# 6. The Web Layer

## 6.1 Controllers

A controller handles requests and creates or prepares the response and is request-scoped. In other words a new instance is created for each request. A controller can generate the response or delegate to a view. To create a controller simply create a class whose name ends with `Controller` and place it within the `grails-app/controllers` directory.

The default URL Mapping setup ensures that the first part of your controller name is mapped to a URI and each action defined within your controller maps to URI within the controller name URI.

## 6.1.1 Understanding Controllers and Actions

#### Creating a controller

Controllers can be created with the create-controller target. For example try running the following command from the root of a Grails project:

    grails create-controller book

The command will result in the creation of a controller at the location `grails-app/controllers/BookController.groovy`:

    class BookController { … }

`BookController` by default maps to the /book URI (relative to your application root).

> The `create-controller` command is merely for convenience and you can just as easily create controllers using your favorite text editor or IDE

#### Creating Actions

A controller can have multiple properties that are each assigned a block of code. Each of these properties maps to a URI:

    class BookController {
        def list = {        // do controller logic
            // create model        return model
        }
    }

This example maps to the `/book/list` URI by default thanks to the property being named `list`.

#### The Default Action

A controller has the concept of a default URI that maps to the root URI of the controller. By default the default URI in this case is `/book`. The default URI is dictated by the following rules:

- If only one action is present the default URI for a controller maps to that action.
- If you define an `index` action which is the action that handles requests when no action is specified in the URI `/book`
- Alternatively you can set it explicitly with the `defaultAction` property:

    def defaultAction = "list"

## 6.1.2 Controllers and Scopes

#### Available Scopes

Scopes are essentially hash like objects that allow you to store variables. The following scopes are available to controllers:

- servletContext - Also known as application scope, this scope allows you to share state across the entire web application. The servletContext is an instance of javax.servlet.ServletContext
- session - The session allows associating state with a given user and typically uses cookies to associate a session with a client. The session object is an instance of HttpSession
- request - The request object allows the storage of objects for the current request only. The request object is an instance of HttpServletRequest
- params - Mutable map of incoming request (CGI) parameters
- flash - See below.

#### Accessing Scopes

Scopes can be accessed using the variable names above in combination with Groovy's array index operator even on classes provided by the Servlet API such as the HttpServletRequest:

    class BookController {
        def find = {
            def findBy = params["findBy"]
            def appContext = request["foo"]
            def loggedUser = session["logged_user"]    }
    }

You can even access values within scopes using the de-reference operator making the syntax even clearer:

    class BookController {
        def find = {
            def findBy = params.findBy
            def appContext = request.foo
            def loggedUser = session.logged_user    }
    }

This is one of the ways that Grails unifies access to the different scopes.

#### Using Flash Scope

Grails supports the concept of flash scope is a temporary store for attributes which need to be available for this request and the next request only. Afterwards the attributes are cleared. This is useful for setting a message directly before redirection, for example:

    def delete = {
        def b = Book.get( params.id )
        if(!b) {
            flash.message = "User not found for id ${params.id}"
            redirect(action:list)
        }
        … // remaining code
    }

## 6.1.3 Models and Views

#### Returning the Model

A model is essentially a map that the view uses when rendering. The keys within that map translate to variable names accessible by the view. There are a couple of ways to return a model, the first way is to explicitly return a map instance:

    def show = {
     	[ book : Book.get( params.id ) ]
    }

If no explicit model is returned the controller's properties will be used as the model thus allowing you to write code like this:

    class BookController {
        List books
        List authors
        def list = {
               books = Book.list()
               authors = Author.list()
        }
    }

> This is possible due to the fact that controllers are prototype scoped. In other words a new controller is created for each request. Otherwise code such as the above would not be thread safe.

In the above example the `books` and `authors` properties will be available in the view.

A more advanced approach is to return an instance of the Spring ModelAndView class:

    import org.springframework.web.servlet.ModelAndViewdef index = {
        def favoriteBooks = … // get some books just for the index page, perhaps your favorites    // forward to the list view to show them
        return new ModelAndView("/book/list", [ bookList : favoriteBooks ])
    }

#### Selecting the View

In both of the previous two examples there was no code that specified which view to render. So how does Grails know which view to pick? The answer lies in the conventions. For the action:

    class BookController {
    	def show = {
    	 	[ book : Book.get( params.id ) ]
    	}
    }

Grails will automatically look for a view at the location `grails-app/views/book/show.gsp` (actually Grails will try to look for a JSP first, as Grails can equally be used with JSP).

If you wish to render another view, then the render method there to help:

    def show = {
      	def map = [ book : Book.get( params.id ) ]
        render(view:"display", model:map)
    }

In this case Grails will attempt to render a view at the location `grails-app/views/book/display.gsp`. Notice that Grails automatically qualifies the view location with the `book` folder of the `grails-app/views` directory. This is convenient, but if you have some shared views you need to access instead use:

    def show = {
      	def map = [ book : Book.get( params.id ) ]
        render(view:"/shared/display", model:map)
    }

In this case Grails will attempt to render a view at the location `grails-app/views/shared/display.gsp`.

#### Rendering a Response

Sometimes its easier (typically with Ajax applications) to render snippets of text or code to the response directly from the controller. For this, the highly flexible `render` method can be used:

    render "Hello World!"

The above code writes the text "Hello World!" to the response, other examples include:

    // write some markup
    render {
       for(b in books) {
          div(id:b.id, b.title)
       }
    }
    // render a specific view
    render(view:'show')
    // render a template for each item in a collection
    render(template:'book_template', collection:Book.list())
    // render some text with encoding and content type
    render(text:"<xml>some xml</xml>",contentType:"text/xml",encoding:"UTF-8")

If you plan on using Groovy's MarkupBuilder to generate html for use with the render method becareful of naming clashes between html elements and Grails tags. e.g.

    def login = {
            StringWriter w = new StringWriter()
            def builder = new groovy.xml.MarkupBuilder(w)
            builder.html{
                head{
                    title 'Log in'
                }
                body{
                    h1 'Hello'
                    form{                }
                }
            }        def html = w.toString()
            render html
        }

Will actually call the form tag (which will return some text that will be ignored by the MarkupBuilder). To correctly output a <form> elemement, use the following:

    def login = {
            // …
            body{
                h1 'Hello'
                builder.form{            }
            }
            // …
       }

## 6.1.4 Redirects and Chaining

#### Redirects

Actions can be redirected using the redirect method present in all controllers:

    class OverviewController {
                         def login = {}                     def find = {
                             if(!session.user)
                                redirect(action:login)
                             …
                         }
                     }

Internally the redirect method uses the HttpServletResonse object's `sendRedirect` method.

The `redirect` method expects either:

- Another closure within the same controller class:

    // Call the login action within the same class
                     redirect(action:login)

- The name of a controller and action:

    // Also redirects to the index action in the home controller
                     redirect(controller:'home',action:'index')

- A URI for a resource relative the application context path:

    // Redirect to an explicit URI
                     redirect(uri:"/login.html")

- Or a full URL:

    // Redirect to a URL
                     redirect(url:"http://grails.org")

Parameters can be optionally passed from one action to the next using the `params` argument of the method:

    redirect(action:myaction, params:[myparam:"myvalue"])

These parameters are made available through the params dynamic property that also accesses request parameters. If a parameter is specified with the same name as a request parameter the request parameter is overridden and the controller parameter used.

Since the `params` object is also a map, you can use it to pass the current request parameters from one action to the next:

    redirect(action:"next", params:params)

Finally, you can also include a fragment in the target URI:

    redirect(controller: "test", action: "show", fragment: "profile")

will (depending on the URL mappings) redirect to something like "/myapp/test/show#profile".

h4. Chaining

Actions can also be chained. Chaining allows the model to be retained from one action to the next. For example calling the `first` action in the below action:

    class ExampleChainController {
                         def first = {
                             chain(action:second,model:[one:1])
                         }
                         def second  = {
                             chain(action:third,model:[two:2])
                         }
                         def third = {
                              [three:3])
                         }
                     }

Results in the model:

    [one:1, two:2, three:3]

The model can be accessed in subsequent controller actions in the chain via the `chainModel` map. This dynamic property only exists in actions following the call to the `chain` method:

    class ChainController {                     def nextInChain = {
                             def model = chainModel.myModel
                             …
                         }
                     }

Like the `redirect` method you can also pass parameters to the `chain` method:

    chain(action:"action1", model:[one:1], params:[myparam:"param1"])

## 6.1.5 Controller Interceptors

Often it is useful to intercept processing based on either request, session or application state. This can be achieved via action interceptors. There are currently 2 types of interceptors: before and after.

> If your interceptor is likely to apply to more than one controller, you are almost certainly better off writing a Filter. Filters can be applied to multiple controllers or URIs, without the need to change the logic of each controller

#### Before Interception

The `beforeInterceptor` intercepts processing before the action is executed. If it returns `false` then the intercepted action will not be executed. The interceptor can be defined for all actions in a controller as follows:

    def beforeInterceptor = {
           println "Tracing action ${actionUri}"
    }

The above is declared inside the body of the controller definition. It will be executed before all actions and does not interfere with processing. A common use case is however for authentication:

    def beforeInterceptor = [action:this.&auth,except:'login']
    // defined as a regular method so its private
    def auth() {
         if(!session.user) {
                redirect(action:'login')
                return false
         }
    }
    def login = {
         // display login page
    }

The above code defines a method called `auth`. A method is used so that it is not exposed as an action to the outside world (i.e. it is private). The `beforeInterceptor` then defines an interceptor that is used on all actions 'except' the login action and is told to execute the 'auth' method. The 'auth' method is referenced using Groovy's method pointer syntax, within the method itself it detects whether there is a user in the session otherwise it redirects to the login action and returns false, instruction the intercepted action not to be processed.

#### After Interception

To define an interceptor that is executed after an action use the `afterInterceptor` property:

    def afterInterceptor = { model ->
           println "Tracing action ${actionUri}"
    }

The after interceptor takes the resulting model as an argument and can hence perform post manipulation of the model or response.

An after interceptor may also modify the Spring MVC ModelAndView object prior to rendering. In this case, the above example becomes:

    def afterInterceptor = { model, modelAndView ->
           println "Current view is ${modelAndView.viewName}"
           if(model.someVar) modelAndView.viewName = "/mycontroller/someotherview"
           println "View is now ${modelAndView.viewName}"
    }

This allows the view to be changed based on the model returned by the current action. Note that the `modelAndView` may be `null` if the action being intercepted called redirect or render.

#### Interception Conditions

Rails users will be familiar with the authentication example and how the 'except' condition was used when executing the interceptor (interceptors are called 'filters' in Rails, this terminology conflicts with the servlet filter terminology in Java land):

    def beforeInterceptor = [action:this.&auth,except:'login']

This executes the interceptor for all actions except the specified action. A list of actions can also be defined as follows:

    def beforeInterceptor = [action:this.&auth,except:['login','register']]

The other supported condition is 'only', this executes the interceptor for only the specified actions:

    def beforeInterceptor = [action:this.&auth,only:['secure']]

## 6.1.6 Data Binding

Data binding is the act of "binding" incoming request parameters onto the properties of an object or an entire graph of objects. Data binding should deal with all necessary type conversion since request parameters, which are typically delivered via a form submission, are always strings whilst the properties of a Groovy or Java object may well not be.

