Development Guidelines
This topic provides guidelines and conventions for plugin development. The intention of these guidelines is to improve the overall quality of the plugin and to ensure that they are well designed, well-documented, consistent, compatible, Internationalization ready and migration ready. This topic can be used to validate plugins for plugin certification. A certified plugin must comply with many of the guidelines and conventions described. For each guideline or convention it is specified whether it is required eor recommended for a particular certification level
In This Topic
- 1 Terminology
- 2 The Certification Process
- 3 Guidelines Overview
- 4 Guidelines Summary
- 5 GUI Guidelines for the Editor
- 6 Migration Guidelines
- 7 Internationalization Guidelines
- 8 Documentation Guidelines
- 9 Distribution Guidelines
- 10 Quality Guidelines
- 11 DTAP Guidelines
- 12 Security Guidelines
- 13 API
- 14 Presentation Plugins
- 15 Coding Conventions
- 16 Javadoc Conventions
- 17 Class Name Conventions
- 18 ID Naming Conventions
Terminology
This topic uses the following acronyms. The meaning of each one is described below.
Term | Description |
|---|---|
POJO | A Plain Old Java Object. This refers to a basic Java class not implementing or extending any special class(es). |
MVC | Model-View-Controller. A design pattern used to separate the business model, business logic and UI logic. |
Spring MVC | The web application framework used by XperienCentral to render the Editor. |
DAO | Data Access Object. An object that encapsulates all access to a particular data source. It is used to prevent a business object from having dependencies with a particular persistence implementation. |
DTAP | Development Test Acceptance and Production. |
JCR | Java Content Repository. |
RBAC | Role Based Access Control. |
FBO | A |
Plugin audit | The process of verifying a plugin against the plugin development guidelines and granting a particular certification level. |
Plugin certification level | A level that indicates the extent to which the plugin conforms to the plugin development guidelines. The higher the certification level, the more the plugin conforms to the defined guidelines. |
Plugin certification range | The range from the first certified plugin version to the first major version of the plugin for which the current plugin certification level will not be valid anymore and a new plugin audit will be required. |
Guideline scope | The software component(s) or component type(s) to which the guideline applies. |
Pre-audit | The act of running the plugin guideline audit tool to verify your plugin against a basic subset of guidelines. |
The Certification Process
The goal of certifying plugins is to improve the overall quality of all plugins, which makes it convenient for the customer, the developer of the plugin and any developer not familiar with the plugin who has to perform maintenance on it.
A summary of the plugin certification:
Guarantees that the plugin will not conflict with other certified plugins.
Guarantees a certain quality level in the sense of stability, compatibility, upgradability, security, performance and many other themes.
Increases the ease of maintenance because the plugin’s source files are structured in a consistent way.
Certification Levels
For each guideline described in this document, a plugin certification level is defined. Plugin certification comes in three levels:
Level 1 - Project specific. The plugin is fully functional for a specific XperienCentral installation but may lack documentation, localization and may require specific hardware or software. The plugin may not be suitable for running on other XperienCentral installations.
Level 2 - Reusable. The plugin is fully functional, provides proper documentation but may require specific hardware or software as indicated in the packaged readme.md. It may lack support for localization and documentation in US English. The plugin is suitable to run on any XperienCentral installation of the version the certificate is valid for.
Level 3 - Product ready. The plugin is fully functional, provides proper documentation and supports at least the hardware and software required by the XperienCentral platform itself. It supports localization and all documentation is available in at least US English. The plugin is of such high quality that it could be incorporated into the XperienCentral platform as is.
The table in the Guidelines Summary specifies for each guideline the plugin certification level for which the guideline is mandatory. The levels are cumulative. For certification of a particular level it is required that the plugin also conforms to all guidelines required for lower certification levels.
Guideline Versions
These plugin development guidelines are subject to change. Occasionally, new guidelines are added, old guidelines are removed or existing guidelines are updated for various reasons. Updates to these guidelines are always effective as of the next available version of XperienCentral. The guidelines are fixed for XperienCentral certification. A certificate will always mention the XperienCentral version for which the certificate has been granted, indicating the exact version of the guidelines against which it was verified. Note that the guidelines are also occasionally updated with textual improvements.
