fit into the main JOINed query. There should be the similarly more effective way to do the database polling too.

UPDATE: I found this answer in the related section, and it says pretty much the same thing:

Hammering your database isn't really a good idea. While I'm pretty sure you've realized this, others might not have. I remember a friend of mine tried to use a php script and a Javascript AJAX function in a loop for a semi-real time game. He very quickly realized that performance degraded as more people joined, simply because he was executing a ton of queries per second which hammered the database.

So polling the database for each client sounds as unscalable and ineffective as building an AJAX chat application.

What I'm asking for

I guess that every possible programming approach must have been named and covered by now, so what is this one called? What is the common advice/approach here?


问:
TDD/BDD: Mocks with expectations: bad?
Is using mocks in the following way a bad idea:

writing tests where mocks expect certain calls from the subject under test

Or even just writing mocks that return values to the subject under test if/when requested

Reason for my doubts: It ties down the SUT to an implementation, since the tests would need to change when the SUT's implementation changes, even if its required behaviour is the same.

I see one alternative: Just pass the SUT the actual collaborating objects it will be working with. So as the implementations change of both, the tests will need fewer changes and still be valid.

Of course there will be times when to thoroughly test an object, it needs to be fed contrived information from the objects it depends on, in which case mocking frameworks might make sense, but still often might be overkill compared to writing test objects that extend an interface common with those collaborators.

Am I missing a benefit of using mocks? Is my above reasoning sound, or should I be using mocks in the above situations for a reason I haven't understood?

答:
Perhaps this is why giving mocks with expectations isn't bad:

When the sole purpose of the SUT Foo is to manipulate other objects (X and Y) in a certain way.

Writing mocks with expectations within a test serves as documentation of how the SUT is expected to manipulate the objects it calls.

If you were to write a test for yet another subject Bar which requires the above SUT, Foo, and you had to set up the SUT with its collaborators, X and Y, you may not care what Foo does with X and Y them since you are only trying to test Bar, but you may still need to know what Foo is doing with X and Y in order to give Bar the context it needs to be testable.

Although that would start being a very messy test, obfuscating the purpose, which is to test Bar. In which case, Foo should probably be mocked/stubbed/faked/dummied and passed to Bar.

Title: TDD/BDD: Mocks with expectations: bad?


答:
You are right that tests would need to change when the implementation changes. However, the value of your tests is that because the behaviour of the system under test does not change your tests will still be valid. What your class does should not change, but how your class does it can. Your tests will help you when you need to rewrite (a part of) the class.

Also, 'writing test objects that extend an interface common with those collaborators' IS mocking (or stubbing). Just because you are not using a mocking framework does not mean it's not mocking.

As a side note: I've seen implementations change because we wanted to optimize them (extract common code, reduce complexity, etc...) but I haven't come across many situations where a changing requirement causes heaps of test code to become obsolete, but a class and its output remains relevant. Think of the O in SOLID: open for extension, closed for modification. Adding functionality or behaviour doesn't mean you should always rip out the internals of the code and completely rewrite it.

Title: TDD/BDD: Mocks with expectations: bad?

Body:
Is using mocks in the following way a bad idea:

writing tests where mocks expect certain calls from the subject under test

Or even just writing mocks that return values to the subject under test if/when requested

Reason for my doubts: It ties down the SUT to an implementation, since the tests would need to change when the SUT's implementation changes, even if its required behaviour is the same.

I see one alternative: Just pass the SUT the actual collaborating objects it will be working with. So as the implementations change of both, the tests will need fewer changes and still be valid.

Of course there will be times when to thoroughly test an object, it needs to be fed contrived information from the objects it depends on, in which case mocking frameworks might make sense, but still often might be overkill compared to writing test objects that extend an interface common with those collaborators.

Am I missing a benefit of using mocks? Is my above reasoning sound, or should I be using mocks in the above situations for a reason I haven't understood?


问:
How to tell whether your programmers are under-performing?
I am a team lead with 5+ developers. I have a developer (let's call him A) who is a good programmer, who writes good clean, easy to understand code. However he is somewhat difficult to manage, and sometimes I wonder whether he is really under-performing or not.

Our company requires the developers to indicate the work progress in the bug tracker we use, not so much as to monitor the programmers but to keep the stakeholders apprised of the progress. The thing is, A only updates a task progress when it is done ( maybe 3 weeks after it is first worked on) and this leaves everyone wondering what is going on in the middle of the development week. He wouldn't change his habit despite repeated probing. ( It's OK, developers hate paperwork, I do, too)

Recent 2-3 months he on leave quite often due to various events-- either he is sick, or have to attend a lot of personal events etc. ( It's OK, bad things happen in a string. It's just a coincidence)

We define sprints, or roadmaps for each month. And in the beginning of the sprint, we will  discuss the amount of work each of the developers have to do in a sprint and the developers get to set the amount of time they need for each task. He usually won't be able to complete all of them. (It's OK, the developers are regularly missing deadlines not due to their fault).

I am based in Singapore. Not sure if that matters. Yeah, Asians are known to be reticent, but does that matter?

If only one or two of the above events happen, I won't feel that A is under-performing, but they all happen together. So I have the feeling that A is under-performing and maybe-- God forbid--- slacking off.

This is just a feeling based on my years of experience as programmer. But I could be wrong.

It is notoriously hard to measure the work of a programmer, given that not all two tasks are alike, and there lacks a standard objective to measure the commitment of a programmer to your company. It is downright impossible to tell whether the programmer is doing his job or slacking off. All you can do, is to trust them-- yeah, trusting and giving them autonomy is the best way for programmers to work, I know that, so don't start a lecture on why you need to trust your programmers, thank you every much-- but if they abuse your trust, can you know?

Outcome:

I've a straight talk with him regarding my perception on his performance. He was indignant when I suggested that I had the feeling that he wasn't performing at his best level. He felt that this was a completely unfair feeling. I then replied that this was my feeling and I didn't know whether my feeling was right or not. He would have none of this and ended the discussion immediately.

Before he left he said that he "would try to give more to the company" in a very cold tone. I was taken aback by his reaction. I am sure that I offended him in some ways. Not too sure whether that was the right thing to do for me to be so frank with him, though.

My question is: How can you tell whether your programmers are under-performing? Surely there are experience team leads who know better than me on this?

Extra notes:

I hate micromanaging. So all that we have for our software process is Sprint ( where tasks get prioritized and assigned, and at the end of the month, a review of the amount of work done). Developers would require to update the tasks as they go along everyday.

There is no standup meeting, or anything of the sort. Mainly because we have the freedom to work from home and everyone cherishes this freedom.

Although I am the one who sets the deadline, but the developers will provide the estimate for each tasks and I will decide-- based on the estimate-- the tasks that go into a particular sprint. If they can't finish the tasks at the end of the sprint, I will push them to the next. So theoretically one can just do only 1 or 2 tasks during the whole sprint and then push the remaining 99 tasks to the next sprint and still he will be fine as long as justifies this-- in the form of daily work progress updates

答:
These are my suggestions:

Innovation: Imagination and creativity used to lower costs and improve the current situation.

Corporation: Willingness to help others accomplish their objectives

Initiative: Attempting non-routine jobs and tasks.

Attendance: Absences or lateness, Below standards.

Alertness: Ability to quickly understand new information and situations

Accuracy and Quality: Code reviews, delivering on time, issue rate).


答:
I can answer your questions concisely: No and no.

One of the tenets of good tests is that they should be repeatable (FIRST principles) so having a mock that behaves in a consistent way is not only desirable, but necessary.

There are unit testing frameworks (such as NUnit) that provide a way to produce N calls to methods with random values but I would suggest that these are used sparingly with tests at the limits of the known values (or with other pertinent business rules) being preferred instead.

There is of course a place for such tests - especially when the range of values is vast, but this should be conducted outside the usual unit test run sphere (test runs should be fast) - perhaps as an integration or soak test.