Grails uses Spring's underlying data binding capability to perform data binding.

#### Binding Request Data to the Model

There are two ways to bind request parameters onto the properties of a domain class. The first involves using a domain classes' implicit constructor:

    def save = {
      def b = new Book(params)
      b.save()
    }

The data binding happens within the code `new Book(params)`. By passing the params object to the domain class constructor Grails automatically recognizes that you are trying to bind from request parameters. So if we had an incoming request like:

    /book/save?title=The%20Stand&author=Stephen%20King

Then the `title` and `author` request parameters would automatically get set on the domain class. If you need to perform data binding onto an existing instance then you can use the properties property:

    def save = {
      def b = Book.get(params.id)
      b.properties = params
      b.save()
    }

This has exactly the same effect as using the implicit constructor.

#### Data binding and Single-ended Associations

If you have a `one-to-one` or `many-to-one` association you can use Grails' data binding capability to update these relationships too. For example if you have an incoming request such as:

    /book/save?author.id=20

Grails will automatically detect the `.id` suffix on the request parameter and look-up the `Author` instance for the given id when doing data binding such as:

    def b = new Book(params)

#### Data Binding and Many-ended Associations

If you have a one-to-many or many-to-many association there are different techniques for data binding depending of the association type.

If you have a `Set` based association (default for a `hasMany`) then the simplest way to populate an association is to simply send a list of identifiers. For example consider the usage of `<g:select>` below:

    <g:select name="books"
              from="${Book.list()}"
              size="5" multiple="yes" optionKey="id"
              value="${author?.books}" />

This produces a select box that allows you to select multiple values. In this case if you submit the form Grails will automatically use the identifiers from the select box to populate the `books` association.

However, if you have a scenario where you want to update the properties of the associated objects the this technique won't work. Instead you have to use the subscript operator:

    <g:textField name="books[0].title" value="the Stand" />
    <g:textField name="books[1].title" value="the Shining" />

However, with `Set` based association it is critical that you render the mark-up in the same order that you plan to do the update in. This is because a `Set` has no concept of order, so although we're referring to `books0` and `books1` it is not guaranteed that the order of the association will be correct on the server side unless you apply some explicit sorting yourself.

This is not a problem if you use `List` based associations, since a `List` has a defined order and an index you can refer to. This is also true of `Map` based associations.

Note also that if the association you are binding to has a size of 2 and you refer to an element that is outside the size of association:

    <g:textField name="books[0].title" value="the Stand" />
    <g:textField name="books[1].title" value="the Shining" />
    <g:textField name="books[2].title" value="Red Madder" />

Then Grails will automatically create a new instance for you at the defined position. If you "skipped" a few elements in the middle:

    <g:textField name="books[0].title" value="the Stand" />
    <g:textField name="books[1].title" value="the Shining" />
    <g:textField name="books[5].title" value="Red Madder" />

Then Grails will automatically create instances in between. For example in the above case Grails will create 4 additional instances if the association being bound had a size of 2.

#### Data binding with Multiple domain classes

It is possible to bind data to multiple domain objects from the params object.

For example so you have an incoming request to:

    /book/save?book.title=The%20Stand&author.name=Stephen%20King

You'll notice the difference with the above request is that each parameter has a prefix such as `author.` or `book.` which is used to isolate which parameters belong to which type. Grails' `params` object is like a multi-dimensional hash and you can index into to isolate only a subset of the parameters to bind.

    def b = new Book(params['book'])

Notice how we use the prefix before the first dot of the `book.title` parameter to isolate only parameters below this level to bind. We could do the same with an `Author` domain class:

    def a = new Author(params['author'])

#### Data binding and type conversion errors

Sometimes when performing data binding it is not possible to convert a particular String into a particular target type. What you get is a type conversion error. Grails will retain type conversion errors inside the errors property of a Grails domain class. Take this example:

    class Book {
        …
        URL publisherURL
    }

Here we have a domain class `Book` that uses the Java concrete type `java.net.URL` to represent URLs. Now say we had an incoming request such as:

    /book/save?publisherURL=a-bad-url

In this case it is not possible to bind the string `a-bad-url` to the `publisherURL` property os a type mismatch error occurs. You can check for these like this:

    def b = new Book(params)if(b.hasErrors()) {
       println "The value ${b.errors.getFieldError('publisherURL').rejectedValue} is not a valid URL!"
    }

Although we have not yet covered error codes (for more information see the section on Validation), for type conversion errors you would want a message to use for the error inside the grails-app/i18n/messages.properties file. You can use a generic error message handler such as:

    typeMismatch.java.net.URL=The field {0} is not a valid URL

Or a more specific one:

    typeMismatch.Book.publisherURL=The publisher URL you specified is not a valid URL

#### Data Binding and Security concerns

When batch updating properties from request parameters you need to be careful not to allow clients to bind malicious data to domain classes that end up being persisted to the database. You can limit what properties are bound to a given domain class using the subscript operator:

    def p = Person.get(1)p.properties['firstName','lastName'] = params

In this case only the `firstName` and `lastName` properties will be bound.

Another way to do this is instead of using domain classes as the target of data binding you could use Command Objects. Alternatively there is also the flexible bindData method.

The `bindData` method allows the same data binding capability, but to arbitrary objects:

    def p = new Person()
    bindData(p, params)

However, the `bindData` method also allows you to exclude certain parameters that you don't want updated:

    def p = new Person()
    bindData(p, params, [exclude:'dateOfBirth'])

Or include only certain properties:

    def p = new Person()
    bindData(p, params, [include:['firstName','lastName]])

## 6.1.7 XML and JSON Responses

#### Using the render method to output XML

Grails' supports a few different ways to produce XML and JSON responses. The first one covered is via the render method.

The `render` method can be passed a block of code to do mark-up building in XML:

    def list = {
    	def results = Book.list()
    	render(contentType:"text/xml") {
    		books {
    			for(b in results) {
    				book(title:b.title)
    			}
    		}
    	}
    }

The result of this code would be something like:

    <books>
    	  <book title="The Stand" />
    	  <book title="The Shining" />
    </books>

Note that you need to be careful to avoid naming conflicts when using mark-up building. For example this code would produce an error:

    def list = {
    	def books = Book.list()  // naming conflict here
    	render(contentType:"text/xml") {
    		books {
    			for(b in results) {
    				book(title:b.title)
    			}
    		}
    	}
    }

The reason is that there is local variable `books` which Groovy attempts to invoke as a method.

#### Using the render method to output JSON

The `render` method can also be used to output JSON:

    def list = {
    	def results = Book.list()
    	render(contentType:"text/json") {
    		books = array {
    			for(b in results) {
    				book title:b.title
    			}
    		}
    	}
    }

In this case the result would be something along the lines of:

    [
    	{title:"The Stand"},
    	{title:"The Shining"}
    ]

Again the same dangers with naming conflicts apply to JSON building.

#### Automatic XML Marshalling

Grails also supports automatic marshaling of domain classes to XML via special converters.

To start off with import the `grails.converters` package into your controller:

    import grails.converters.*

Now you can use the following highly readable syntax to automatically convert domain classes to XML:

    render Book.list() as XML

The resulting output would look something like the following::

    <?xml version="1.0" encoding="ISO-8859-1"?>
    <list>
      <book id="1">
        <author>Stephen King</author>
        <title>The Stand</title>
      </book>
      <book id="2">
        <author>Stephen King</author>
        <title>The Shining</title>
      </book>
    </list>

An alternative to using the converters is to use the codecs feature of Grails. The codecs feature provides encodeAsXML and encodeAsJSON methods:

    def xml = Book.list().encodeAsXML()
    render xml

For more information on XML marshaling see the section on REST

#### Automatic JSON Marshalling

Grails also supports automatic marshaling to JSON via the same mechanism. Simply substitute `XML` with `JSON`:

    render Book.list() as JSON

The resulting output would look something like the following:

    [
    	{"id":1,
    	 "class":"Book",
    	 "author":"Stephen King",
    	 "title":"The Stand"},
    	{"id":2,
    	 "class":"Book",
    	 "author":"Stephen King",
    	 "releaseDate":new Date(1194127343161),
    	 "title":"The Shining"}
     ]

Again as an alternative you can use the `encodeAsJSON` to achieve the same effect.

## 6.1.8 More on JSONBuilder

The previous section on on XML and JSON responses covered simplistic examples of rendering XML and JSON responses. Whilst the XML builder used by Grails is the standard XmlSlurper found in Groovy, the JSON builder is a custom implementation specific to Grails.

#### JSONBuilder and Grails versions

JSONBuilder behaves different depending on the version of Grails you use. For version below 1.2 there deprecated grails.util.JSonBuilder class is used. This section covers the usage of the Grails 1.2 JSONBuilder

For backwards compatibility the old `JSonBuilder` class is used with the `render` method for older applications, if you want to use the newer/better `JSONBuilder` class then you can do so by setting the following in `Config.groovy`:

    grails.json.legacy.builder=false

#### Rendering Simple Objects

To render a simple JSON object just set properties within the context of the closure:

    render(contentType:"text/json") {
    	hello = "world"
    }

The above will produce the JSON:

    {"hello":"world"}

#### Rendering JSON Arrays

To render a list of objects simple assign a list:

    render(contentType:"text/json") {
    	categories = ['a', 'b', 'c']
    }

This will produce:

    {"categories":["a","b","c"]}

You can also render lists of complex objects, for example:

    render(contentType:"text/json") {
    	categories = [ { a = "A" }, { b = "B" } ]
    }

This will produce:

    {"categories":[ {"a":"A"} , {"b":"B"}] }

If you want to return a list as the root then you have to use the special `element` method:

    render(contentType:"text/json") {
    	element 1
    	element 2
    	element 3
    }

The above code produces:

    [1,2,3]

#### Rendering Complex Objects

Rendering complex objects can be done with closures. For example:

    render(contentType:"text/json") {
        categories = ['a', 'b', 'c']
        title ="Hello JSON"
        information = {
            pages = 10
        }
    }

The above will produce the JSON:

    {"categories":["a","b","c"],"title":"Hello JSON","information":{"pages":10}}

#### Arrays of Complex Objects

As mentioned previously you can nest complex objects within arrays using closures:

    render(contentType:"text/json") {
    	categories = [ { a = "A" }, { b = "B" } ]
    }

However, if you need to build them up dynamically then you may want to use the `array` method:

    def results = Book.list()
    render(contentType:"text/json") {
    	books = array {
    		for(b in results) {
    			book title:b.title
    		}
    	}
    }

#### Direct JSONBuilder API Access

If you don't have access to the `render` method, but still want to produce JSON you can use the API directly:

    def builder = new JSONBuilder()def result = builder.build {
        categories = ['a', 'b', 'c']
        title ="Hello JSON"
        information = {
            pages = 10
        }
    }// prints the JSON text
    println result.toString()def sw = new StringWriter()
    result.render sw

## 6.1.9 Uploading Files

#### Programmatic File Uploads

Grails supports file uploads via Spring's MultipartHttpServletRequest interface. To upload a file the first step is to create a multipart form like the one below:

    Upload Form: <br />
    	<g:form action="upload" method="post" enctype="multipart/form-data">
    		<input type="file" name="myFile" />
    		<input type="submit" />
    	</g:form>

There are then a number of ways to handle the file upload. The first way is to work with the Spring MultipartFile instance directly:

    def upload = {
        def f = request.getFile('myFile')
        if(!f.empty) {
          f.transferTo( new File('/some/local/dir/myfile.txt') )
          response.sendError(200,'Done');
        }
        else {
           flash.message = 'file cannot be empty'
           render(view:'uploadForm')
        }
    }

This is clearly handy for doing transfers to other destinations and manipulating the file directly as you can obtain an InputStream and so on via the MultipartFile interface.

