Subject: Re: CAP: List Of Items (crisp)

From: "John Stracke" <[email-masked]>
Date: Mon, 11 Feb 2002 15:22:22 -0500

>(1) CRISP needs to be updated. It is not in sync with CAP (beep).

True.  I'll see if I can get to that soon.

>(2) We need to make sure that QUERYLEVEL and CAPABILITIES
>    allow for iana and X-tokens.
>
>    Do we say that if <car>xxx</car> does not exists, then
>    the CS does not support ANY VCARs?
>
>    Do we say that if <query-level>xxx</query-level> does not
>    exist, then no query is supported on the CS?

It might be better if these statements are made explicitly (e.g.,
"<car/>" or "<car>none</car>"), so that it's obvious that a missing
element is a bug.

>(3) It is not clear to me if a CRISP server sends some kind
>    of capability specifying the fact it only supports iTIP
>    methods.

That's the intent in my older drafts.  I'll have to dig into the
latest CAP version to see whether I can say that explicitly, or (as
you suggested a month or few ago) just say "I'm CRISP".

>(4) There would have to be some MINIMUM predefined VCAR support
>    in a CRISP server, else how would implementations say 
>    that UPN-X can make requests, and UPN-Y can not.

Um...I don't think we can do that, really.  The point of CRISP is to
carry iTIP operations from users who don't have accounts on the local
CS; and we have no way of authenticating remote users.

>(5) Would we have to generate some kind of capability that
>    specified which components the server supported? Or
>    should this be specified in CRISP as a CAP extension?

Hmm.  I've always thought that a base CAP client (written by someone
who never read the CRISP spec) should be able to talk to a CRISP
server and understand its capabilities; that's why I took the approach
of defining "NONE" capabilities.  However, it now occurs to me that a
client has to be written specifically to take advantage of CRISP,
because a CRISP client has to log in with no credentials, which it
would never do in CAP.

/================================================================\
|John Stracke                    |Principal Engineer             |
[email-masked]   |Incentive Systems, Inc.        |
|http://www.incentivesystems.com |My opinions are my own.        |
|================================================================|
|A successful tool is one that was used to do something undreamed|
|of by its author.                                               |
\================================================================/

---

From: Doug Royer <[email-masked]>
Date: Mon, 11 Feb 2002 14:18:32 -0700

> "<car/>" or "<car>none</car>"), so that it's obvious that a missing

Sounds good to me. As you are the most interested. Be sure
to PING us when we do last call if 'none' is not a valid
querylevel.

> you suggested a month or few ago) just say "I'm CRISP".

get-capabilities returns <CRISP [version="xx"/> ?

> CS; and we have no way of authenticating remote users.

I see your point. But how about defining in CRISP the VCAR
that allows users to understand what they are being allowed to do?
At the very least, they are allowed to deposit:

	METHOD:REQUEST

Perhaps:

	METHOD:COUNTER
	METHOD:ADD

Maybe:

	METHOD:DECLINE-COUNTER

What about:

	METHOD:CANCEL

See my point? What can they do - EVERYTHING as long as it
is an iTIP METHOD? 

If yes - then I would like to see the VCAR that you
are proposing as the restriction.

> because a CRISP client has to log in with no credentials, which it

Or how about they just authenticate as anonymous?