Title: TDD/BDD: Mocks with expectations: bad?


问:
Role vs Permission Based Access Control
I'm trying to understand the inherent tradeoff between roles and permissions when it comes to access control (authorization).

Let's start with a given: in our system, a Permission will be a fine-grained unit of access ("Edit resource X", "Access the dashboard page", etc.). A Role will be a collection of 1+ Permissions. A User can have 1+ Roles. All these relationships (Users, Roles, Permissions) are all stored in a database and can be changed on the fly and as needed.

My concerns:

(1) What is so "bad" about checking Roles for access control? What benefits are gained by checking for permissions instead? In other words, what's the difference between these two snippets below:

```<code>if(SecurityUtils.hasRole(user)) {
    // Grant them access to a feature
}

// vs.
if(SecurityUtils.hasPermission(user)) {
    // Grant them access to a feature
}
</code>```

And:

(2) In this scenario what useful value do Roles even provide? Couldn't we just assign 1+ Permissions to Users directly? What concrete value of abstraction do Roles offer (can someone give specific examples)?

答:
(1) What is so "bad" about checking Roles for access control? What
  benefits are gained by checking for permissions instead?

At the moment of checking, the calling code only needs to know "does user X have permission to perform action Y?".

The calling code does not care about and should not be aware of relationships between roles and permissions.

The authorization layer will then check if the user has this permission, typically by checking if the user's role has this permission. This allows you to change authorization logic without updating the calling code.

If you directly check for role at the call site, you are implicitly forming role ⇄ permission relationships and injecting authorization logic into the calling code, violating separation of concerns.

Should you later decide that role foo should not have permission baz, you would have to change every code which checks if the user is a foo.

(2) In this scenario what useful value do Roles even provide? Couldn't
  we just assign 1+ Permissions to Users directly? What concrete value
  of abstraction do Roles offer (can someone give specific examples)?

Roles conceptually represent a named collection of permissions.

Let's say you are adding a new feature which allows a user to edit certain settings. This feature should be available to administrators only.

If you are storing permissions per user, you would have to find all users in your database which you somehow know are administrators (If you're not storing role information for users, how would you even know which users are administrators?), and append this permission to their list of permissions.

If you use roles, you only have to append the permission to the Administrator role, which is both easier to perform, more space efficient, and is less prone to mistakes.

Title: Role vs Permission Based Access Control


答:
In response to your first question, the biggest issue with checking that a user has a role rather than a specific permission, is that permissions can be held by multiple roles. As an example to this, a developer might have access to see the developer portal on the company intranet, which is probably also a permission held by their manager. If a user is then attempting to access the developer portal, you'd have a check similar to:

```<code>if(SecurityUtils.hasRole(developer)) {
    // Grant them access to a feature
} else if(SecurityUtils.hasRole(manager)) {
    // Grant them access to a feature
} else if...
</code>```

(A switch statement in your language of choice would be better, but still not particularly tidy)

The more common or widely held a permission is, the more user roles you would need to check to ensure that someone is able to access a given system. This would also lead to the issue that every time you modify permissions for a role, you would need to modify the check to reflect this. In a large system this would become very unwieldy very quickly.

If you simply check that the user has the permission that allows them access to the developer portal for example, it doesn't matter what role they hold, they will be granted access.

To answer your second question, the reason you have roles is because they act as easy to modify and distribute "packages" of permissions. If you are have a system that has hundreds of roles and thousands of permissions, adding a new user (for example a new HR manager) would require you to go through and give them every single permission that other HR managers hold. Not only would this be tedious, but it is prone to mistakes if done manually. Compare this to simply adding the "HR manager" role to a user's profile, which will grant them the same access as every other user with that role.

You could argue that you could simply clone an existing user (if your system supported this), but while this does grant the user the correct permissions for that moment in time, attempting to add or remove a permission for all users in the future may be difficult. An example scenario for this is if maybe in the past the HR staff were also in charge of payroll, but later on the company gets large enough to hire staff specifically to handle payroll. This means that HR no longer need to access the payroll system, so that permission can be removed. If you have 10 different members of HR, you'll need to manually go through and make sure you remove the correct permission which introduces the possibility for user error. The other issue with this is that it simply doesn't scale; as you gain more and more users in a given role it makes modification of a role much more difficult. Compare this to using roles, where you would only need to modify the overarching role in question to remove the permission, which would be reflected by every user that holds that role.

Title: Role vs Permission Based Access Control

Body:
I'm trying to understand the inherent tradeoff between roles and permissions when it comes to access control (authorization).

Let's start with a given: in our system, a Permission will be a fine-grained unit of access ("Edit resource X", "Access the dashboard page", etc.). A Role will be a collection of 1+ Permissions. A User can have 1+ Roles. All these relationships (Users, Roles, Permissions) are all stored in a database and can be changed on the fly and as needed.

My concerns:

(1) What is so "bad" about checking Roles for access control? What benefits are gained by checking for permissions instead? In other words, what's the difference between these two snippets below:

```<code>if(SecurityUtils.hasRole(user)) {
    // Grant them access to a feature
}

// vs.
if(SecurityUtils.hasPermission(user)) {
    // Grant them access to a feature
}
</code>```

And:

(2) In this scenario what useful value do Roles even provide? Couldn't we just assign 1+ Permissions to Users directly? What concrete value of abstraction do Roles offer (can someone give specific examples)?

Body:
In response to your first question, the biggest issue with checking that a user has a role rather than a specific permission, is that permissions can be held by multiple roles. As an example to this, a developer might have access to see the developer portal on the company intranet, which is probably also a permission held by their manager. If a user is then attempting to access the developer portal, you'd have a check similar to:

if(SecurityUtils.hasRole(developer)) {
    // Grant them access to a feature
} else if(SecurityUtils.hasRole(manager)) {
    // Grant them access to a feature
} else if...

(A switch statement in your language of choice would be better, but still not particularly tidy)

The more common or widely held a permission is, the more user roles you would need to check to ensure that someone is able to access a given system. This would also lead to the issue that every time you modify permissions for a role, you would need to modify the check to reflect this. In a large system this would become very unwieldy very quickly.

If you simply check that the user has the permission that allows them access to the developer portal for example, it doesn't matter what role they hold, they will be granted access.

To answer your second question, the reason you have roles is because they act as easy to modify and distribute "packages" of permissions. If you are have a system that has hundreds of roles and thousands of permissions, adding a new user (for example a new HR manager) would require you to go through and give them every single permission that other HR managers hold. Not only would this be tedious, but it is prone to mistakes if done manually. Compare this to simply adding the "HR manager" role to a user's profile, which will grant them the same access as every other user with that role.

You could argue that you could simply clone an existing user (if your system supported this), but while this does grant the user the correct permissions for that moment in time, attempting to add or remove a permission for all users in the future may be difficult. An example scenario for this is if maybe in the past the HR staff were also in charge of payroll, but later on the company gets large enough to hire staff specifically to handle payroll. This means that HR no longer need to access the payroll system, so that permission can be removed. If you have 10 different members of HR, you'll need to manually go through and make sure you remove the correct permission which introduces the possibility for user error. The other issue with this is that it simply doesn't scale; as you gain more and more users in a given role it makes modification of a role much more difficult. Compare this to using roles, where you would only need to modify the overarching role in question to remove the permission, which would be reflected by every user that holds that role.


问:
I'm looking for a way to add database update scripts to a "playlist"
I've got a group of scripts to run and I'd like to batch them all together. Rather than write a .cmd/.bat file to run the lot it feels to me like there ought to be something similar to a playlist (e.g. .pls ?) file and 'script player' that could run each script in order and have different options on what to do if a script fails (e.g. stop / carry-on). Sort of like a makefile I guess only a bit more user friendly.

Please can you point me at anything like this? thanks.

答:
What you are looking for is a database change management system. Depending on your evironment you might be looking at manually writing scripts, but there are also frameworks that can do migrations with code.

There are many different software solutions that help you with this issue and you can look them up with your favorite search engine. For example, the company I work for uses RoundhousE.


答:
Use both, and write a Python script that'll import the peewee models and convert them to GORM models.

I've scratched something very basic. I've created models.py with the example in peewee's README.md:

```<code>from peewee import *
import datetime

db = SqliteDatabase('my_database.db', threadlocals=True)

class BaseModel(Model):
    class Meta:
        database = db

class User(BaseModel):
    username = CharField(unique=True)

class Tweet(BaseModel):
    user = ForeignKeyField(User, related_name='tweets')
    message = TextField()
    created_date = DateTimeField(default=datetime.datetime.now)
    is_published = BooleanField(default=True)
</code>```

And here is a simple script that imports it and create Go code:

```<code>import peewee

def enumerate_models():
    import models
    for name in dir(models):
        item = getattr(models, name)
        if isinstance(item, type) and issubclass(item, models.BaseModel) and item != models.BaseModel:
            yield item

def model_fields(model):
    for name in dir(model):
        item = getattr(model, name)
        if isinstance(item, peewee.Field):
            yield name, item

def field_go_type(field_spec):
    return {
        peewee.PrimaryKeyField: 'uint',
        peewee.ForeignKeyField: 'uint',
        peewee.TextField: 'string',
        peewee.CharField: 'string',
        peewee.DateTimeField: 'time.Time',
        peewee.BooleanField: 'bool',
    }.get(type(field_spec), '?%s?' % type(field_spec))

for model in enumerate_models():
    print('type' ,model.__name__, 'struct {')
    for field_name, field_spec in model_fields(model):
        field_go_decleration = []
        field_go_decleration.append(field_name)
        field_go_decleration.append(field_go_type(field_spec))
        print('\t' + ' '.join(field_go_decleration))
    print('}')
</code>```

It's output:

```<code>type Tweet struct {
    created_date time.Time
    id uint
    is_published bool
    message string
    user uint
}
type User struct {
    id uint
    username string
}
</code>```

My script still needs more work to add the annotations, but you get the basic idea.

Title: Using ORMs in two separate programs which share a DB

Body:
I have an application that is divided into two main parts:

A web crawler written in Python

A REST API written in Golang

They share a MySQL database, which is mainly populated/updated by the web crawler, and then read from by the REST API.

I wanted to use an ORM on each side to make interacting with the database easier, but now I am not sure if this is a good approach.

On the Python side, I was looking at using peewee, and for Golang I will use gorm.

It doesn't seem like a good idea to maintain two sets of ORM model files, where I would have to change each set whenever I want to change some attributes of the database.  Additionally, I am worried that with two ORMs battling for structure of the database, that conflicts might arise, or the models might become out of sync with what the actual db structure is.

Is this a scenario where using an ORM will cause more trouble than its worth?  Or maybe I should use a single ORM (for either Python or Golang) and write raw queries for the other side.

Body:
Use both, and write a Python script that'll import the peewee models and convert them to GORM models.

I've scratched something very basic. I've created models.py with the example in peewee's README.md:

from peewee import *
import datetime

db = SqliteDatabase('my_database.db', threadlocals=True)

class BaseModel(Model):
    class Meta:
        database = db

class User(BaseModel):
    username = CharField(unique=True)

class Tweet(BaseModel):
    user = ForeignKeyField(User, related_name='tweets')
    message = TextField()
    created_date = DateTimeField(default=datetime.datetime.now)
    is_published = BooleanField(default=True)

And here is a simple script that imports it and create Go code:

import peewee

def enumerate_models():
    import models
    for name in dir(models):
        item = getattr(models, name)
        if isinstance(item, type) and issubclass(item, models.BaseModel) and item != models.BaseModel:
            yield item

def model_fields(model):
    for name in dir(model):
        item = getattr(model, name)
        if isinstance(item, peewee.Field):
            yield name, item

def field_go_type(field_spec):
    return {
        peewee.PrimaryKeyField: 'uint',
        peewee.ForeignKeyField: 'uint',
        peewee.TextField: 'string',
        peewee.CharField: 'string',
        peewee.DateTimeField: 'time.Time',
        peewee.BooleanField: 'bool',
    }.get(type(field_spec), '?%s?' % type(field_spec))

for model in enumerate_models():
    print('type' ,model.__name__, 'struct {')
    for field_name, field_spec in model_fields(model):
        field_go_decleration = []
        field_go_decleration.append(field_name)
        field_go_decleration.append(field_go_type(field_spec))
        print('\t' + ' '.join(field_go_decleration))
    print('}')

It's output:

type Tweet struct {
    created_date time.Time
    id uint
    is_published bool
    message string
    user uint
}
type User struct {
    id uint
    username string
}

My script still needs more work to add the annotations, but you get the basic idea.


答:
It sounds like you're looking for an ETL tool such as SSIS.

These are tools that support the extraction, transformation and loading of data into data warehouses. Whilst this may not be exactly what you're probably trying to do, they do have extensive functionality for running scripts and you are able to branch accordingly depending on a variety of criteria.

Title: I'm looking for a way to add database update scripts to a "playlist"

Body:
I've got a group of scripts to run and I'd like to batch them all together. Rather than write a .cmd/.bat file to run the lot it feels to me like there ought to be something similar to a playlist (e.g. .pls ?) file and 'script player' that could run each script in order and have different options on what to do if a script fails (e.g. stop / carry-on). Sort of like a makefile I guess only a bit more user friendly.

Please can you point me at anything like this? thanks.


问:
In Web API is it a good practice to wrap the results with my model?
I have a Web API, and I'm thinking if it's a good idea to always wrap the result with a my own result model which will always contain specific structure like:

```<code>{
 Data:(of type T generic),
 Messages:[
   {Key:"Key1",Messages:["Msg1","Msg2","Msg3"]},
   {Key:"Key2",Messages:["Msg1","Msg2","Msg3"]},
  ],
 MetaData:[
   {Key:"",Value:"" },
   {Key:"",Value:"" }
  ]
}
</code>```

So I see this model is suitable for all situations, for example:

I want to return success 20x with data only, I just fill Data
property only and leave the others empty.

If I want to return failure status with some messages (from Model state or any other) I just fill Messages.

So I always return my model.

Is this considered as good practice, or should I return different model depending on each status (success or failure).

Thanks

Update 1:

Status codes will still be used to determine if the messages inside the model are error messages or just warning or maybe info, what I'm asking here to abandon the using of Status Codes but:

is it a best practice to use unified model in all my responses, maybe
  some times I need to response as BadRequest with data returned with
  the messages.

答:
Consider returning error messages of some kind, if something went wrong. Returning a model even though an error occurred is probably not the best practice.

For example, when no data was found, returning null instead is often better practice.


答:
I believe in web api You should stick to the conventions and use http error codes to indicate failure.

Think how would You treat Your message on the receiving side:

You would have to write some kind of logic to really detect whether You got an error or success.

You would have to explain the convention to other developers using the code.

I would say this is a bit of reinventing the wheel. In my team we simply use HTTP status codes with messages to report error and it seems to be working well. It's also simpler to handle it with certain web related libraries we're using on client side.

Edit after question update:
In my opinion this really comes down to particular use case. If You think about using this pattern always starting from now then I would not go into it.

If You intend to introduce it in a particular service or product and it is really true (which means there is a use case or requirement) that You will have to return some data together with an error code that's fine. In this case I don't see any better solution.

Title: In Web API is it a good practice to wrap the results with my model?

Body:
I have a Web API, and I'm thinking if it's a good idea to always wrap the result with a my own result model which will always contain specific structure like:

```<code>{
 Data:(of type T generic),
 Messages:[
   {Key:"Key1",Messages:["Msg1","Msg2","Msg3"]},
   {Key:"Key2",Messages:["Msg1","Msg2","Msg3"]},
  ],
 MetaData:[
   {Key:"",Value:"" },
   {Key:"",Value:"" }
  ]
}
</code>```

So I see this model is suitable for all situations, for example:

I want to return success 20x with data only, I just fill Data
property only and leave the others empty.