#### File Uploads through Data Binding

File uploads can also be performed via data binding. For example say you have an `Image` domain class as per the below example:

    class Image {
       byte[] myFile
    }

Now if you create an image and pass in the `params` object such as the below example, Grails will automatically bind the file's contents as a byte to the `myFile` property:

    def img = new Image(params)

It is also possible to set the contents of the file as a string by changing the type of the `myFile` property on the image to a String type:

    class Image {
       String myFile
    }

## 6.1.10 Command Objects

Grails controllers support the concept of command objects. A command object is similar to a form bean in something like Struts and they are useful in circumstances when you want to populate a subset of the properties needed to update a domain class. Or where there is no domain class required for the interaction, but you need features such as data binding and validation.

#### Declaring Command Objects

Command objects are typically declared in the same source file as a controller directly below the controller class definition. For example:

    class UserController {
    	…
    }
    class LoginCommand {
       String username
       String password
       static constraints = {
               username(blank:false, minSize:6)
               password(blank:false, minSize:6)
       }
    }

As the previous example demonstrates you can supply constraints to command objects just as you can with domain classes.

#### Using Command Objects

To use command objects, controller actions may optionally specify any number of command object parameters. The parameter types must be supplied so that Grails knows what objects to create, populate and validate.

Before the controller action is executed Grails will automatically create an instance of the command object class, populate the properties of the command object with request parameters having corresponding names and the command object will be validated. For Example:

    class LoginController {
      def login = { LoginCommand cmd ->
             if(cmd.hasErrors()) {
                    redirect(action:'loginForm')
             }
             else {
                // do something else
            }
      }
    }

#### Command Objects and Dependency Injection

Command objects can participate in dependency injection. This is useful if your command object has some custom validation logic which may need to interact with Grails services:

    class LoginCommand {
        def loginService	String username
    	String password	static constraints = {
    		username(validator: { val, obj ->
    			obj.loginService.canLogin(obj.username, obj.password)
    		})
    	}
    }

In this example the command object interacts with a bean injected by name from the Spring `ApplicationContext`.

## 6.1.11 Handling Duplicate Form Submissions

Grails has built in support for handling duplicate form submissions using the "Synchronizer Token Pattern". To get started you need to define a token on the form tag:

    <g:form useToken="true" ...>

Then in your controller code you can use the withForm method to handle valid and invalid requests:

    withForm {
       // good request
    }.invalidToken {
       // bad request
    }

If you only provide the withForm method and not the chained `invalidToken` method then by default Grails will store the invalid token in a `flash.invalidToken` variable and redirect the request back to the original page. This can then be checked in the view:

    <g:if test="${flash.invalidToken}">
      Don't click the button twice!
    </g:if>

> The withForm tag makes use of the session and hence requires session affinity if used in a cluster.

## 6.1.12 Simple Type Converters

### Type Conversion Methods

If you prefer to avoid the overhead of Data Binding and simply want to convert incoming parameters (typically Strings) into another more appropriate type the params object has a number of convenience methods for each type:

    def total = params.int('total')

The above example uses the `int` method, there are also methods for `boolean`, `long`, `char`, `short` and so on. Each of these methods are null safe and safe from any parsing errors so you don't have to perform any addition checks on the parameters.

These same type conversion methods are also available on the tagLibraries parameter of GSP tags.

### Handling Multi Parameters

A common use case is dealing with multiple request parameters of the same name. For example you could get a query string such as `?name=Bob&name=Judy`.

In this case dealing with 1 parameter and dealing with many has different semantics since Groovy's iteration mechanics for `String` iterate over each character. To avoid this problem the params object provides a `list` method that always returns a list:

    for(name in params.list('name')) {
    	println name
    }

## 6.2 Groovy Server Pages

Groovy Servers Pages (or GSP for short) is Grails' view technology. It is designed to be familiar for users of technologies such as ASP and JSP, but to be far more flexible and intuitive.

In Grails GSPs live in the `grails-app/views` directory and are typically rendered automatically (by convention) or via the render method such as:

    render(view:"index")

A GSP is typically a mix of mark-up and GSP tags which aid in view rendering.

> Although it is possible to have Groovy logic embedded in your GSP and doing this will be covered in this document the practice is strongly discouraged. Mixing mark-up and code is a bad thing and most GSP pages contain no code and needn't do so.

A GSP typically has a "model" which is a set of variables that are used for view rendering. The model is passed to the GSP view from a controller. For example consider the following controller action:

    def show = {
    	[book: Book.get(params.id)]
    }

This action will look-up a `Book` instance and create a model that contains a key called `book`. This key can then be reference within the GSP view using the name `book`:

    <%=book.title%>

## 6.2.1 GSP Basics

In the next view sections we'll go through the basics of GSP and what is available to you. First off let's cover some basic syntax that users of JSP and ASP should be familiar with.

GSP supports the usage of `<% %>` blocks to embed Groovy code (again this is discouraged):

    <html>
       <body>
         <% out << "Hello GSP!" %>
       </body>
    </html>

As well as this syntax you can also use the `<%= %>` syntax to output values:

    <html>
       <body>
         <%="Hello GSP!" %>
       </body>
    </html>

GSP also supports JSP-style server-side comments as the following example demonstrates:

    <html>
       <body>
    	 <%-- This is my comment --%>
         <%="Hello GSP!" %>
       </body>
    </html>

## 6.2.1.1 Variables and Scopes

Within the `<% %>` brackets you can of course declare variables:

    <% now = new Date() %>

And then re-use those variables further down the page:

    <%=now%>

However, within the scope of a GSP there are a number of pre-defined variables including:

- `application` - The javax.servlet.ServletContext instance
- `applicationContext` The Spring ApplicationContext instance
- `flash` - The flash object
- `grailsApplication` - The GrailsApplication instance
- `out` - The response writer for writing to the output stream
- `params` - The params object for retrieving request parameters
- `request` - The HttpServletRequest instance
- `response` - The HttpServletResponse instance
- `session` - The HttpSession instance
- `webRequest` - The GrailsWebRequest instance

## 6.2.1.2 Logic and Iteration

Using the `<% %>` syntax you can of course embed loops and so on using this syntax:

    <html>
       <body>
          <% [1,2,3,4].each { num -> %>
             <p><%="Hello ${num}!" %></p>
          <%}%>
       </body>
    </html>

As well as logical branching:

    <html>
       <body>
          <% if(params.hello == 'true' )%>
          <%="Hello!"%>
          <% else %>
          <%="Goodbye!"%>
       </body>
    </html>

## 6.2.1.3 Page Directives

GSP also supports a few JSP-style page directives.

The import directive allows you to import classes into the page. However, it is rarely needed due to Groovy's default imports and GSP Tags:

    <%@ page import="java.awt.*" %>

GSP also supports the contentType directive:

    <%@ page contentType="text/json" %>

The contentType directive allows using GSP to render other formats.

## 6.2.1.4 Expressions

In GSP the `<%= %>` syntax introduced earlier is rarely used due to the support for GSP expressions. It is present mainly to allow ASP and JSP developers to feel at home using GSP. A GSP expression is similar to a JSP EL expression or a Groovy GString and takes the form `${expr}`:

    <html>
      <body>
        Hello ${params.name}
      </body>
    </html>

However, unlike JSP EL you can have any Groovy expression within the `${..}` parenthesis. Variables within the `${..}` are not escaped by default, so any HTML in the variable's string is output directly to the page. To reduce the risk of Cross-site-scripting (XSS) attacks, you can enable automatic HTML escaping via the `grails.views.default.codec` setting in `grails-app/conf/Config.groovy`:

    grails.views.default.codec='html'

Other possible values are 'none' (for no default encoding) and 'base64'.

## 6.2.2 GSP Tags

Now that the less attractive JSP heritage has been set aside, the following sections cover GSP's built-in tags, which are the favored way to define GSP pages.

> The section on Tag Libraries covers how to add your own custom tag libraries.

All built-in GSP tags start with the prefix `g:`. Unlike JSP, you don't need to specify any tag library imports. If a tag starts with `g:` it is automatically assumed to be a GSP tag. An example GSP tag would look like:

    <g:example />

GSP tags can also have a body such as:

    <g:example>
       Hello world
    </g:example>

Expressions can be passed into GSP tag attributes, if an expression is not used it will be assumed to be a String value:

    <g:example attr="${new Date()}">
       Hello world
    </g:example>

Maps can also be passed into GSP tag attributes, which are often used for a named parameter style syntax:

    <g:example attr="${new Date()}" attr2="[one:1, two:2, three:3]">
       Hello world
    </g:example>

Note that within the values of attributes you must use single quotes for Strings:

    <g:example attr="${new Date()}" attr2="[one:'one', two:'two']">
       Hello world
    </g:example>

With the basic syntax out the way, the next sections look at the tags that are built into Grails by default.

## 6.2.2.1 Variables and Scopes

Variables can be defined within a GSP using the set tag:

    <g:set var="now" value="${new Date()}" />

Here we assign a variable called `now` to the result of a GSP expression (which simply constructs a new `java.util.Date` instance). You can also use the body of the `<g:set>` tag to define a variable:

    <g:set var="myHTML">
       Some re-usable code on: ${new Date()}
    </g:set>

Variables can also be placed in one of the following scopes:

- `page` - Scoped to the current page (default)
- `request` - Scoped to the current request
- `flash` - Placed within flash scope and hence available for the next request
- `session` - Scoped for the user session
- `application` - Application-wide scope.

To select which scope a variable is placed into use the `scope` attribute:

    <g:set var="now" value="${new Date()}" scope="request" />

## 6.2.2.2 Logic and Iteration

GSP also supports logical and iterative tags out of the box. For logic there are if, else and elseif which support your typical branching scenarios:

    <g:if test="${session.role == 'admin'}">
       <%-- show administrative functions --%>
    </g:if>
    <g:else>
       <%-- show basic functions --%>
    </g:else>

For iteration GSP has the each and while tags:

    <g:each in="${[1,2,3]}" var="num">
       <p>Number ${num}</p>
    </g:each><g:set var="num" value="${1}" />
    <g:while test="${num < 5 }">
        <p>Number ${num++}</p>
    </g:while>

## 6.2.2.3 Search and Filtering

If you have collections of objects you often need to sort and filter them in some way. GSP supports the findAll and grep for this task:

    Stephen King's Books:
    <g:findAll in="${books}" expr="it.author == 'Stephen King'">
         <p>Title: ${it.title}</p>
    </g:findAll>

The `expr` attribute contains a Groovy expression that can be used as a filter. Speaking of filters the grep tag does a similar job such as filter by class:

    <g:grep in="${books}" filter="NonFictionBooks.class">
         <p>Title: ${it.title}</p>
    </g:grep>

Or using a regular expression:

    <g:grep in="${books.title}" filter="~/.*?Groovy.*?/">
         <p>Title: ${it}</p>
    </g:grep>

The above example is also interesting due to its usage of GPath. GPath is Groovy's equivalent to an XPath like language. Essentially the `books` collection is a collection of `Book` instances. However assuming each `Book` has a `title`, you can obtain a list of Book titles using the expression `books.title`. Groovy will auto-magically go through the list of Book instances, obtain each title, and return a new list!

