Develop Reference

Unique URL generator for Object Items or hiding ID from URL parameter

I am working on an application built using Python3 and Django that generates PDFs (via HTML) using filled fields from a data model.
I've created a URL function that takes a value of document ID and type, and then generates a PDF of that document.
What I want to do is to email clients a link that contains that URL function with a specific document ID, however, the problem that I'm facing is that the generated URL has the document ID in the URL parameter, and this is terrible for security purposes as all they can do is change ID number on URL and get access to a different document (that they are not supposed to see)
My questions are:
A- Is there a way to create a unique link for every generated PDF that I can send to clients?
B- Would it be better to create another field in the model of a randomly generated 15 character value, that I use instead of the ID in the parameter?

Ok so I have fixed it by doing the following:
1- UUID was definetly the way, thank you #Toan Quoc Ho for that suggestion. I have added a UUID field to each of the models,
2- Because I wanted to keep my PK as ID, I had the problem of generating unique UUID fields of existing documents. So I followed this solution, and it worked magically. Only thing to note is that there can be no traffic when applying these changes, otherwise the database will crash, be aware.
3- I, then, used the UUID together with ID to determine documents and passed them as URL parameters using regex as (\d+)/([\w-]+)
Voila, that did exactly what I wanted. No two documents share the same UUID, and vice-versa. I could generate a link unique to each document, and block any other access.

I would use the new secrets module available in Python 3.6+. Here is an example:
from secrets import token_urlsafe
random_string = token_urlsafe(16)
print(random_string)
The result would be something like this - nslhgo0dYowR6CvMDEwC_A.

"Get" document from cosmosdb by id (not knowing the _rid)

As MS Support recently told me that using a "GET" is much more efficient in RUs usage than a sql query. I'm wondering if I can (within the azure.cosmos python package or a custom HTTP request to the REST API) get a document by its unique 'id' field (for which I generated a GUIDs) without an SQL Query.
Every example shown are using the link/path of the doc which is built with the '_rid' metadata of the document and not the 'id' field set when creating the doc.
I use a bulk upsert stored procedure I wrote to create my new documents and never retrieve the metadata for each one of them (I have ~ 100 millions docs) so retrieving the _rid would be equivalent to retrieving the doc itself.

The reason that the ReadDocument method is so much more efficient than a SQL query is because it uses _rid instead of a user generated field, even the required id field. This is because the _rid isn't just a unique value, it also encodes information about where that document is physically stored.
To give an example of how this works, let's say you are explaining to someone where a party is this weekend. You could use the name that you use for the house "my friend Ryan's house" or you could use the address "123 ThatOne Street Somewhere, WA 11111". They both are unique identifiers, but for someone trying to get there one is way more efficient than the other.
Telling someone to go to your friend's house is like using your own id. It does map to a specific house, but the person will still need to find out where that physically is to get there. Using the address is like working with the _rid field. Based on that information alone they can get to the party location. Of course, in the real world the person would probably need directions, but the data storage in a database is a lot more organized than most city streets so an address is sufficient to go retrieve the document.
If you want to take advantage of this method you will need to find a way to work with the _rid field.

How to find full service name from partial name in python

I am writing a Python script that will manage multiple Oracle databases on a single box. Each database has its own OracleService, but they all run under one TNSListener. Because each computer's install might name things differently I want to make this as dynamic as possible.
First, I need to start the TNSListener service. Most of these are on local laptops that only start the listener when we are going to use an Oracle database. In addition, some laptops run different versions of Oracle so the actual service name is different. For this I need to be able to find the full service name or names that contains the string 'TNSListener'.
Second, all of the OracleService names will be appended by the instance name (i.e., OracleServiceTESTING1). So I need to get a list of all the OracleServices on the machine and then display a selection of the instances based on the appended portion of the service names.
I thought about accessing the registry and trying to pull services from there, but the overhead to parse through that seems excessive. I'm just looking for some general guidance on how to find all services that match the string 'TNSListener' and 'OracleService'.

I would recommend a library like pywinservicemanager. A short code example to check if a particular service exists would look like this:
from pywinservicemanager.WindowsServiceConfigurationManager import ServiceExists
serviceName = 'TestService'
serviceExists = ServiceExists(serviceName)
print serviceExists

How do you control user access to records in a key-value database?

I have a web application that accesses large amounts of JSON data.
I want to use a key value database for storing JSON data owned/shared by different users of the web application (not users of the database). Each user should only be able to access the records they own or share.
In a relational database, I would add a column Owner to the record table, or manage shared ownerships in a separate table, and check access on the application side (Python). For key value stores, two approaches come to mind.
User ID as part of the key
What if I use keys like USERID_RECORDID and then write code to check the USERID before accessing the record? Is that a good idea? It wouldn't work with records that are shared between users.
User ID as part of the value
I could store one or more USERIDs in the value data and check if the data contains the ID of the user trying to access the record. Performance is probably slower than having the user ID as part of the key, but shared ownerships are possible.
What are typical patterns to do what I am trying to do?

Both of the solutions you described have some limitations.
You point yourself that including the owner ID in the key does not solve the problem of shared data. However, this solution may be acceptable, if you add another key/value pair, containing the IDs of the contents shared with this user (key: userId:shared, value: [id1, id2, id3...]).
Your second proposal, in which you include the list of users who were granted access to a given content, is OK if and only if you application needs to make a query to retrieve the list of users who have access to a particular content. If your need is to list all contents a given user can access, this design will lead you to poor performances, as the K/V store will have to scan all records -and this type of database engine usually don't allow you to create an index to optimise this kind of request.
From a more general point of view, with NoSQL databases and especially Key/Value stores, the model has to be defined according to the requests to be made by the application. It may lead you to duplicate some information. The application has the responsibility of maintaining the consistency of the data.
By example, if you need to get all contents for a given user, whether this user is the owner of the content or these contents were shared with him, I suggest you to create a key for the user, containing the list of content Ids for that user, as I already said. But if your app also needs to get the list of users allowed to access a given content, you should add their IDs in a field of this content. This would result in something like :
key: contentID, value: { ..., [userId1, userID2...]}
When you remove the access to a given content for a user, your app (and not the datastore) have to remove the userId from the content value, and the contentId from the list of contents for this user.
This design may imply for your app to make multiple requests: by example one to get the list of userIDs allowed to access a given content, and one or more to get these user profiles. However, this should not really be a problem as K/V stores usually have very high performances.

Is there a function to check whether an ID you want to use for an entity is available?

I think I read something about a function appengine has that can tell whether an ID / key you want to use for an entity is available, or if there was a function to get an available ID to choose. App engine team said also that we should set the ID when the entity is created and not change it. But in practice we can just copy everything to a new entity with the new ID?
Thanks!
Update
I think the function I'm looking for is allocateIDs from the docs:
http://code.google.com/appengine/docs/python/datastore/functions.html

To reserve one or more IDs, use allocate_ids(). To check whether an ID is already taken, just construct a Key for it using Key.from_path(kind, id) and try to db.get() it. Also note that IDs for keys with a parent are taken from separate pools and are only unique among keys with the same parent.

On the page describing transactions, a use case is presented where the entity in question, a SalesAccount is updated, or if the account doesn't exist, it is created instead. The technique is to just try to load the entity with the given key; and if it returns nothing, create it. It's important to do this inside a transaction to avoid the situation where two users are both racing for the same key, and both see that it doesn't exist (and both try to create it).