If I want to return failure status with some messages (from Model state or any other) I just fill Messages.

So I always return my model.

Is this considered as good practice, or should I return different model depending on each status (success or failure).

Thanks

Update 1:

Status codes will still be used to determine if the messages inside the model are error messages or just warning or maybe info, what I'm asking here to abandon the using of Status Codes but:

is it a best practice to use unified model in all my responses, maybe
  some times I need to response as BadRequest with data returned with
  the messages.


问:
Feeding std::streambuf for Non-Blocking std::istream Read
I want to write small library to guide a child process for a specific needs (not trying to reinvent bicycle here).

My needs includes reading from child stdout and stderr. I want to implement this as streams. If I would use simple std::streambuf descendant that reads directly from pipe on underflow - then my stdout and stderr streams would block on read when there is no data available. I want to evade this, and so far I have two ideas

Provide a timeouted method for my streams, that checks if there any data. I need only binary interface of streams i.e. read and write methods, so method which which returns available data amount is fine enough.

But wait - there is already method, with behavior which almost match my desire. std::streambuf::in_avail. What if I'll start background thread which will feed data from pipes to my streambuf? Then I could use standard stream method std::istream::readsome.

Mix of a previous two: provide a method for streams, that will read data from pipe buffer to streambuf. Its like flush for std::istream. This eliminates need in a background thread.

Personally, I like the second variant better, but I feel, that it have many caveats.

Which variant is better in a terms of code readability, performance and interface usability?

答:
It seems that like ratchet freak said in comments, the best solution is to use asynchronous IO. And i'm going to use boost::asio. It have nice support for pipes.

Windows: http://www.boost.org/doc/libs/1_59_0/doc/html/boost_asio/overview/windows/stream_handle.html
Posix:
http://www.boost.org/doc/libs/1_59_0/doc/html/boost_asio/overview/posix/stream_descriptor.html


问:
MVVM with multiple view models that share a model
I have an application where there is an "inventor" model whose data I would like to display differently in different areas of the application.  Therefore, I'd like to create different view models backed by that one model.

For instance, in one section, I might display just a list of inventors with their first, middle, and last name.  In another area of the application, I might display the inventors with only their initials.

A clean implementation of MVVM would seem to dictate that I'd have one model for every view model; however, if there is one notion of a model -- the inventor -- which contains a lot of data that is common across multiple usage areas in an application, then I feel as though there should be one concrete model that is shared by multiple view models.

I've not been able to locate anything that seems to address this, though I'm surprised because I feel like it would be a common question for beginners in MVVM.  Is there a "standard" or accepted answer to this?

答:
I'm afraid the premise that there's a model for each view model is wrong.

The model represents your data, and the data exists only once in your application. Suppose there were a variety of models around and you would have to keep them in sync. On what grounds would this be reasonable?

But perhaps you just confused the model with the view.

For each view you can (and imho should) have an associated view model. So, you would have 1 model, 3 view models and 3 views. The model contains the raw data, the 3 view models "process" the raw data into a format that fits the needs of their respective views.


问:
How far to go with typedef'ing primitive types like int
I have seen C++ code such as the following with many typedefs.

What are the benefits of using many typedefs like this as opposed to using C++ primitives? Is there another approach that might also achieve those benefits?

In the end, the data is all stored in memory or transmitted over the wire as bits and bytes, does it really matter?

```<code>types.h:

typedef int16_t Version;
typedef int32_t PacketLength;
typedef int32_t Identity;
typedef int32_t CabinetNumber;
typedef int64_t Time64;
typedef int64_t RFID;
typedef int64_t NetworkAddress;
typedef int64_t PathfinderAddress;
typedef int16_t PathfinderPan;
typedef int16_t PathfinderChannel;
typedef int64_t HandsetSerialNumber;
typedef int16_t PinNumber;
typedef int16_t LoggingInterval;
typedef int16_t DelayMinutes;
typedef int16_t ReminderDelayMinutes;
typedef int16_t EscalationDelayMinutes;
typedef float CalibrationOffset;
typedef float AnalogValue;
typedef int8_t PathfinderEtrx;
typedef int8_t DampingFactor;
typedef int8_t RankNumber;
typedef int8_t SlavePort;
typedef int8_t EventLevel;
typedef int8_t Percent;
typedef int8_t SensorNumber;
typedef int8_t RoleCode;
typedef int8_t Hour;
typedef int8_t Minute;
typedef int8_t Second;
typedef int8_t Day;
typedef int8_t Month;
typedef int16_t Year;
typedef int8_t EscalationLevel;
</code>```

It seems logical to try and make sure the same type is always used for a particular thing to avoid overflows, but I do often see code where "int" has just been used pretty much everywhere instead.  The typedefing often does lead to code that looks a bit like this though:

```<code>DoSomething(EscalationLevel escalationLevel) {
    ...
}
</code>```

Which then makes me wonder which token is actually describing the parameter: the parameter type or the parameter name?