## 6.2.2.4 Links and Resources

GSP also features tags to help you manage linking to controllers and actions. The link tag allows you to specify controller and action name pairing and it will automatically work out the link based on the URL Mappings, even if you change them! Some examples of the link can be seen below:

    <g:link action="show" id="1">Book 1</g:link>
    <g:link action="show" id="${currentBook.id}">${currentBook.name}</g:link>
    <g:link controller="book">Book Home</g:link>
    <g:link controller="book" action="list">Book List</g:link>
    <g:link url="[action:'list',controller:'book']">Book List</g:link>
    <g:link action="list" params="[sort:'title',order:'asc',author:currentBook.author]">
         Book List
    </g:link>

## 6.2.2.5 Forms and Fields

#### Form Basics

GSP supports many different tags for aiding in dealing with HTML forms and fields, the most basic of which is the form tag. The `form` tag is a controller/action aware version of the regular HTML form tag. The `url` attribute allows you to specify which controller and action to map to:

    <g:form name="myForm" url="[controller:'book',action:'list']">...</g:form>

In this case we create a form called `myForm` that submits to the `BookController`'s `list` action. Beyond that all of the usual HTML attributes apply.

#### Form Fields

As well as easy construction of forms GSP supports custom tags for dealing with different types of fields including:

- textField - For input fields of type 'text'
- checkBox - For input fields of type 'checkbox'
- radio - For input fields of type 'radio'
- hiddenField - For input fields of type 'hidden'
- select - For dealing with HTML select boxes

Each of these allow GSP expressions as the value:

    <g:textField name="myField" value="${myValue}" />

GSP also contains extended helper versions of the above tags such as radioGroup (for creating groups of radio tags), localeSelect, currencySelect and timeZoneSelect (for selecting locale's, currencies and time zone's respectively).

#### Multiple Submit Buttons

The age old problem of dealing with multiple submit buttons is also handled elegantly with Grails via the actionSubmit tag. It is just like a regular submit, but allows you to specify an alternative action to submit to:

    <g:actionSubmit value="Some update label" action="update" />

## 6.2.2.6 Tags as Method Calls

One major different between GSP tags and other tagging technologies is that GSP tags can be called as either regular tags or as method calls from either controllers, tag libraries or GSP views.

#### Tags as method calls from GSPs

When called as methods tags return their results as a String instead of writing directly to the response. So for example the createLinkTo tag can equally be called as a method:

    Static Resource: ${createLinkTo(dir:"images", file:"logo.jpg")}

This is particularly useful when you need to use a tag within an attribute:

    <img src="${createLinkTo(dir:'images', file:'logo.jpg')}" />

In view technologies that don't support this feature you have to nest tags within tags, which becomes messy quickly and often has an adverse effect of WYSWIG tools such as Dreamweaver that attempt to render the mark-up as it is not well-formed:

    <img src="<g:createLinkTo dir="images" file="logo.jpg" />" />

#### Tags as method calls from Controllers and Tag Libraries

You can also invoke tags from controllers and tag libraries. Tags within the default `g:` namespace can be invoked without the prefix and a String result is returned:

    def imageLocation = createLinkTo(dir:"images", file:"logo.jpg")

However, you can also prefix the namespace to avoid naming conflicts:

    def imageLocation = g.createLinkTo(dir:"images", file:"logo.jpg")

If you have a custom namespace you can use that prefix instead (Example using the FCK Editor plugin):

    def editor = fck.editor()

## 6.2.3 Views and Templates

As well as views, Grails has the concept of templates. Templates are useful for separating out your views into maintainable chunks and combined with Layouts provide a highly re-usable mechanism for structure views.

#### Template Basics

Grails uses the convention of placing an underscore before the name of a view to identify it as a template. For example a you may have a template that deals with rendering Books located at `grails-app/views/book/_bookTemplate.gsp`:

    <div class="book" id="${book?.id}">
       <div>Title: ${book?.title}</div>
       <div>Author: ${book?.author?.name}</div>
    </div>

To render this template from one of the views in `grails-app/views/book` you can use the render tag:

    <g:render template="bookTemplate" model="[book:myBook]" />

Notice how we pass into a model to use using the `model` attribute of the render tag. If you have multiple `Book` instances you can also render the template for each `Book` using the render tag:

    <g:render template="bookTemplate" var="book" collection="${bookList}" />

#### Shared Templates

In the previous example we had a template that was specific to the `BookController` and its views at `grails-app/views/book`. However, you may want to share templates across your application.

In this case you can place them in the root views directory at grails-app/views or any subdirectory below that location and then with the template attribute use a `/` before the template name to indicate the relative template path. For example if you had a template called `grails-app/views/shared/_mySharedTemplate.gsp`, you could reference it as follows:

    <g:render template="/shared/mySharedTemplate" />

You can also use this technique to reference templates in any directory from any view or controller:

    <g:render template="/book/bookTemplate" model="[book:myBook]" />

#### The Template Namespace

Since templates are used so frequently there is template namespace, called `tmpl`, available that makes using templates easier. Consider for example the following usage pattern:

    <g:render template="bookTemplate" model="[book:myBook]" />

This can be expressed with the `tmpl` namespace as follows:

    <tmpl:bookTemplate book="${myBook}" />

#### Templates in Controllers and Tag Libraries

You can also render templates from controllers using the render method found within controllers, which is useful for Ajax applications:

    def show = {
        def b = Book.get(params.id)
    	render(template:"bookTemplate", model:[book:b])
    }

The render method within controllers writes directly to the response, which is the most common behaviour. If you need to instead obtain the result of template as a String you can use the render tag:

    def show = {
        def b = Book.get(params.id)
    	String content = g.render(template:"bookTemplate", model:[book:b])
    	render content
    }

Notice the usage of the `g.` namespace which tells Grails we want to use the tag as method call instead of the render method.

## 6.2.4 Layouts with Sitemesh

#### Creating Layouts

Grails leverages Sitemesh, a decorator engine, to support view layouts. Layouts are located in the `grails-app/views/layouts` directory. A typical layout can be seen below:

    <html>
          <head>
              <title><g:layoutTitle default="An example decorator" /></title>
              <g:layoutHead />
          </head>
          <body onload="${pageProperty(name:'body.onload')}">
                <div class="menu"><!--my common menu goes here--></menu>
                     <div class="body">
                          <g:layoutBody />
                     </div>
                </div>
          </body>
    </html>

The key elements are the layoutHead, layoutTitle and layoutBody tag usages, here is what they do:

- `layoutTitle` - outputs the target page's title
- `layoutHead` - outputs the target pages head tag contents
- `layoutBody` - outputs the target pages body tag contents

The previous example also demonstrates the pageProperty tag which can be used to inspect and return aspects of the target page.

#### Triggering Layouts

There are a few ways to trigger a layout. The simplest is to add a meta tag to the view:

    <html>
        <head>
    	    <title>An Example Page</title>
            <meta name="layout" content="main"></meta>
        </head>
        <body>This is my content!</body>
    </html>

In this case a layout called `grails-app/views/layouts/main.gsp` will be used to layout the page. If we were to use the layout from the previous section the output would resemble the below:

    <html>
          <head>
              <title>An Example Page</title>
          </head>
          <body onload="">
            <div class="menu"><!--my common menu goes here--></div>
                     <div class="body">
    					This is my content!
                     </div>
          </body>
    </html>

#### Specifying A Layout In A Controller

Another way to specify a layout is to specify the name of the layout by assigning a value to the "layout" property in a controller. For example, if you have a controller such as:

    class BookController {
        static layout = 'customer'    def list = {  … }
    }

You can create a layout called `grails-app/views/layouts/customer.gsp` which will be applied to all views that the `BookController` delegates to. The value of the "layout" property may contain a directory structure relative to the `grails-app/views/layouts/` directory. For example:

    class BookController {
        static layout = 'custom/customer'    def list = {  … }
    }

Views rendered from that controller would be decorated with the `grails-app/views/layouts/custom/customer.gsp` template.

#### Layout by Convention

Another way to associate layouts is to use "layout by convention". For example, if you have a controller such as:

    class BookController {
        def list = {  … }
    }

You can create a layout called `grails-app/views/layouts/book.gsp`, by convention, which will be applied to all views that the `BookController` delegates to.

Alternatively, you can create a layout called `grails-app/views/layouts/book/list.gsp` which will only be applied to the `list` action within the `BookController`.

If you have both the above mentioned layouts in place the layout specific to the action will take precedence when the list action is executed.

#### Inline Layouts

Grails' also supports Sitemesh's concept of inline layouts with the applyLayout tag. The `applyLayout` tag can be used to apply a layout to a template, URL or arbitrary section of content. Essentially, this allows to even further modularize your view structure by "decorating" your template includes.

Some examples of usage can be seen below:

    <g:applyLayout name="myLayout" template="bookTemplate" collection="${books}" /><g:applyLayout name="myLayout" url="http://www.google.com" /><g:applyLayout name="myLayout">
    The content to apply a layout to
    </g:applyLayout>

#### Server-Side Includes

While the applyLayout tag is useful for applying layouts to external content, if you simply want to include external content in the current page you can do so with the include:

    <g:include controller="book" action="list"></g:include>

You can even combine the include tag and the applyLayout tag for added flexibility:

    <g:applyLayout name="myLayout">
       <g:include controller="book" action="list"></g:include>
    </g:applyLayout>

Finally, you can also call the include tag from a controller or tag library as a method:

    def content = include(controller:"book", action:"list")

The resulting content will be provided via the return value of the include tag.

## 6.2.5 Sitemesh Content Blocks

Although it is useful to decorate an entire page sometimes you may find the need to decorate independent sections of your site. To do this you can use content blocks. To get started you need to divide the page to be decorate using the `<content>` tag:

    <content tag="navbar">
    … draw the navbar here…
    </content>
    <content tag="header">
    … draw the header here…
    </content>
    <content tag="footer">
    … draw the footer here…
    </content>
    <content tag="body">
    … draw the body here…
    </content>

Then within the layout you can reference these components and apply individual layouts to each:

    <html>
    	<body>
    		<div id="header">
    			<g:applyLayout name="headerLayout"><g:pageProperty name="page.header"></g:applyLayout>
    		</div>
    		<div id="nav">
    			<g:applyLayout name="navLayout"><g:pageProperty name="page.navbar"></g:applyLayout>
    		</div>
    		<div id="body">
    			<g:applyLayout name="bodyLayout"><g:pageProperty name="page.body"></g:applyLayout>
    		</div>
    		<div id="footer">
    			<g:applyLayout name="footerLayout"><g:pageProperty name="page.footer"></g:applyLayout>
    		</div>
    	</body>
    </html>

## 6.3 Tag Libraries

Like Java Server Pages (JSP), GSP supports the concept of custom tag libraries. Unlike JSP, Grails tag library mechanism is simply, elegant and completely reload-able at runtime.

