Xeku.Scripts.WebApi 0.0.0.7

Xeku.Scripts.WebApi

WebApi module for Xeku.Scripts, providing remote script execution endpoints via REST API.

Features

• Remote Execution: Execute compiled scripts via HTTP POST endpoint
• Timeout Support: Built-in 30-second timeout mechanism (configurable)
• Execution Logging: Automatic logging of all remote executions
• ScriptContext Support: Optional ScriptContext injection for XAF interactions
• Standard Authentication: Compatible with JWT Bearer and ApiKey authentication

Installation

dotnet add package Xeku.Scripts.WebApi

Dependencies

• Xeku.Core.WebApi - Core WebApi module
• Xeku.Scripts - Scripts core module (required)
• DevExpress.ExpressApp.Api.Xpo.All - XAF OData support

Integration

1. Module Registration

Add to your WebApi project's Startup.cs:

builder.Modules
    .Add<Xeku.Scripts.WebApi.ScriptsWebApiModule>();

2. Authentication Configuration

This module uses standard [Authorize] attribute. Ensure your Startup.cs has proper authentication configured:

Option A: JWT Bearer (Standard)

services.AddAuthentication()
    .AddJwtBearer(options => {
        // JWT configuration
    });

Option B: ApiKey (Recommended for external integration)

// Install Xeku.ApiKey.WebApi module
builder.Modules
    .Add<Xeku.ApiKey.WebApi.ApiKeyWebApiModule>();

API Endpoints

POST /api/ScriptsController/Execute

Executes a compiled script remotely.

Request Body:

{
  "scriptId": "guid-of-compiled-script",
  "withContext": true,
  "timeoutSeconds": 30
}

Response (Success - 200 OK):

{
  "success": true,
  "executionLogId": "guid",
  "returnValue": "result or null",
  "durationMs": 123,
  "messages": ["[INFO] Hello from Script!", "[WARN] ..."]
}

Response (Error - 400/404/500):

{
  "type": "https://xeku.dev/errors/execution-failed",
  "title": "Execution Failed",
  "status": 400,
  "detail": "Script not compiled or specific error message"
}

Usage Examples

Using curl with ApiKey

curl -X POST "https://your-api.com/api/ScriptsController/Execute" \
  -H "Authorization: ApiKey YOUR_API_KEY_HERE" \
  -H "Content-Type: application/json" \
  -d '{
    "scriptId": "12345678-1234-1234-1234-123456789abc",
    "withContext": true,
    "timeoutSeconds": 30
  }'

Using C# HttpClient

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("Authorization", "ApiKey YOUR_API_KEY");

var request = new
{
    scriptId = Guid.Parse("12345678-1234-1234-1234-123456789abc"),
    withContext = true,
    timeoutSeconds = 30
};

var response = await client.PostAsJsonAsync(
    "https://your-api.com/api/ScriptsController/Execute",
    request);

var result = await response.Content.ReadFromJsonAsync<ExecutionResult>();

Error Scenarios

Security Recommendations

1. Use ApiKey Authentication: Implement Xeku.ApiKey module for external API access
2. Limit Script Permissions: Use XAF security to restrict who can create/edit scripts
3. Set Reasonable Timeouts: Default 30 seconds prevents infinite loops
4. Monitor Execution Logs: Review ScriptExecutionLog regularly
5. Validate Script Content: Review scripts before compilation in production

Performance Considerations

• Assembly Caching: Compiled assemblies are cached in memory for fast execution
• Async Execution: The Execute endpoint is fully async-compatible
• Timeout Mechanism: Uses CancellationTokenSource for efficient timeout handling

Related Modules

• Xeku.Scripts - Core scripts module
• Xeku.ApiKey.WebApi - ApiKey authentication

License

Proprietary - Xeku Solutions