答:
We (at our company) do it a lot in C++. It helps understanding and maintaining code. Which is good when moving people between teams or doing refactoring. Example:

```<code>typedef float Price;
typedef int64_t JavaTimestmap;

void f(JavaTimestamp begin, JavaTimestamp end, Price income);
</code>```

We believe it's a good practice to create typedef to the dimension name from the representation type. This new name represents a general role in a software. The name of a parameter is a local role. Like in User sender, User receiver. At some places it can be redundant, like void register(User user), but I don't consider it being a problem.

Later one may have the idea that float is not the best for representing prices because of the special rounding rules of booking, so one downloads or implements a BCDFloat (binary coded decimal) type and changes the typedef. There is no search and replace work from float to BCDFloat which would be hardened by the fact that there are possibly many more floats in your code.

It is not a silver bullet and has its own caveats, but we think it is much better using it than not.

OwnerDisplayName: Mark

Body:
We (at our company) do it a lot in C++. It helps understanding and maintaining code. Which is good when moving people between teams or doing refactoring. Example:

typedef float Price;
typedef int64_t JavaTimestmap;

void f(JavaTimestamp begin, JavaTimestamp end, Price income);

We believe it's a good practice to create typedef to the dimension name from the representation type. This new name represents a general role in a software. The name of a parameter is a local role. Like in User sender, User receiver. At some places it can be redundant, like void register(User user), but I don't consider it being a problem.

Later one may have the idea that float is not the best for representing prices because of the special rounding rules of booking, so one downloads or implements a BCDFloat (binary coded decimal) type and changes the typedef. There is no search and replace work from float to BCDFloat which would be hardened by the fact that there are possibly many more floats in your code.

It is not a silver bullet and has its own caveats, but we think it is much better using it than not.


问:
How to store records with variable structure?
We have an old system to manage inventory adjustments that is going to be remade. There are different type of reasons to make an adjustment, and each type requires different data to be filled. Some only require the product and quantity, others require a document ID, others require two products per adjustment, and so on.

Now, in the current system, the data is stored in a master-details tables structure. While the master table represents no major problem, the details table was originally designed with all the possible fields required for the original 5 types of adjustment. So, many records don't use all the fields. But, as the number of adjustment types increased, it has been troublesome to adapt the data required for these adjustments to the current structure, using fields for a different purpose that they were designed for, or storing more than 1 value per field. This is the kind of bad design we're trying to avoid with the new version.

Now, considering that there are currently 15 different types of adjustment, and that this number can increase, what would be the most efficient way to store this data in terms of accesibility and Read/Write performance? Keeping in mind that most of the data processing will be made in the application, we have two possible approaches:

To have the main data as "normal" fields (i.e. primary and foreign keys), and the rest of the data in a XML field, having the XML the required data depending on the adjustment type.

To have 1 table per type of adjustment, reference all these tables to the one master table and add tables as required.

Any other option we have not considered yet

Database is SQL Server 2008 RS and application will be on .NET (C#). We already have a few pros and cons for each option, but it is yet to be decided if database access will be mainly via EF or Stored Procedures (as the old system), and I'm aware each way can fit differently with how data is stored.

答:
I would suggest you retain the master table as you've described and have a table for each adjustment type. In between, have a link table with a FK to the master table and a column for the adjustment type and a FK to the primary key on each adjustment table. Naturally, you'd also want a metadata table to store adjustment types and their descriptions.

ERD

You might ask why you couldn't just have a FK to Master from the child tables. A valid point, but this design affords you the opportunity to apply the same change to multiple Master records without introducing redundancy.

I've seen some implementations similar to the scenario you've described where the type is omitted on the link table for the sake of brevity and a series of adjustment table PKs are earmarked for the type. I'd strongly advise you not to do this as some adjustment types may grow far beyond what you'd anticipate.


答:
I usually go with the multiple table approach.

You might find however, that in terms of read/write performance your current single table format outperforms both alternatives.

XML columns for structured data in a relational database are, I think, trying to do the same job as tables and columns. Before you head down that route, consider the problems you may encounter when in the future you need to change the format of the data.

Title: How to store records with variable structure?

Body:
We have an old system to manage inventory adjustments that is going to be remade. There are different type of reasons to make an adjustment, and each type requires different data to be filled. Some only require the product and quantity, others require a document ID, others require two products per adjustment, and so on.

Now, in the current system, the data is stored in a master-details tables structure. While the master table represents no major problem, the details table was originally designed with all the possible fields required for the original 5 types of adjustment. So, many records don't use all the fields. But, as the number of adjustment types increased, it has been troublesome to adapt the data required for these adjustments to the current structure, using fields for a different purpose that they were designed for, or storing more than 1 value per field. This is the kind of bad design we're trying to avoid with the new version.

Now, considering that there are currently 15 different types of adjustment, and that this number can increase, what would be the most efficient way to store this data in terms of accesibility and Read/Write performance? Keeping in mind that most of the data processing will be made in the application, we have two possible approaches:

To have the main data as "normal" fields (i.e. primary and foreign keys), and the rest of the data in a XML field, having the XML the required data depending on the adjustment type.

To have 1 table per type of adjustment, reference all these tables to the one master table and add tables as required.

Any other option we have not considered yet

Database is SQL Server 2008 RS and application will be on .NET (C#). We already have a few pros and cons for each option, but it is yet to be decided if database access will be mainly via EF or Stored Procedures (as the old system), and I'm aware each way can fit differently with how data is stored.


答: I think a lot depends on your anticipated data volume. If you're only going to have a couple thousand of inventory adjustments a year, then let the implementation LOE determine what method to use. If you anticipate higher volume, then you'll probably wind up getting better performance by going with separate tables (especially if you have to search or report on some of the variable data fields). I know SQL Server has some built-in support for XML in database records, but it didn't seem to support complex queries IIRC, and performance will be slower if you don't have the space to devote to index support.  I'd also suggest looking at JSON instead of XML if you're going to be storing a lot of data in the variable fields, it's a lot easier to parse (although you do lose the strong typing of XML Schema).</p>


问:
Doesn't dependency injection push the testing burden further down the chain?
I'm learning about dependency injection and while I can see the appeal of it when writing functional libraries, I fail to see how it solves anything when you'll also be the one using the libraries.

It makes testing the library much simpler, because there isn't much to test.

But you will eventually have to test your injected function when you use the library and have to deal with mocking and stubbing functions from the standard library.

This is a concrete case I'm dealing with in Node.js:

```<code>function compile(options) {
  var files = options.files;
  var texCompiler = options.texCompiler;
  var pdfMerger = options.pdfMerger;

  return Promise.all(files.map(texCompiler(files)))
    .then(pdfMerger);
}
</code>```

That is trivial to test: injecting mock objects or spies as the texCompiler and pdfMerger is a piece of cake because the function really doesn't do much at all. All I can test is that both functions are called in the right sequence.

It doesn't save me from testing my texCompiler and pdfMerger functions eventually though. They look something like that:

```<code>var tex2Pdf = Promise.method(function tex2Pdf(tex_doc) {
    var latex_command = 'pdflatex';
    var pdf_output_filename = path.parse(tex_doc).name + '.pdf';
    var cmd = latex_command + ' ' + tex_doc;
    var options = {
      cwd: path.resolve(tex_doc, '..') // pdflatex will only look for custom
      // cls files in the cwd and includes relative to the cwd
    };
    child_process.spawn(cmd, options)
      .on('end', function() {
        console.log('tex2Pdf finish');
        debugger;
        return path.resolve(tex_doc, '..', pdf_output_filename);
      })
      .on('error', function(e) {
        throw e;
      });
});

var mergeTwoPdf = Promise.method(function mergeTwoPdf(pdf_files) {
  var output_file = randomId() + '.pdf';
  var cmd = 'gs -dBATCH -dNOPAUSE -sDEVICE=pdfwrite -sOutputFile=' + output_file + ' ' + pdf_files[0] + ' ' + pdf_file[1];
  child_process.spawn(cmd)
    .on('finish', function() {
      return output_file;
    })
  .on('error', function(e) {
    throw (e);
  });
});
</code>```

This is the real thing, and it is a bigger pain to test. I have to mock child_process.spawn with a spy to make sure it gets called with the right arguments, but it doesn't actually do anything, because I don't want to actually merge any PDF file when running the tests and my mocks have to emit the right events so the function isn't stuck.

These are problems I would have had if I didn't inject the dependency in my first snippet and used these functions instead. And it really feels like I'm pushing the problem further down without solving it.

Am I misunderstanding dependency injection? Am I doing it wrong?

答:
I think it's the testing you are misunderstanding if anything.

I would test your PDF file creation by creating a PDF file and comparing it with a known good one.

I would test your PDF file merge by merging two PDF files and comparing the output with, again, a known good file.


答:
You're missing the point of testing it seems.

That is trivial to test: injecting mocks or spies as the texCompiler and pdfMerger is a piece of cake because the function really doesn't do much at all. All I can test is that both functions are called in the right sequence.

Awesome! If the function is doing trivial work, then the test should be trivial. Likewise, if all that function is actually doing is calling A then B, you're not validating much of your code.

The entire point of good tests are to isolate what you're testing, so when the test fails, you can better know what went wrong. Dependency injection helps that.

And it really feels like I'm pushing the problem further down without solving it.

Sure, in this case you're not "solving it" because your code has nasty dependencies that are hard to isolate. You need to work with the filesystem. You need to call these external processes. Sometimes that is the nature of the beast.

Dependency Injection doesn't remove dependencies, it just flips them around so that you can choose what they are. That helps isolate code for testing. It helps  the code be more flexible when those dependencies inevitably change. But it does not kill them - your code still needs to be able to do all the same things somewhere.

Title: Doesn't dependency injection push the testing burden further down the chain?

Body:
I'm learning about dependency injection and while I can see the appeal of it when writing functional libraries, I fail to see how it solves anything when you'll also be the one using the libraries.

It makes testing the library much simpler, because there isn't much to test.

But you will eventually have to test your injected function when you use the library and have to deal with mocking and stubbing functions from the standard library.

This is a concrete case I'm dealing with in Node.js:

```<code>function compile(options) {
  var files = options.files;
  var texCompiler = options.texCompiler;
  var pdfMerger = options.pdfMerger;

  return Promise.all(files.map(texCompiler(files)))
    .then(pdfMerger);
}
</code>```

That is trivial to test: injecting mock objects or spies as the texCompiler and pdfMerger is a piece of cake because the function really doesn't do much at all. All I can test is that both functions are called in the right sequence.