Quite simply, to create a tag library create a Groovy class that ends with the convention `TagLib` and place it within the `grails-app/taglib` directory:

    class SimpleTagLib {}

Now to create a tag simply create property that is assigned a block of code that takes two arguments: The tag attributes and the body content:

    class SimpleTagLib {
    	def simple = { attrs, body ->    }
    }

The `attrs` argument is a simple map of the attributes of the tag, whilst the `body` argument is another invokable block of code that returns the body content:

    class SimpleTagLib {
    	def emoticon = { attrs, body ->
    	   out << body() << (attrs.happy == 'true' ? " :-)" : " :-(")
        }
    }

As demonstrated above there is an implicit `out` variable that refers to the output `Writer` which you can use to append content to the response. Then you can simply reference the tag inside your GSP, no imports necessary:

    <g:emoticon happy="true">Hi John</g:emoticon>

## 6.3.1 Variables and Scopes

Within the scope of a tag library there are a number of pre-defined variables including:

- `actionName` - The currently executing action name
- `controllerName` - The currently executing controller name
- `flash` - The flash object
- `grailsApplication` - The GrailsApplication instance
- `out` - The response writer for writing to the output stream
- `pageScope` - A reference to the pageScope object used for GSP rendering (i.e. the binding)
- `params` - The params object for retrieving request parameters
- `pluginContextPath` - The context path to the plugin that contains the tag library
- `request` - The HttpServletRequest instance
- `response` - The HttpServletResponse instance
- `servletContext` - The javax.servlet.ServletContext instance
- `session` - The HttpSession instance

## 6.3.2 Simple Tags

As demonstrated it the previous example it is trivial to write simple tags that have no body and merely output content. Another example is a `dateFormat` style tag:

    def dateFormat = { attrs, body ->
    	out << new java.text.SimpleDateFormat(attrs.format).format(attrs.date)
    }

The above uses Java's `SimpleDateFormat` class to format a date and then write it to the response. The tag can then be used within a GSP as follows:

    <g:dateFormat format="dd-MM-yyyy" date="${new Date()}" />

With simple tags sometimes you need to write HTML mark-up to the response. One approach would be to embed the content directly:

    def formatBook = { attrs, body ->
        out << "<div id="${attrs.book.id}">"
        out << "Title : ${attrs.book.title}"
    	out << "</div>"
    }

Although this approach may be tempting it is not very clean. A better approach would be to re-use the render tag:

    def formatBook = { attrs, body ->
        out << render(template:"bookTemplate", model:[book:attrs.book])
    }

And then have a separate GSP template that does the actual rendering.

## 6.3.3 Logical Tags

You can also create logical tags where the body of the tag is only output once a set of conditions have been met. An example of this may be a set of security tags:

    def isAdmin = { attrs, body ->
         def user = attrs['user']
         if(user != null && checkUserPrivs(user)) {
               out << body()
         }
    }

The tag above checks if the user is an administrator and only outputs the body content if he/she has the correct set of access privileges:

    <g:isAdmin user="${myUser}">
        // some restricted content
    </g:isAdmin>

## 6.3.4 Iterative Tags

Iterative tags are trivial too, since you can invoke the body multiple times:

    def repeat = { attrs, body ->
        attrs.times?.toInteger().times { num ->
            out << body(num)
        }
    }

In this example we check for a `times` attribute and if it exists convert it to a number then use Groovy's `times` method to iterate by the number of times specified by the number:

    <g:repeat times="3">
    <p>Repeat this 3 times! Current repeat = ${it}</p>
    </g:repeat>

Notice how in this example we use the implicit `it` variable to refer to the current number. This works because when we invoked the body we passed in the current value inside the iteration:

    out << body(num)

That value is then passed as the default variable `it` to the tag. However, if you have nested tags this can lead to conflicts, hence you should should instead name the variables that the body uses:

    def repeat = { attrs, body ->
    	def var = attrs.var ? attrs.var : "num"
        attrs.times?.toInteger().times { num ->
            out << body((var):num)
        }
    }

Here we check if there is a `var` attribute and if there is use that as the name to pass into the body invocation on this line:

    out << body((var):num)

> Note the usage of the parenthesis around the variable name. If you omit these Groovy assumes you are using a String key and not referring to the variable itself.

Now we can change the usage of the tag as follows:

    <g:repeat times="3" var="j">
    <p>Repeat this 3 times! Current repeat = ${j}</p>
    </g:repeat>

Notice how we use the `var` attribute to define the name of the variable `j` and then we are able to reference that variable within the body of the tag.

## 6.3.5 Tag Namespaces

By default, tags are added to the default Grails namespace and are used with the `g:` prefix in GSP pages. However, you can specify a different namespace by adding a static property to your `TagLib` class:

    class SimpleTagLib {
        static namespace = "my"    def example = { attrs ->
            …
        }
    }

Here we have specified a `namespace` of `my` and hence the tags in this tag lib must then be referenced from GSP pages like this:

    <my:example name="..." />

Where the prefix is the same as the value of the static `namespace` property. Namespaces are particularly useful for plugins.

Tags within namespaces can be invoked as methods using the namespace as a prefix to the method call:

    out << my.example(name:"foo")

This works from GSP, controllers or tag libraries

## 6.3.6 Using JSP Tag Libraries

In addition to the simplified tag library mechanism provided by GSP, you can also use JSP tags from GSP. To do so simply declare the JSP you want to use via the `taglib` directive:

    <%@ taglib prefix="fmt" uri="http://java.sun.com/jsp/jstl/fmt" %>

Then you can use it like any other tag:

    <fmt:formatNumber value="${10}" pattern=".00"/>

With the added bonus that you can invoke JSP tags like methods:

    ${fmt.formatNumber(value:10, pattern:".00")}

## 6.3.7 Tag return value

Since Grails 1.2, a tag library call returns an instance of `org.codehaus.groovy.grails.web.util.StreamCharBuffer` class by default. This change improves performance by reducing object creation and optimizing buffering during request processing. In earlier Grails versions, a `java.lang.String` instance was returned.

Tag libraries can also return direct object values to the caller since Grails 1.2.. Object returning tag names are listed in a static `returnObjectForTags` property in the tag library class.

Example:

    class ObjectReturningTagLib {
    	static namespace = "cms"
    	static returnObjectForTags = ['content']	def content = { attrs, body ->
    		CmsContent.findByCode(attrs.code)?.content
        }
    }

## 6.4 URL Mappings

Throughout the documentation so far the convention used for URLs has been the default of `/controller/action/id`. However, this convention is not hard wired into Grails and is in fact controlled by a URL Mappings class located at `grails-app/conf/UrlMappings.groovy`.

The `UrlMappings` class contains a single property called `mappings` that has been assigned a block of code:

    class UrlMappings {
        static mappings = {
        }
    }

## 6.4.1 Mapping to Controllers and Actions

To create a simple mapping simply use a relative URL as the method name and specify named parameters for the controller and action to map to:

    "/product"(controller:"product", action:"list")

In this case we've mapped the URL `/product` to the `list` action of the `ProductController`. You could of course omit the action definition to map to the default action of the controller:

    "/product"(controller:"product")

An alternative syntax is to assign the controller and action to use within a block passed to the method:

    "/product" {
    	controller = "product"
    	action = "list"
    }

Which syntax you use is largely dependent on personal preference. If you simply want to rewrite on URI onto another explicit URI (rather than a controller/action pair) this can be achieved with the following example:

    "/hello"(uri:"/hello.dispatch")

Rewriting specific URIs is often useful when integrating with other frameworks.

## 6.4.2 Embedded Variables

#### Simple Variables

The previous section demonstrated how to map trivial URLs with concrete "tokens". In URL mapping speak tokens are the sequence of characters between each slash / character. A concrete token is one which is well defined such as as `/product`. However, in many circumstances you don't know what the value of a particular token will be until runtime. In this case you can use variable placeholders within the URL for example:

    static mappings = {
      "/product/$id"(controller:"product")
    }

In this case by embedding a $id variable as the second token Grails will automatically map the second token into a parameter (available via the params object) called `id`. For example given the URL `/product/MacBook`, the following code will render "MacBook" to the response:

    class ProductController {
         def index = { render params.id }
    }

You can of course construct more complex examples of mappings. For example the traditional blog URL format could be mapped as follows:

    static mappings = {
       "/$blog/$year/$month/$day/$id"(controller:"blog", action:"show")
    }

The above mapping would allow you to do things like:

    /graemerocher/2007/01/10/my_funky_blog_entry

The individual tokens in the URL would again be mapped into the params object with values available for `year`, `month`, `day`, `id` and so on.

#### Dynamic Controller and Action Names

Variables can also be used to dynamically construct the controller and action name. In fact the default Grails URL mappings use this technique:

    static mappings = {
        "/$controller/$action?/$id?"()
    }

Here the name of the controller, action and id are implicitly obtained from the variables `controller`, `action` and `id` embedded within the URL.

You can also resolve the controller name and action name to execute dynamically using a closure:

    static mappings = {
        "/$controller" {
    	   action = { params.goHere }
        }
    }

#### Optional Variables

Another characteristic of the default mapping is the ability to append a `?` at the end of a variable to make it an optional token. In a further example this technique could be applied to the blog URL mapping to have more flexible linking:

    static mappings = {
       "/$blog/$year?/$month?/$day?/$id?"(controller:"blog", action:"show")
    }

With this mapping all of the below URLs would match with only the relevant parameters being populated in the params object:

    /graemerocher/2007/01/10/my_funky_blog_entry
    /graemerocher/2007/01/10
    /graemerocher/2007/01
    /graemerocher/2007
    /graemerocher

#### Arbitrary Variables

You can also pass arbitrary parameters from the URL mapping into the controller by merely setting them in the block passed to the mapping:

    "/holiday/win" {
         id = "Marrakech"
         year = 2007
    }

This variables will be available within the params object passed to the controller.

#### Dynamically Resolved Variables

The hard coded arbitrary variables are useful, but sometimes you need to calculate the name of the variable based on runtime factors. This is also possible by assigning a block to the variable name:

    "/holiday/win" {
         id = { params.id }
         isEligible = { session.user != null } // must be logged in
    }

In the above case the code within the blocks is resolved when the URL is actually matched and hence can be used in combination with all sorts of logic.