Plugin Version Updates
A plugin audit is performed on a particular version of a plugin, for example the 1.1.0 version. This version is referred to as the "plugin audit version". After the plugin audit, new versions of the plugin may become available.In a micro version update (for example from version 1.1.0 to 1.1.1), it is unlikely that a code change could lead to a guideline violation. If it did, that it would be a guideline violation since micro version updates should only contain micro software changes. The same partially applies to minor version updates. It would still be rather unlikely that a minor version update would violate a guideline. A major version update, however, could contain major refactoring or major functional enhancements which could mean that the plugin has to be recertified. For that reason GX Software stipulates that a plugin certification level is only valid until the next major version of the plugin . For example, if version 1.1.4 of a plugin has been certified at level 2, then each 1.1.x version, where x >= 4, as well as each 1.y.z version, where y >= 2, will also be certified at level 2. We refer to the range between the first certified version and the version from which the certificate will expire the "plugin certification range.
Preaudit
A plugin audit tool is available that automates and supports plugin audits. Running this tool to verify a plugin is called a pre-audit. Running a pre-audit is required before a plugin audit is requested. If the pre-audit results in one or more guideline violations which the developer of the plugin believes to be invalid, the developer should indicate this in the audit request.
Plugin audit report
A plugin audit report contains four important results:
The version of the plugin that has been audited.
The assigned certification level (if applicable) for the plugin (the plugin certification level).
The XperienCentral version for which the certificate is valid.
The range of plugin versions for which the certificate is valid (the plugin certification range).
For example:
Version of the audited plugin : 1.1.4
Assigned plugin certification level: 2
Certified on XperienCentral version: 10.8
Plugin certification range: 1.1.4 to 2.0 (but not including 2.0)
Guidelines Overview
This document describes the guidelines and conventions for plugin development. These are divided into the following themes:
GUI guidelines for the Editor - Guidelines to design consistent and user-friendly User Interfaces for the XperienCentral Editor. These guidelines do not apply to the GUI of the website environment.
Architecture - The architectural design patterns that the plugin should comply with. Design patterns contribute to software quality in many ways; future compatibility, plug ability, extendibility and synoptic code.
Migration - These guidelines deal with software upgrades. Conforming to these guidelines will guarantee a smooth migration from older to newer versions of the plugin.
Internationalization - All plugins must be ready for internationalization. This must be taken into account when designing the software. The XperienCentral platform offers support for internationalization.
Documentation - Since plugins are small software components that may be reused in other projects than they were originally intended for, it is important that proper user documentation is available.
Distribution - These guidelines define how a plugin should be packaged and distributed. They cover the contents of a plugin release and how they should be packaged.
Quality - These guidelines cover the stability and compatibility of the plugin with web browsers, web servers, application servers and databases.
DTAP support - The plugin must be designed to support the DTAP model.
Security - The security guidelines define rules that must be followed in order to ensure that the plugin is a secure web application. This prevents common security errors like the enabling of SQL injection and cross-site scripting.
API - A plugin may expose an API in the form of implementation classes, interfaces and constants. These guidelines describe how such an API should be exposed by a plugin.
Coding conventions - Conforming to coding conventions contributes to readability of the software code. This makes it easy to read, easy to learn and will prevent bugs.
Javadoc - A proper Javadoc is very important for software developers coding against the API exposed by the plugin. If a plugin is extendable, it is very important that its API is well documented.
Naming conventions - For readability and maintainability of the software code, it is always a good idea to define the conventions used to name particular methods and classes.
Guidelines versus Conventions
Conventions are a specific type of guidelines: they describe proper naming or the way software code or documentation should be written. A convention is very specific and easy to validate against. A guideline is a more abstract definition and harder to validate.
Guideline Overview
This part contains an overview of all guidelines and conventions defined in this topic. The tables below define which guidelines and conventions are required for which plugin certification levels. The table also indicates a scope. The scope indicates to which part of the plugin the guideline applies. This may be only one particular component, a set of components or the plugin as a whole.
The following abbreviations are used in the table summary:
Scope | Description |
|---|---|
A | The guideline applies to all component types or to the plugin or WCA as a whole. |
P | The guideline applies to panel components. |
E | The guideline applies to element components. |
M | The guideline applies to media item components. |
C | The guideline applies to service components. |
D | The guideline applies to page metadata components. |
L | The guideline applies to servlet components. |
R | The guideline applies to presentation components. |
F | The guideline applies to form components. |
V | The guideline applies to profile provider components. |
Guidelines Summary
The table below summarizes all the guidelines. Because the guidelines have evolved over time, some IDs have been removed, therefore the sequential order skips numbers in some places. If the column "Certification Level" is blank, this means that the guideline is not required for any certification level and is only a recommendation. Most of the guidelines are discussed in greater length following the table below.