It doesn't save me from testing my texCompiler and pdfMerger functions eventually though. They look something like that:

```<code>var tex2Pdf = Promise.method(function tex2Pdf(tex_doc) {
    var latex_command = 'pdflatex';
    var pdf_output_filename = path.parse(tex_doc).name + '.pdf';
    var cmd = latex_command + ' ' + tex_doc;
    var options = {
      cwd: path.resolve(tex_doc, '..') // pdflatex will only look for custom
      // cls files in the cwd and includes relative to the cwd
    };
    child_process.spawn(cmd, options)
      .on('end', function() {
        console.log('tex2Pdf finish');
        debugger;
        return path.resolve(tex_doc, '..', pdf_output_filename);
      })
      .on('error', function(e) {
        throw e;
      });
});

var mergeTwoPdf = Promise.method(function mergeTwoPdf(pdf_files) {
  var output_file = randomId() + '.pdf';
  var cmd = 'gs -dBATCH -dNOPAUSE -sDEVICE=pdfwrite -sOutputFile=' + output_file + ' ' + pdf_files[0] + ' ' + pdf_file[1];
  child_process.spawn(cmd)
    .on('finish', function() {
      return output_file;
    })
  .on('error', function(e) {
    throw (e);
  });
});
</code>```

This is the real thing, and it is a bigger pain to test. I have to mock child_process.spawn with a spy to make sure it gets called with the right arguments, but it doesn't actually do anything, because I don't want to actually merge any PDF file when running the tests and my mocks have to emit the right events so the function isn't stuck.

These are problems I would have had if I didn't inject the dependency in my first snippet and used these functions instead. And it really feels like I'm pushing the problem further down without solving it.

Am I misunderstanding dependency injection? Am I doing it wrong?


问:
Long running DB query with concurrent write at the same time
We have a big table with a lot of data and a select query which takes 3 seconds to run.

However we are a highly concurrent environment and each second we get 100 new records in our database.

So let's say we have this query, and before that query starts, we have 1000 items which satisfy those query. The query takes 3 seconds, and each second there are 50 new items that match those query added to the DB.

My question is: What result will this query return to me (is it 1000, 1150 or somewhere in between), and how does this vary depending on the DB engine (SQL, NoSQL).

It's not a question about the exact number, more - why it would actually be that number.

答:
You're essentially asking about how locks are performed and when. This will be covered in the documentation for each database implementation.

As an example for PostgreSQL the required reading is:

http://www.postgresql.org/docs/9.4/static/transaction-iso.html

Specifically you'll see it's up to the programmer to set isolation levels. That said there are defaults like:

Read Committed is the default isolation level in PostgreSQL.

And then it goes onto explain it. The table explains what can occur at each isolation level.

You can also use explicit locking in most RDMS:

http://www.postgresql.org/docs/9.4/static/explicit-locking.html

This explains the default also at least for select:

ACCESS SHARE - The SELECT command acquires a lock of this mode on referenced tables. In general, any query that only reads a table and does not modify it will acquire this lock mode.

If you want to ensure you're not reading anything added after the query starts you can use "EXCLUSIVE". From the table you can see what this means.

This mode allows only concurrent ACCESS SHARE locks, i.e., only reads from the table can proceed in parallel with a transaction holding this lock mode.

Which can be useful if your problem requires that.

Regarding NoSQL there's so many of them. I'm not sure where to start, but glancing at the wikipedia article on NoSQL it indicates some don't even offer isolation. (Or ACID).


问:
C# .NET MVVM software architecture and naming conventions
I am currently working on a software using C# .NET and WPF with the MVVM pattern.

Though the software is almost done, I have been discussing our architecture for a long time and I would like to get your opinions/advices on the convention/good practices side.

The current architecture is as follows:

Project/

DataContext/

Models/

Engine3D/

...

Utilities/

Converters/

Statics/

ViewModels/

Grids/

Menus/

Windows/

...

Views/

Grids/

Menus/

Windows/

...

Models folder:

Contains the Models from the MVVM pattern.

The Models folder is organized by feature, meaning that it has nested folders named after a feature or context, for example Models/Engine3D for every Model related to 3D.

We never append the "Model" word as a suffix, the files are named [Feature].cs
For example, Project.cs, Model3D.cs, Animation.cs, etc...

Views folder:

Contains the Views from the MVVM pattern.

The Views folder is organized by WPF Control, meaning that it has nested folders named after a WPF Control, for example Views/Windows for every View related to a WPF Window, or View/Grids, etc...

The files are named [Feature][ControlType].xaml with:

[Feature]: The "feature" implemented/described by the View, for example "CreateProject" for a feature creating a Project, Display3DModel for a Grid displaying a Model3D (using 3D libraries), etc...

[ControlType]: The type of "xaml" control represented by the file, being a Window, a UserControl, a Grid, etc... As an example, a Window displaying the System Preferences would be called SystemPreferencesWindow.xaml, and a Grid holding the list of all the Projects would be ProjectsListGrid.xaml.
For example, CreateProjectWindow.xaml, SystemPreferencesWindow.xaml, Display3DModelGrid.xaml, ProjectsListGrid.xaml

ViewModels folder:

Contains the ViewModels from the MVVM pattern.

The ViewModels folder copies the Views folder in terms of architecture, meaning that it has nested folders named after a WPF Control, for example ViewModels/Windows for every ViewModel related to a WPF Window, or ViewModels/Grids.

A ViewModel file has the same name as its related View file, with the suffix "ViewModel": the files are named [Feature][ControlType]ViewModel.cs with:

For example, based on View => ViewModel:
CreateProjectWindow.xaml => CreateProjectWindowViewModel.cs, OpenProjectWindow.xaml => OpenProjectWindowViewModel.cs, etc...

DataContext folder:

Contains the DataContext files, ie. files related to a certain context in the software; these are classes that are neither ViewModels or Models, are mostly accessible "staticly" and correspond to a very specific context in the software execution flow so don't really belong in the Utilities folder.
These classes are for example the Session class holding session values concerning the user like the web technologies' sessions.

Utilities folder:

Contains a set of files/classes tools of various goals :

Definition classes, giving system mechanisms to the overall software such as ObservableObject.cs, DelegateCommand.cs and RelayCommand.cs which permit MVVM data binding, etc...

Utilities/Converters folder: Converters classes...

Utilities/Statices folder: Contains static operations classes taking an input and returning an output, for example FileOperations.cs, XWindow.cs (don't bother with the name, it's project's specific) that regroups System.Windows operations like InvokeWindow() and CloseWindow() so that it's easier to manipulate System.Windows in the code, Model3DImporter.cs which imports 3D Models very easily, SerializationManager.cs for serialization operations, etc...

Classes with constants:

Some classes need constants values and since these values must be accessed from pretty much everywhere in the code, we didn't store these constant values in the related classes but in a "sister" class.

These "sister" classes are as follows:

```<code>// The sister class
public static class Model3DConstants
{
    private static readonly IList<String> supportedFileExtensions = ...
}

// The original class
public class Model3D
{
}
</code>```

As I mentioned in the beginning of my message, I would like your ideas/advices on our architecture/naming conventions, because I am sure that we are missing something out but don't know what.

Are we doing the complete opposite of what should be done in a correct C# .NET MVVM software using WPF, what are the flaws and/or stuff that we should modify

Do not hesitate to participate in the debate neither or even ask me questions if I am unclear about the above description.

答:
This may not answer everything you are asking, but it's too much for a comment.