## 6.4.3 Mapping to Views

If you want to resolve a URL to a view, without a controller or action involved, you can do so too. For example if you wanted to map the root URL `/` to a GSP at the location `grails-app/views/index.gsp` you could use:

    static mappings = {
          "/"(view:"/index")  // map the root URL
    }

Alternatively if you need a view that is specific to a given controller you could use:

    static mappings = {
       "/help"(controller:"site",view:"help") // to a view for a controller
    }

## 6.4.4 Mapping to Response Codes

Grails also allows you to map HTTP response codes to controllers, actions or views. All you have to do is use a method name that matches the response code you are interested in:

    static mappings = {
       "500"(controller:"errors", action:"serverError")
       "404"(controller:"errors", action:"notFound")
       "403"(controller:"errors", action:"forbidden")
    }

Or alternatively if you merely want to provide custom error pages:

    static mappings = {
       "500"(view:"/errors/serverError")
       "404"(view:"/errors/notFound")
       "403"(view:"/errors/forbidden")
    }

## 6.4.5 Mapping to HTTP methods

URL mappings can also be configured to map based on the HTTP method (GET, POST, PUT or DELETE). This is extremely useful for RESTful APIs and for restricting mappings based on HTTP method.

As an example the following mappings provide a RESTful API URL mappings for the `ProductController`:

    static mappings = {
       "/product/$id"(controller:"product"){
           action = [GET:"show", PUT:"update", DELETE:"delete", POST:"save"]
       }
    }

## 6.4.6 Mapping Wildcards

Grails' URL mappings mechanism also supports wildcard mappings. For example consider the following mapping:

    static mappings = {
    	"/images/*.jpg"(controller:"image")
    }

This mapping will match all paths to images such as `/image/logo.jpg`. Of course you can achieve the same effect with a variable:

    static mappings = {
    	"/images/$name.jpg"(controller:"image")
    }

However, you can also use double wildcards to match more than one level below:

    static mappings = {
    	"/images/**.jpg"(controller:"image")
    }

In this cases the mapping will match `/image/logo.jpg` as well as `/image/other/logo.jpg`. Even better you can use a double wildcard variable:

    static mappings = {
    	// will match /image/logo.jpg and /image/other/logo.jpg
    	"/images/$name**.jpg"(controller:"image")
    }

In this case it will store the path matched by the wildcard inside a `name` parameter obtainable from the params object:

    def name = params.name
    println name // prints "logo" or "other/logo"

If you are using wildcard URL mappings then you may want to exclude certain URIs from Grails' URL mapping process. To do this you can provide an `excludes` setting inside the `UrlMappings.groovy` class:

    class UrlMappings = {
    	static excludes = ["/images/**", "/css/**"]
    	static mappings = {
    		…
    	}
    }

In this case Grails won't attempt to match any URIs that start with `/images` or `/css`.

## 6.4.7 Automatic Link Re-Writing

Another great feature of URL mappings is that they automatically customize the behaviour of the link tag so that changing the mappings don't require you to go and change all of your links.

This is done through a URL re-writing technique that reverse engineers the links from the URL mappings. So given a mapping such as the blog one from an earlier section:

    static mappings = {
       "/$blog/$year?/$month?/$day?/$id?"(controller:"blog", action:"show")
    }

If you use the link tag as follows:

    <g:link controller="blog" action="show" params="[blog:'fred', year:2007]">My Blog</g:link>
    <g:link controller="blog" action="show" params="[blog:'fred', year:2007, month:10]">My Blog - October 2007 Posts</g:link>

Grails will automatically re-write the URL in the correct format:

    <a href="/fred/2007">My Blog</a>
    <a href="/fred/2007/10">My Blog - October 2007 Posts</a>

## 6.4.8 Applying Constraints

URL Mappings also support Grails' unified validation constraints mechanism, which allows you to further "constrain" how a URL is matched. For example, if we revisit the blog sample code from earlier, the mapping currently looks like this:

    static mappings = {
       "/$blog/$year?/$month?/$day?/$id?"(controller:"blog", action:"show")
    }

This allows URLs such as:

    /graemerocher/2007/01/10/my_funky_blog_entry

However, it would also allow:

    /graemerocher/not_a_year/not_a_month/not_a_day/my_funky_blog_entry

This is problematic as it forces you to do some clever parsing in the controller code. Luckily, URL Mappings can be constrained to further validate the URL tokens:

    "/$blog/$year?/$month?/$day?/$id?" {
         controller = "blog"
         action = "show"
         constraints {
              year(matches:/\d{4}/)
              month(matches:/\d{2}/)
              day(matches:/\d{2}/)
         }
    }

In this case the constraints ensure that the `year`, `month` and `day` parameters match a particular valid pattern thus relieving you of that burden later on.

## 6.4.9 Named URL Mappings

URL Mappings also support named mappings. Simply put, named mappings are mappings which have a name associated with them. The name may be used to refer to a specific mapping when links are being generated.

The syntax for defining a named mapping is as follows:

    static mappings = {
       name <mapping name>: <url pattern> {
          // …
       }
    }

An example:

    static mappings = {
        name personList: "/showPeople" {
            controller = 'person'
            action = 'list'
        }
        name accountDetails: "/details/$acctNumber" {
            controller = 'product'
            action = 'accountDetails'
        }
    }

The mapping may be referenced in a link tag in a GSP.

    <g:link mapping="personList">List People</g:link>

That would result in:

    <a href="/showPeople">List People</a>

Parameters may be specified using the params attribute.

    <g:link mapping="accountDetails" params="[acctNumber:'8675309']">Show Account</g:link>

That would result in:

    <a href="/details/8675309">Show Account</a>

Alternatively you may reference a named mapping using the link namespace.

    <link:personList>List People</link:personList>

That would result in:

    <a href="/showPeople">List People</a>

The link namespace approach allows parameters to be specified as attributes.

    <link:accountDetails acctNumber="8675309">Show Account</link:accountDetails>

That would result in:

    <a href="/details/8675309">Show Account</a>

## 6.5 Web Flow

#### Overview

Grails supports the creation of web flows built on the Spring Web Flow project. A web flow is a conversation that spans multiple requests and retains state for the scope of the flow. A web flow also has a defined start and end state.

Web flows don't require an HTTP session, but instead store their state in a serialized form, which is then restored using a flow execution key that Grails passes around as a request parameter. This makes flows far more scalable than other forms of stateful application that use the HttpSession and its inherit memory and clustering concerns.

Web flow is essentially an advanced state machine that manages the "flow" of execution from one state to the next. Since the state is managed for you, you don't have to be concerned with ensuring that users enter an action in the middle of some multi step flow, as web flow manages that for you. This makes web flow perfect for use cases such as shopping carts, hotel booking and any application that has multi page work flows.

#### Creating a Flow

To create a flow create a regular Grails controller and then add an action that ends with the convention `Flow`. For example:

    class BookController {
       def index = {
          redirect(action:"shoppingCart")
       }
       def shoppingCartFlow = {
            …
       }
    }

Notice when redirecting or referring to the flow as an action we omit the `Flow` suffix. In other words the name of the action of the above flow is `shoppingCart`.

## 6.5.1 Start and End States

As mentioned before a flow has a defined start and end state. A start state is the state which is entered when a user first initiates a conversation (or flow). The start state of A Grails flow is the first method call that takes a block. For example:

    class BookController {
       …
       def shoppingCartFlow = {
           showCart {
               on("checkout").to "enterPersonalDetails"
               on("continueShopping").to "displayCatalogue"
           }
           …
           displayCatalogue {
                redirect(controller:"catalogue", action:"show")
           }
           displayInvoice()
       }
    }

Here the `showCart` node is the start state of the flow. Since the showCart state doesn't define an action or redirect it is assumed be a view state that, by convention, refers to the view `grails-app/views/book/shoppingCart/showCart.gsp`.

Notice that unlike regular controller actions, the views are stored within a directory that matches the name of the flow: `grails-app/views/book/shoppingCart`.

The `shoppingCart` flow also has two possible end states. The first is `displayCatalogue` which performs an external redirect to another controller and action, thus exiting the flow. The second is `displayInvoice` which is an end state as it has no events at all and will simply render a view called `grails-app/views/book/shoppingCart/displayInvoice.gsp` whilst ending the flow at the same time.

Once a flow has ended it can only be resumed from the start state, in this case `showCart`, and not from any other state.

## 6.5.2 Action States and View States

#### View states

A view state is a one that doesn't define an `action` or a `redirect`. So for example the below is a view state:

    enterPersonalDetails {
       on("submit").to "enterShipping"
       on("return").to "showCart"
    }

It will look for a view called `grails-app/views/book/shoppingCart/enterPersonalDetails.gsp` by default. Note that the `enterPersonalDetails` state defines two events: `submit` and `return`. The view is responsible for triggering these events. If you want to change the view to be rendered you can do so with the render method:

    enterPersonalDetails {
       render(view:"enterDetailsView")
       on("submit").to "enterShipping"
       on("return").to "showCart"
    }

Now it will look for `grails-app/views/book/shoppingCart/enterDetailsView.gsp`. If you want to use a shared view, start with a / in view argument:

    enterPersonalDetails {
       render(view:"/shared/enterDetailsView")
       on("submit").to "enterShipping"
       on("return").to "showCart"
    }

Now it will look for `grails-app/views/shared/enterDetailsView.gsp`

#### Action States

An action state is a state that executes code but does not render any view. The result of the action is used to dictate flow transition. To create an action state you need to define an action to to be executed. This is done by calling the `action` method and passing it a block of code to be executed:

    listBooks {
       action {
    	  [ bookList:Book.list() ]
       }
       on("success").to "showCatalogue"
       on(Exception).to "handleError"
    }

As you can see an action looks very similar to a controller action and in fact you can re-use controller actions if you want. If the action successfully returns with no errors the `success` event will be triggered. In this case since we return a map, this is regarded as the "model" and is automatically placed in flow scope.

In addition, in the above example we also use an exception handler to deal with errors on the line:

    on(Exception).to "handleError"

What this does is make the flow transition to a state called `handleError` in the case of an exception.

You can write more complex actions that interact with the flow request context:

    processPurchaseOrder  {
         action {
             def a =  flow.address
             def p = flow.person
             def pd = flow.paymentDetails
             def cartItems = flow.cartItems
             flow.clear()         def o = new Order(person:p, shippingAddress:a, paymentDetails:pd)
             o.invoiceNumber = new Random().nextInt(9999999)
             cartItems.each { o.addToItems(it) }
             o.save()
             [order:o]
         }
         on("error").to "confirmPurchase"
         on(Exception).to "confirmPurchase"
         on("success").to "displayInvoice"
    }

Here is a more complex action that gathers all the information accumulated from the flow scope and creates an `Order` object. It then returns the order as the model. The important thing to note here is the interaction with the request context and "flow scope".

#### Transition Actions

Another form of action is what is known as a transition action. A transition action is executed directly prior to state transition once an event has been triggered. A trivial example of a transition action can be seen below:

    enterPersonalDetails {
       on("submit") {
           log.trace "Going to enter shipping"
       }.to "enterShipping"
       on("return").to "showCart"
    }

Notice how we pass a block of the code to `submit` event that simply logs the transition. Transition states are extremely useful for data binding and validation, which is covered in a later section.

## 6.5.3 Flow Execution Events

In order to transition execution of a flow from one state to the next you need some way of trigger an event that indicates what the flow should do next. Events can be triggered from either view states or action states.