Guideline ID | Description | Certification Level | Scope |
|---|---|---|---|
G001 | The HTML rendering the UI conforms to the basic layout using a table of class | 1 | PEMDV |
G002 | The HTML rendering the UI uses only the defined CSS classes. | 3 | PEMDV |
G003 | The UI conforms to the basic guidelines. | 2 | PEMDV |
G004 | The UI uses the widgets supported by the XperienCentral platform. | 2 | PEMDV |
G005 | The JSPs that render the HTML use the JSTL tags and JSP tags offered by the XperienCentral platform as often as possible. | 2 | PEMDV |
G006 | The UI conforms to the defined UI interaction patterns. | 2 | PEMDV |
G007 | The business object is implemented as a POJO and does not contain any reference to a controller, form backing object or DAO. | 1 | PEMDV |
G008 | The business object does not contain properties or logic whose sole purpose is the view. | 1 | PDV |
G009 | The | 1 | PEMDV |
G010 | The | 1 | PEMDV |
G011 | The | 1 | PEMDV |
G012 | The | 3 | PMDV |
G013 | The controller is a separate class and implements all controller logic. | 1 | PEMD |
G014 | Persistence logic is not contained by the business object but implemented in a separate DAO. | 1 | PEMDV |
G015 | JSPs do not contain SQL statements or other persistence implementation-specific logic unless they are contained by a separate JSP tag. | 1 | PEMDRV |
G016 | The plugin contains all resources not provided by dependencies or other presentation plugins and is capable of being deployed and functioning properly on any XperienCentral installation, as long as all its defined dependencies are available. | 1 | A |
G017 | The version number of a plugin conforms to the syntax "major.minor.micro". | 1 | A |
G019 | The version numbers of the plugin are independent of the XperienCentral release they were developed for. | 1 | A |
G020 | If the data model of the plugin has been changed in a newer version of the plugin , the plugin must properly handle data model updates. | 2 | PEMDV |
G021 | The API that XperienCentral provides is used to access the data model XperienCentral exposes. | 1 | A |
G022 | XperienCentral features and API functions are used where possible instead of implementing custom functions. | 1 | A |
G023 | When the plugin uses a service, a dependency with that service is defined in the component definition in order to retrieve a reference to the service. | 1 | A |
G024 | Text, images and other GUI components are suitable for translation. | 3 | PEMCDV |
G025 | Multilingual content that can be created using the plugin is translatable. |
| PEMCDLFV |
G026 | Language labels are defined in language resource files conforming to JavaI18N and the filename meets the syntax | 1 | PEMCDLFV |
G027 | Label IDs in the language resource files use only lower case letters. | 1 | PEMCDLFV |
G028 | Language labels in language resource files are grouped per component and prefixed with at least the ID of the component. |
| PEMCDLFV |
G034 | Documentation is available in at least the US English language. | 3 | PEMDFV |
G035 | A plugin is distributed as a single ZIP file known as a WCA (WebManager Component Archive) which can also contain other related plugins. | 1 | A |
G036 | The contents of the WCA conforms to the defined directory structure. | 2 | A |
G037 | The WCA contains a readme.md and a changelog.md. | 1 | A |
G038 | The layout of the readme.md and changelog.md follow the defined templates. Click the links to the left to download the templates. | 1 | A |
G039 | The plugin JAR file containing the software follows the defined directory structure. | 1 | A |
G042 | The HTML generated by the JSPs for rendering the Editor is XHTML 1.0 transitional compliant. | 3 | PEMDV |
G045 | All content generated by the plugin is stored in the JCR or in an external database if there is an obvious need for it. | 1 | PEMCDLFV |
G046 | The configuration management service is used to store configuration options. No hard-coded web IDs, paths or URLs are used in the software. | 1 | PEMCDLFV |
G047 | The preferences service is used to store all preferences. | 1 | PEMCDLFV |
G048 | The | 1 | PEMDRV |
G049 | SQL-prepared statements are used for all SQL queries. | 1 | A |
G050 | At least one RBAC category is defined for each component which has a GUI representation which contains one or more RBAC permissions for the component. | 2 | PEDV |
G051 | A permission category defines and implements at least the RBAC permissions as defined. | 2 | PEV |
G052 | The implementation of RBAC permission handling is mainly programmed in a controller or service, not in the business object itself. The check is only performed in the business object itself if the permission defines authorization to retrieve or update that particular property only. | 2 | PEMDV |