Your solution's organization (I use the term organization rather than architecture) should reflect how you use it. It should be efficient for your use. For instance, when you want to make a change to a Menu does a developer have to open files from View/Menus and also from ViewModels/Menus to make the change? (This is inefficient.) Or do you have designers who only ever open Views, and developers who only ever open ViewModels?

This is why single team projects might prefer a feature-oriented approach (with related Views and View Models in the same feature folder) whereas large projects with multiple teams might prefer a component-oriented approach like your current structure. (This may also be the reason for Conway's law.)

I make a distinction (at least mentally) between Utilities and Infrastructure. Infrastructure code is a core part of your application's inner workings that is used by policy (e.g. "We always use RelayCommand on these WPF controls." -- UI Infrastructure). Whereas Utilities are generally useful purpose-built functions like perhaps FileOperations. I'm not suggesting that you create a new Infrastructure project or rename anything. Just make sure that all your "must use" components are in a highly accessible place, which it sounds like they are.

Utility code is at greatest risk for being forgotten or ignored. So make sure that what you put there is truly useful and time-saving. If you pollute it with a lot of minor helpers, other developers will not take the time to familiarize themselves with it and miss the opportunity to save time.

And then there are Helpers which are what I deem reusable code which is helpful across a few specific components. Maybe it's shared code used for related features. I generally keep these close to the calling code if possible and not in Utilities. This way, the code is not far off when a developer needs to work on that feature, and it doesn't add cruft to the more highly-reusable Utilities.

I look at it like: developers must be familiar with Infrastructure, should be familiar with Utilities, and may be familiar with a given feature's Helpers (if they work on that feature).


答:
In RDBMS parlance, you're really talking about Isolation Levels. How these vary depends on the RDBMS in question (and also the version).

Perhaps the simplest scenario is Read Committed vs Read Uncommitted. If you wish to read only clean data i.e. that which has been committed to the database then the result may differ from uncommitted data which may have been valid at the time but which has since been rolled back. A subtlety which is lost on many a new developer lacking database nous is that while clean reads return "correct" data, dirty reads can be faster since they don't have to wait for transactions to finish to complete the picture of the data.

Whether spurious data actually matters varies from case to case. Clearly, banking and financial applications absolutely require accurate data whilst say, pulling a gender split from a large data warehouse for a management report would perhaps require a lower level of accuracy.

For certain tasks, you may wish there to be a consistent view of the data for the duration of your operation in which case, a snapshot of the data is taken and the query works against that until the operation is done no matter what records are added to the later data vintage.

In addition to the query time, there is also the consideration of how quickly new records are written. If there are a high number of indexes on the table then new records will be added at a lower rate than if there were a low number of indexes on the table.

Title: Long running DB query with concurrent write at the same time

Body:
We have a big table with a lot of data and a select query which takes 3 seconds to run.

However we are a highly concurrent environment and each second we get 100 new records in our database.

So let's say we have this query, and before that query starts, we have 1000 items which satisfy those query. The query takes 3 seconds, and each second there are 50 new items that match those query added to the DB.

My question is: What result will this query return to me (is it 1000, 1150 or somewhere in between), and how does this vary depending on the DB engine (SQL, NoSQL).

It's not a question about the exact number, more - why it would actually be that number.


问:
Confusion on aggregate root
Let's say I have the following entities.

Product, Option, and OptionValue

Product can be created without any options.

Option must include at least one OptionValue

OptionValue can be created without associations.

In this case, can product be an aggregate root?

I was thinking 'Yes', but then..I can't delete Option objects associated with a Product object when I delete the Product object because other Product objects might be associated with Option objects.

If Product is not an aggregate root, what should I call them? Just an aggregate?

答:
When you have the question "What is the Aggregate Root here?"

One useful exercise that I've heard:

Put all your use cases (behaviors) on sticky notes.

Go through the sticky notes and start piling them together where the use cases are related.

Examine each pile and try to come up with a concept for it.

Go through the use cases in the pile and see if each one matches the concept.

Revise as necessary (move notes between piles, update concepts)

We often expect ARs to be the nouns of the sentences we make describing business processes. But sometimes there is an over-arching theme of the use cases (a higher level abstraction) that ends up being the AR, and the aforementioned nouns are sub-objects (entities or value objects or documents) within the AR or even just reference data.

Title: Confusion on aggregate root


问:
Check in which region is a geoposition Marker located in
I use Mapbox to display some moving markers over a map with several polygons drew over it (feature layers).

I have serveral markers (~1000) and multiple feature layers (polygons ~200) that represent different regions. The markers are moving (once per second with a constant velocity) and I have to know at any moment on which polygon does the marker position reside on.

First idea is the one to iterate for each marker every second over all polygons and check with a point in polygon formula (for geopositions?) if it is inside or not. This solution will not work as the complexity of O(NrMarkers * NrPolygons) seems too mcuh to run every second (might work but will put too mcuh stress on the server that moves the marker positions).

Now, I think maybe there is some way I could use more complex structures like k-d trees but it will be pretty hard to implement them and still there would be pretty much computation to be done each second.

I was also thinking of pre-processing because the polygons are known from the start and never change. Maybe I could somehow store for some known coordinates what polygons intersect those coordinates and use this info to exclude some polygons (or directly know the correct one) for any given position query.

So, to formulate it as an algorithmic question:

Given a list of P polygons (~200) (each having between 3 and 20 vertexes) and a list of N points (~1000) (which can either be still or have a constant speed that might change direction from time to time) find an algorithm that tells for each of the N points with which polygon shape does it intersect (inside which polygon is it, if any). This query will be asked every second for the same list of polygons and the same list of points (points which have their position updated after each second).

答:
This geographical problem is called Point in Polygon, and there's a solution in Python here.

For the sake of completeness here it is in JavaScript with some examples:

```<code>// x,y are point coordinates
// poly is a list of tuples [[x,y], [x,y], ....]
function isPointInPolygon(x,y,poly) {
    var num = poly.length,
        i = 0;
        j = num - 1;
        c = false;

    for( i = 0; i < num; i++ ) {
        if( ((poly[i][1] > y) != (poly[j][1] > y)) && (x < (poly[j][0] - poly[i][0]) * (y - poly[i][1]) / (poly[j][1] - poly[i][1]) + poly[i][0]) ) {
            c = !c;
        }
        j = i;
    }
    return(c);
}

isPointInPolygon(5,1, [[0,0], [7,3], [9,0]]); // true
isPointInPolygon(5,3, [[0,0], [7,3], [9,0]]); // false
</code>```

This shouldn't be used for lat/lng coordinates for very large areas. City scale should be fine though.

Update

Rereading the question I'm not sure I've sufficiently answered. I've added new code where the client's browser will run this much better than O(NrMarkers * NrPolygons) as long as your polygons don't overlap too much. This expanded code creates, and can store, bounding rectangles for polygons to reduce expensive calls to isPointInPolygon.