#### Triggering Events from a View State

As discussed previously the start state of the flow in a previous code listing deals with two possible events. A `checkout` event and a `continueShopping` event:

    def shoppingCartFlow = {
        showCart {
            on("checkout").to "enterPersonalDetails"
            on("continueShopping").to "displayCatalogue"
        }
        …
    }

Since the `showCart` event is a view state it will render the view `grails-app/book/shoppingCart/showCart.gsp`. Within this view you need to have components that trigger flow execution. On a form this can be done use the submitButton tag:

    <g:form action="shoppingCart">
        <g:submitButton name="continueShopping" value="Continue Shopping"></g:submitButton>
        <g:submitButton name="checkout" value="Checkout"></g:submitButton>
    </g:form>

The form must submit back to the `shoppingCart` flow. The name attribute of each submitButton tag signals which event will be triggered. If you don't have a form you can also trigger an event with the link tag as follows:

    <g:link action="shoppingCart" event="checkout" />

#### Triggering Events from an Action

To trigger an event from an `action` you need to invoke a method. For example there is the built in `error()` and `success()` methods. The example below triggers the `error()` event on validation failure in a transition action:

    enterPersonalDetails {
       on("submit") {
             def p = new Person(params)
             flow.person = p
             if(!p.validate())return error()
       }.to "enterShipping"
       on("return").to "showCart"
    }

In this case because of the error the transition action will make the flow go back to the `enterPersonalDetails` state.

With an action state you can also trigger events to redirect flow:

    shippingNeeded {
       action {
           if(params.shippingRequired) yes()
           else no()
       }
       on("yes").to "enterShipping"
       on("no").to "enterPayment"
    }

## 6.5.4 Flow Scopes

#### Scope Basics

You'll notice from previous examples that we used a special object called `flow` to store objects within "flow scope". Grails flows have 5 different scopes you can utilize:

- `request` - Stores an object for the scope of the current request
- `flash` - Stores the object for the current and next request only
- `flow` - Stores objects for the scope of the flow, removing them when the flow reaches an end state
- `conversation` - Stores objects for the scope of the conversation including the root flow and nested subflows
- `session` - Stores objects inside the users session

> Grails service classes can be automatically scoped to a web flow scope. See the documentation on Services for more information.

Also returning a model map from an action will automatically result in the model being placed in flow scope. For example, using a transition action, you can place objects within `flow` scope as follows:

    enterPersonalDetails {
       on("submit") {
             [person:new Person(params)]
       }.to "enterShipping"
       on("return").to "showCart"
    }

Be aware that a new request is always created for each state, so an object placed in request scope in an action state (for example) will not be available in a subsequent view state. Use one of the other scopes to pass objects from one state to another. Also note that Web Flow:

1. Moves objects from flash scope to request scope upon transition between states;
2. Merges objects from the flow and conversation scopes into the view model before rendering (so you shouldn't include a scope prefix when referencing these objects within a view, e.g. GSP pages).

#### Flow Scopes and Serialization

When placing objects in `flash`, `flow` or `conversation` scope they must implement `java.io.Serializable` otherwise you will get an error. This has an impact on domain classes in that domain classes are typically placed within a scope so that they can be rendered in a view. For example consider the following domain class:

    class Book {
    	String title
    }

In order to place an instance of the `Book` class in a flow scope you will need to modify it as follows:

    class Book implements Serializable {
    	String title
    }

This also impacts associations and closures you declare within a domain class. For example consider this:

    class Book implements Serializable {
    	String title
    	Author author
    }

Here if the `Author` association is not `Serializable` you will also get an error. This also impacts closures used in GORM events such as `onLoad`, `onSave` and so on. The following domain class will cause an error if an instance is placed in a flow scope:

    class Book implements Serializable {
    	String title
    	def onLoad = {
    		println "I'm loading"
    	}
    }

The reason is that the assigned block on the `onLoad` event cannot be serialized. To get around this you should declare all events as `transient`:

    class Book implements Serializable {
    	String title
    	transient onLoad = {
    		println "I'm loading"
    	}
    }

## 6.5.5 Data Binding and Validation

In the section on start and end states, the start state in the first example triggered a transition to the `enterPersonalDetails` state. This state renders a view and waits for the user to enter the required information:

    enterPersonalDetails {
       on("submit").to "enterShipping"
       on("return").to "showCart"
    }

The view contains a form with two submit buttons that either trigger the submit event or the return event:

    <g:form action="shoppingCart">
        <!-- Other fields -->
        <g:submitButton name="submit" value="Continue"></g:submitButton>
        <g:submitButton name="return" value="Back"></g:submitButton>
    </g:form>

However, what about the capturing the information submitted by the form? To to capture the form info we can use a flow transition action:

    enterPersonalDetails {
       on("submit") {
             flow.person = new Person(params)
             !flow.person.validate() ? error() : success()
       }.to "enterShipping"
       on("return").to "showCart"
    }

Notice how we perform data binding from request parameters and place the `Person` instance within `flow` scope. Also interesting is that we perform validation and invoke the `error()` method if validation fails. This signals to the flow that the transition should halt and return to the `enterPersonalDetails` view so valid entries can be entered by the user, otherwise the transition should continue and go to the `enterShipping` state.

Like regular actions, flow actions also support the notion of Command Objects by defining the first argument of the closure:

    enterPersonalDetails {
       on("submit") { PersonDetailsCommand cmd ->
              flow.personDetails = cmd
             !flow.personDetails.validate() ? error() : success()
       }.to "enterShipping"
       on("return").to "showCart"
    }

## 6.5.6 Subflows and Conversations

Grails' Web Flow integration also supports subflows. A subflow is like a flow within a flow. For example take this search flow:

    def searchFlow = {
                displaySearchForm {
                    on("submit").to "executeSearch"
                }
                executeSearch {
                    action {
                        [results:searchService.executeSearch(params.q)]
                    }
                    on("success").to "displayResults"
                    on("error").to "displaySearchForm"
                }
                displayResults {
                    on("searchDeeper").to "extendedSearch"
                    on("searchAgain").to "displaySearchForm"
                }
                extendedSearch {
                    subflow(extendedSearchFlow)   // <--- extended search subflow
                    on("moreResults").to "displayMoreResults"
                    on("noResults").to "displayNoMoreResults"
                }
                displayMoreResults()
                displayNoMoreResults()
    }

It references a subflow in the `extendedSearch` state. The subflow is another flow entirely:

    def extendedSearchFlow = {
           startExtendedSearch {
               on("findMore").to "searchMore"
               on("searchAgain").to "noResults"
           }
           searchMore {
               action {
                  def results = searchService.deepSearch(ctx.conversation.query)
                  if(!results)return error()
                  conversation.extendedResults = results
               }
               on("success").to "moreResults"
               on("error").to "noResults"
           }
           moreResults()
           noResults()
    }

Notice how it places the `extendedResults` in conversation scope. This scope differs to flow scope as it allows you to share state that spans the whole conversation not just the flow. Also notice that the end state (either `moreResults` or `noResults` of the subflow triggers the events in the main flow:

    extendedSearch {
             subflow(extendedSearchFlow)   // <--- extended search subflow
             on("moreResults").to "displayMoreResults"
             on("noResults").to "displayNoMoreResults"
    }

## 6.6 Filters

Although Grails controllers support fine grained interceptors, these are only really useful when applied to a few controllers and become difficult to manage with larger applications. Filters on the other hand can be applied across a whole group of controllers, a URI space or a to a specific action. Filters are far easier to plug-in and maintain completely separately to your main controller logic and are useful for all sorts of cross cutting concerns such as security, logging, and so on.

## 6.6.1 Applying Filters

To create a filter create a class that ends with the convention `Filters` in the `grails-app/conf` directory. Within this class define a code block called `filters` that contains the filter definitions:

    class ExampleFilters {
       def filters = {
            // your filters here
       }
    }

Each filter you define within the `filters` block has a name and a scope. The name is the method name and the scope is defined using named arguments. For example if you need to define a filter that applies to all controllers and all actions you can use wildcards:

    sampleFilter(controller:'*', action:'*') {
      // interceptor definitions
    }

The scope of the filter can be one of the following things:

- A controller and/or action name pairing with optional wildcards
- A URI, with Ant path matching syntax

Filter rule attributes:

- `controller` - controller matching pattern, by default * is replaced with .* and a regex is compiled
- `action` - action matching pattern, by default * is replaced with .* and a regex is compiled
- `regex` (true/false) - use regex syntax (don't replace '*' with '.*')
- `uri` - a uri to match, expressed with as Ant style path (e.g. /book/**)
- `find` (true/false) - rule matches with partial match (see java.util.regex.Matcher.find())
- `invert` (true/false) - invert the rule (NOT rule)

Some examples of filters include:

- All controllers and actions

    all(controller:'*', action:'*') {}

- Only for the `BookController`

    justBook(controller:'book', action:'*') {}

- All controllers except the `BookController`

    notBook(controller:'book', invert:true) {}

- All actions containing 'save' in the action name

    saveInActionName(action:'save', find:true) {}

- Applied to a URI space

    someURIs(uri:'/book/**') {}

- Applied to all URIs

    allURIs(uri:'/**') {}

In addition, the order in which you define the filters dictates the order in which they are executed.

## 6.6.2 Filter Types

Within the body of the filter you can then define one of the following interceptor types for the filter:

- `before` - Executed before the action. Can return false to indicate all future filters and the action should not execute
- `after` - Executed after an action. Takes a first argument as the view model
- `afterView` - Executed after view rendering

For example to fulfill the common authentication use case you could define a filter as follows:

    class SecurityFilters {
       def filters = {
           loginCheck(controller:'*', action:'*') {
               before = {
                  if(!session.user && !actionName.equals('login')) {
                      redirect(action:'login')
                      return false
                   }
               }       }
       }
    }

Here the `loginCheck` filter uses a `before` interceptor to execute a block of code that checks if a user is in the session and if not redirects to the login action. Note how returning false ensure that the action itself is not executed.

## 6.6.3 Variables and Scopes

Filters support all the common properties available to controllers and tag libraries, plus the application context:

- request - The HttpServletRequest object
- response - The HttpServletResponse object
- session - The HttpSession object
- servletContext - The ServletContext object
- flash - The flash object
- params - The request parameters object
- actionName - The action name that is being dispatched to
- controllerName - The controller name that is being dispatched to
- grailsApplication - The Grails application currently running
- applicationContext - The ApplicationContext object

However, filters only support a subset of the methods available to controllers and tag libraries. These include:

- redirect - For redirects to other controllers and actions
- render - For rendering custom responses

## 6.7 Ajax

Ajax stands for Asynchronous Javascript and XML and is the driving force behind the shift to richer web applications. These types of applications in general are better suited to agile, dynamic frameworks written in languages like Ruby and Groovy Grails provides support for building Ajax applications through its Ajax tag library for a full list of these see the Tag Library Reference.

## 6.7.1 Ajax using Prototype

By default Grails ships with the Prototype library, but through the Plug-in system provides support for other frameworks such as Dojo Yahoo UI and the Google Web Toolkit

This section covers Grails' support for Prototype. To get started you need to add this line to the `<head>` tag of your page:

    <g:javascript library="prototype" />

This uses the javascript tag to automatically place the correct references in place for Prototype. If you require Scriptaculous too you can do the following instead:

    <g:javascript library="scriptaculous" />

This works because of Grails' support for adaptive tag libraries. Thanks to Grails' plugin system there is support for a number of different Ajax libraries including (but not limited to):

- prototype
- dojo
- yui
- mootools

## 6.7.1.1 Remoting Linking

Remote content can be loaded in a number of ways, the most commons way is through the remoteLink tag. This tag allows the creation of HTML anchor tags that perform an asynchronous request and optionally set the response in an element. The simplest way to create a remote link is as follows:

    <g:remoteLink action="delete" id="1">Delete Book</g:remoteLink>

The above link sends an asynchronous request to the `delete` action of the current controller with an id of `1`.

## 6.7.1.2 Updating Content

This is great, but usually you would want to provide some kind of feedback to the user as to what has happened:

    def delete = {
          def b = Book.get( params.id )
          b.delete()
          render "Book ${b.id} was deleted"
    }

GSP code:

    <div id="message"></div>
    <g:remoteLink action="delete" id="1" update="message">Delete Book</g:remoteLink>

The above example will call the action and set the contents of the `message` `div` to the response in this case `"Book 1 was deleted"`. This is done by the `update` attribute on the tag, which can also take a map to indicate what should be updated on failure:

    <div id="message"></div>
    <div id="error"></div>
    <g:remoteLink action="delete" id="1"
                  update="[success:'message',failure:'error']">Delete Book</g:remoteLink>

Here the `error` div will be updated if the request failed.

## 6.7.1.3 Remote Form Submission

An HTML form can also be submitted asynchronously in one of two ways. Firstly using the formRemote tag which expects similar attributes to those for the remoteLink tag:

    <g:formRemote url="[controller:'book',action:'delete']" update="[success:'message',failure:'error']">
           <input type="hidden" name="id" value="1" />
           <input type="submit" value="Delete Book!" />
    </g:formRemote >

Or alternatively you can use the submitToRemote tag to create a submit button. This allows some buttons to submit remotely and some not depending on the action:

    <form action="delete">
           <input type="hidden" name="id" value="1" />
           <g:submitToRemote action="delete" update="[success:'message',failure:'error']" />
    </form>

## 6.7.1.4 Ajax Events

Specific javascript can be called if certain events occur, all the events start with the "on" prefix and allow you to give feedback to the user where appropriate, or take other action:

    <g:remoteLink action="show"
                  id="1"
                  update="success"
                  onLoading="showProgress()"
                  onComplete="hideProgress()">Show Book 1</g:remoteLink>

The above code will execute the "showProgress()" function which may show a progress bar or whatever is appropriate. Other events include:

- `onSuccess` - The javascript function to call if successful
- `onFailure` - The javascript function to call if the call failed
- `on_ERROR_CODE` - The javascript function to call to handle specified error codes (eg on404="alert('not found!')")
- `onUninitialized` - The javascript function to call the a ajax engine failed to initialise
- `onLoading` - The javascript function to call when the remote function is loading the response
- `onLoaded` - The javascript function to call when the remote function is completed loading the response
- `onComplete` - The javascript function to call when the remote function is complete, including any updates

If you need a reference to the `XmlHttpRequest` object you can use the implicit event parameter `e` to obtain it:

    <g:javascript>
       function fireMe(e) {
    	   alert("XmlHttpRequest = " + e)
       }
    }
    </g:javascript>
    <g:remoteLink action="example"
                  update="success"
                  onSuccess="fireMe(e)">Ajax Link</g:remoteLink>

## 6.7.2 Ajax with Dojo

Grails features an external plug-in to add Dojo support to Grails. To install the plug-in type the following command from the root of your project in a terminal window:

    grails install-plugin dojo

This will download the current supported version of Dojo and install it into your Grails project. With that done you can add the following reference to the top of your page:

    <g:javascript library="dojo" />

Now all of Grails tags such as remoteLink, formRemote and submitToRemote work with Dojo remoting.

## 6.7.3 Ajax with GWT

Grails also features support for the Google Web Toolkit through a plug-in comprehensive documentation for can be found on the Grails wiki.

## 6.7.4 Ajax on the Server

Although Ajax features the X for XML there are a number of different ways to implement Ajax which are typically broken down into:

- Content Centric Ajax - Where you merely use the HTML result of a remote call to update the page
- Data Centric Ajax - Where you actually send an XML or JSON response from the server and programmatically update the page
- Script Centric Ajax - Where the server sends down a stream of Javascript to be evaluated on the fly

Most of the examples in the Ajax section cover Content Centric Ajax where you are updating the page, but you may also want to use Data Centric or Script Centric. This guide covers the different styles of Ajax.

#### Content Centric Ajax

Just to re-cap, content centric Ajax involves sending some HTML back from the server and is typically done by rendering a template with the render method:

    def showBook = {
    	def b = Book.get(params.id)	render(template:"bookTemplate", model:[book:b])
    }

Calling this on the client involves using the remoteLink tag:

    <g:remoteLink action="showBook" id="${book.id}" update="book${book.id}">Update Book</g:remoteLink>
    <div id="book${book.id}">
       <!--existing book mark-up -->
    </div>

#### Data Centric Ajax with JSON

Data Centric Ajax typically involves evaluating the response on the client and updating programmatically. For a JSON response with Grails you would typically use Grails' JSON marshaling capability:

    import grails.converters.*def showBook = {
    	def b = Book.get(params.id)    render b as JSON
    }

And then on the client parse the incoming JSON request using an Ajax event handler:

    <g:javascript>
    function updateBook(e) {
    	var book = eval("("+e.responseText+")") // evaluate the JSON
    	$("book"+book.id+"_title").innerHTML = book.title
    }
    <g:javascript>
    <g:remoteLink action="test" update="foo" onSuccess="updateBook(e)">Update Book</g:remoteLink>
    <g:set var="bookId">book${book.id}</g:set>
    <div id="${bookId}">
    	<div id="${bookId}_title">The Stand</div>
    </div>

#### Data Centric Ajax with XML

On the server side using XML is equally trivial:

    import grails.converters.*def showBook = {
    	def b = Book.get(params.id)    render b as XML
    }

However, since DOM is involved the client gets more complicated:

    <g:javascript>
    function updateBook(e) {
    	var xml = e.responseXML
    	var id = xml.getElementsByTagName("book").getAttribute("id")
    	$("book"+id+"_title")=xml.getElementsByTagName("title")[0].textContent
    }
    <g:javascript>
    <g:remoteLink action="test" update="foo" onSuccess="updateBook(e)">Update Book</g:remoteLink>
    <g:set var="bookId">book${book.id}</g:set>
    <div id="${bookId}">
    	<div id="${bookId}_title">The Stand</div>
    </div>

#### Script Centric Ajax with JavaScript

Script centric Ajax involves actually sending Javascript back that gets evaluated on the client. An example of this can be seen below:

    def showBook = {
    	def b = Book.get(params.id)    response.contentType = "text/javascript"
        String title = b.title.encodeAsJavascript()
        render "$('book${b.id}_title')='${title}'"
    }

The important thing to remember is to set the `contentType` to `text/javascript`. If you are using Prototype on the client the returned Javascript will automatically be evaluated due to this `contentType` setting.

Obviously in this case it is critical that you have an agreed client-side API as you don't want changes on the client breaking the server. This is one of the reasons Rails has something like RJS. Although Grails does not currently have a feature such as RJS there is a Dynamic JavaScript Plug-in that offers similar capabilities.

## 6.8 Content Negotiation

Grails has built in support for Content negotiation using either the HTTP `Accept` header, an explicit format request parameter or the extension of a mapped URI.

#### Configuring Mime Types

Before you can start dealing with content negotiation you need to tell Grails what content types you wish to support. By default Grails comes configured with a number of different content types within `grails-app/conf/Config.groovy` using the `grails.mime.types` setting:

    grails.mime.types = [ xml: ['text/xml', 'application/xml'],
                          text: 'text-plain',
                          js: 'text/javascript',
                          rss: 'application/rss+xml',
                          atom: 'application/atom+xml',
                          css: 'text/css',
                          cvs: 'text/csv',
                          all: '*/*',
                          json: 'text/json',
                          html: ['text/html','application/xhtml+xml']
                        ]

The above bit of configuration allows Grails to detect to format of a request containing either the 'text/xml' or 'application/xml' media types as simply 'xml'. You can add your own types by simply adding new entries into the map.

#### Content Negotiation using the Accept header

Every incoming HTTP request has a special Accept header that defines what media types (or mime types) a client can "accept". In older browsers this is typically:

    */*

Which simply means anything. However, on newer browser something all together more useful is sent such as (an example of a Firefox `Accept` header):

    text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5

Grails parses this incoming format and adds a `property` to the request object that outlines the preferred request format. For the above example the following assertion would pass:

    assert 'html' == request.format

Why? The `text/html` media type has the highest "quality" rating of 0.9, therefore is the highest priority. If you have an older browser as mentioned previously the result is slightly different:

    assert 'all' == request.format

In this case 'all' possible formats are accepted by the client. To deal with different kinds of requests from Controllers you can use the withFormat method that acts as kind of a switch statement:

    import grails.converters.*class BookController {
    	def books
    	def list = {
    		this.books = Book.list()
    		withFormat {
    			html bookList:books
    			js { render "alert('hello')" }
    			xml { render books as XML }
    		}
    	}
    }

What happens here is that if the preferred format is `html` then Grails will execute the `html()` call only. What this is does is make Grails look for a view called either `grails-app/views/books/list.html.gsp` or `grails-app/views/books/list.gsp`. If the format is `xml` then the closure will be invoked and an XML response rendered.

How do we handle the "all" format? Simply order the content-types within your `withFormat` block so that whichever one you want executed comes first. So in the above example, "all" will trigger the `html` handler.

> When using withFormat make sure it is the last call in your controller action as the return value of the `withFormat` method is used by the action to dictate what happens next.

#### Content Negotiation with the format Request Parameter

If fiddling with request headers if not your favorite activity you can override the format used by specifying a `format` request parameter:

    /book/list?format=xml

You can also define this parameter in the URL Mappings definition:

    "/book/list"(controller:"book", action:"list") {
    	format = "xml"
    }

#### Content Negotiation with URI Extensions

Grails also supports content negotiation via URI extensions. For example given the following URI:

    /book/list.xml

Grails will shave off the extension and map it to `/book/list` instead whilst simultaneously setting the content format to `xml` based on this extension. This behaviour is enabled by default, so if you wish to turn it off, you must set the `grails.mime.file.extensions` property in `grails-app/conf/Config.groovy` to `false`:

    grails.mime.file.extensions = false

#### Testing Content Negotiation

To test content negotiation in an integration test (see the section on Testing) you can either manipulate the incoming request headers:

    void testJavascriptOutput() {
    	def controller = new TestController()
    	controller.request.addHeader "Accept", "text/javascript, text/html, application/xml, text/xml, */*"	controller.testAction()
    	assertEquals "alert('hello')", controller.response.contentAsString
    }

Or you can set the format parameter to achieve a similar effect:

    void testJavascriptOutput() {
    	def controller = new TestController()
    	controller.params.format = 'js'	controller.testAction()
    	assertEquals "alert('hello')", controller.response.contentAsString
    }