```<code>// Not to be used for large areas or near equator or 0/180 longitude
// x,y are point coordinates
// poly is a list of tuples [[x,y], [x,y], ....]
function isPointInPolygon(x, y, poly) {
  var num = poly.length,
      i = 0;
  j = num - 1;
  c = false;

  for (i = 0; i < num; i++) {
    if (((poly[i][1] > y) != (poly[j][1] > y)) && (x < (poly[j][0] - poly[i][0]) * (y - poly[i][1]) / (poly[j][1] - poly[i][1]) + poly[i][0])) {
      c = !c;
    }
    j = i;
  }
  return (c);
}

function arePointsInPolygons(points, polygons) {
    var pointnum = points.length,
        polynum = polygons.length,
        vertnum,
        pb = polybounds,
        results = [],
        pt, pg, v;

    if( pb.length === 0 ) {
        // get the polygon bounds for each polygon
        for( pg = 0; pg < polynum; pg++ ) {
            pb.push([false, false, false, false]);
            vertnum = polygons[pg].length;

            for( v = 0; v < vertnum; v++ ) {
                // north
                if( pb[pg][0] === false || polygons[pg][v][1] > pb[pg][0] ) {
                    pb[pg][0] = polygons[pg][v][1];
                }
                // east
                if( pb[pg][1] === false || polygons[pg][v][0] > pb[pg][1] ) {
                    pb[pg][1] = polygons[pg][v][0];
                }
                // south
                if( pb[pg][2] === false || polygons[pg][v][1] < pb[pg][2] ) {
                    pb[pg][2] = polygons[pg][v][1];
                }
                // west
                if( pb[pg][3] === false || polygons[pg][v][0] < pb[pg][3] ) {
                    pb[pg][3] = polygons[pg][v][0];
                }
            }
        }
        polybounds = pb;
    }

    // check which points fall within the bounds, if yes call isPointInPolygon
    for( pt = 0; pt < pointnum; pt++ ) {
        results.push([]);
        for( pg = 0; pg < polynum; pg++ ) {
            if( points[pt][0] > pb[pg][3] && points[pt][0] < pb[pg][1] &&
               points[pt][1] > pb[pg][2] && points[pt][1] < pb[pg][0] ) {
                if( isPointInPolygon(points[pt][0], points[pt][1], polygons[pg]) ) {
                    results[pt].push(pg);
                }
            }
        }
    }

    return(results);
}

// Test
var i,
    inside,
    numiter = 1000000,
    points = [];
for( i = 0; i < numiter; i++ ) {
    points.push([parseInt(Math.random()*10,10), parseInt(Math.random()*10,10)]);
}

// test isPointInPolygon for list of many points
inside = 0;
var start = new Date().getTime();
for( i = 0; i < numiter; i++ ) {
    inside += isPointInPolygon(points[i][0], points[i][1], [[0, 0], [7, 3], [9, 0]]) ? 1 : 0;
}
console.log(new Date().getTime() - start);

// do same test with optimization
var polybounds = [];
var start = new Date().getTime();
arePointsInPolygons(points, [[[0, 1], [7, 3], [9, 0]],[[0, 3], [3, 3], [3, -1]]]);
console.log(new Date().getTime() - start); // slower, builds polybounds

var start = new Date().getTime();
arePointsInPolygons(points, [[[0, 1], [7, 3], [9, 0]],[[0, 3], [3, 3], [3, -1]]]);
console.log(new Date().getTime() - start);

// arePointsInPolygons returns array of length equal to number of points containing arrays of polygon indexes in which the points fall - empty indicates not in any.
</code>```

Limitations update

Looking at the map below:

(source)

The northern border, which follows the 49th parallel, is sometimes straight and sometimes curved on the maps. For web maps the projection used shows the border as horizontal. The danger lies when a point falls within the area in one projection but not in the other. The path along a curved surface is ambiguous. See diagram:

Body:
This geographical problem is called Point in Polygon, and there's a solution in Python here.

For the sake of completeness here it is in JavaScript with some examples:

// x,y are point coordinates
// poly is a list of tuples [[x,y], [x,y], ....]
function isPointInPolygon(x,y,poly) {
    var num = poly.length,
        i = 0;
        j = num - 1;
        c = false;

    for( i = 0; i < num; i++ ) {
        if( ((poly[i][1] > y) != (poly[j][1] > y)) && (x < (poly[j][0] - poly[i][0]) * (y - poly[i][1]) / (poly[j][1] - poly[i][1]) + poly[i][0]) ) {
            c = !c;
        }
        j = i;
    }
    return(c);
}

isPointInPolygon(5,1, [[0,0], [7,3], [9,0]]); // true
isPointInPolygon(5,3, [[0,0], [7,3], [9,0]]); // false

This shouldn't be used for lat/lng coordinates for very large areas. City scale should be fine though.

Update

Rereading the question I'm not sure I've sufficiently answered. I've added new code where the client's browser will run this much better than O(NrMarkers * NrPolygons) as long as your polygons don't overlap too much. This expanded code creates, and can store, bounding rectangles for polygons to reduce expensive calls to isPointInPolygon.

// Not to be used for large areas or near equator or 0/180 longitude
// x,y are point coordinates
// poly is a list of tuples [[x,y], [x,y], ....]
function isPointInPolygon(x, y, poly) {
  var num = poly.length,
      i = 0;
  j = num - 1;
  c = false;

  for (i = 0; i < num; i++) {
    if (((poly[i][1] > y) != (poly[j][1] > y)) && (x < (poly[j][0] - poly[i][0]) * (y - poly[i][1]) / (poly[j][1] - poly[i][1]) + poly[i][0])) {
      c = !c;
    }
    j = i;
  }
  return (c);
}

function arePointsInPolygons(points, polygons) {
    var pointnum = points.length,
        polynum = polygons.length,
        vertnum,
        pb = polybounds,
        results = [],
        pt, pg, v;

    if( pb.length === 0 ) {
        // get the polygon bounds for each polygon
        for( pg = 0; pg < polynum; pg++ ) {
            pb.push([false, false, false, false]);
            vertnum = polygons[pg].length;

            for( v = 0; v < vertnum; v++ ) {
                // north
                if( pb[pg][0] === false || polygons[pg][v][1] > pb[pg][0] ) {
                    pb[pg][0] = polygons[pg][v][1];
                }
                // east
                if( pb[pg][1] === false || polygons[pg][v][0] > pb[pg][1] ) {
                    pb[pg][1] = polygons[pg][v][0];
                }
                // south
                if( pb[pg][2] === false || polygons[pg][v][1] < pb[pg][2] ) {
                    pb[pg][2] = polygons[pg][v][1];
                }
                // west
                if( pb[pg][3] === false || polygons[pg][v][0] < pb[pg][3] ) {
                    pb[pg][3] = polygons[pg][v][0];
                }
            }
        }
        polybounds = pb;
    }

    // check which points fall within the bounds, if yes call isPointInPolygon
    for( pt = 0; pt < pointnum; pt++ ) {
        results.push([]);
        for( pg = 0; pg < polynum; pg++ ) {
            if( points[pt][0] > pb[pg][3] && points[pt][0] < pb[pg][1] &&
               points[pt][1] > pb[pg][2] && points[pt][1] < pb[pg][0] ) {
                if( isPointInPolygon(points[pt][0], points[pt][1], polygons[pg]) ) {
                    results[pt].push(pg);
                }
            }
        }
    }

    return(results);
}

// Test
var i,
    inside,
    numiter = 1000000,
    points = [];
for( i = 0; i < numiter; i++ ) {
    points.push([parseInt(Math.random()*10,10), parseInt(Math.random()*10,10)]);
}

// test isPointInPolygon for list of many points
inside = 0;
var start = new Date().getTime();
for( i = 0; i < numiter; i++ ) {
    inside += isPointInPolygon(points[i][0], points[i][1], [[0, 0], [7, 3], [9, 0]]) ? 1 : 0;
}
console.log(new Date().getTime() - start);

// do same test with optimization
var polybounds = [];
var start = new Date().getTime();
arePointsInPolygons(points, [[[0, 1], [7, 3], [9, 0]],[[0, 3], [3, 3], [3, -1]]]);
console.log(new Date().getTime() - start); // slower, builds polybounds

var start = new Date().getTime();
arePointsInPolygons(points, [[[0, 1], [7, 3], [9, 0]],[[0, 3], [3, 3], [3, -1]]]);
console.log(new Date().getTime() - start);

// arePointsInPolygons returns array of length equal to number of points containing arrays of polygon indexes in which the points fall - empty indicates not in any.

Limitations update

Looking at the map below:

(source)

The northern border, which follows the 49th parallel, is sometimes straight and sometimes curved on the maps. For web maps the projection used shows the border as horizontal. The danger lies when a point falls within the area in one projection but not in the other. The path along a curved surface is ambiguous. See diagram: