Kitto.Web.Routing.Attributes

Custom attributes for KittoX attribute-based routing and dependency injection. Applied to resource classes and their methods to declare URL routes, HTTP methods, and parameter bindings.

TKXPathAttribute class

Declares the URL path template for a resource class (base path) or a handler method (sub-path). Supports {ParamName} placeholders. Example: [TKXPath('/kx/view/{ViewName}/data')]

constructor Create(const AValue: string);

Creates the attribute with the given URL path template.

property Value: string read FValue;

The URL path template (e.g. '/kx/view/{ViewName}' or '/data').

TKXGETAttribute class

Marks a handler method as responding to HTTP GET requests.

TKXPOSTAttribute class

Marks a handler method as responding to HTTP POST requests.

TKXANYAttribute class

Marks a handler method as responding to both GET and POST requests.

TKXPUTAttribute class

Marks a handler method as responding to HTTP PUT requests (REST update).

TKXDELETEAttribute class

Marks a handler method as responding to HTTP DELETE requests (REST delete).

TKXPATCHAttribute class

Marks a handler method as responding to HTTP PATCH requests (REST partial update).

TKXOPTIONSAttribute class

Marks a handler method as responding to HTTP OPTIONS requests (CORS preflight).

TKXPathParamAttribute class

Extracts a named segment from the URL path template. The name must match a {ParamName} placeholder in the path. Example: [TKXPathParam('ViewName')] const AViewName: string

constructor Create(const AName: string);

Creates the attribute bound to the given {placeholder} name.

property Name: string read FName;

Name of the {placeholder} in the path this parameter captures.

TKXQueryParamAttribute class

Extracts a named value from the URL query string (?name=value). Example: [TKXQueryParam('key')] const AKey: string

constructor Create(const AName: string);

Creates the attribute bound to the given query-string field name.

property Name: string read FName;

Name of the query-string field (?Name=value) this parameter reads.

TKXFormParamAttribute class

Extracts a named value from the POST form body (application/x-www-form-urlencoded). Falls back to query string if not found in POST body. Example: [TKXFormParam('_op')] const AOperation: string

constructor Create(const AName: string);

Creates the attribute bound to the given POST-body field name.

property Name: string read FName;

Name of the POST-body field this parameter reads (query-string fallback).

TKXFormBodyAttribute class

Binds the whole POST body to a TStrings parameter (all name=value pairs, the RTL ContentFields, by reference — do not free). Convenience for handlers that want the raw form. The record-level binding for /save stays in the handler, which needs the store / op / key lifecycle. Example: [TKXFormBody] const AFields: TStrings

TKXContextAttribute class

Marker attribute for dependency injection. The parameter type determines what gets injected from the TKXInjectionRegistry. Supported types: TKWebRequest, TKWebResponse, TKWebSession, TKConfig, TKAuthenticator, TKViewTable, and any custom-registered type. Example: [TKXContext] ASession: TKWebSession

TKXAnonymousAttribute class

Marks a handler method as reachable WITHOUT authentication. The authorization filter (TKXAuthorizationFilter) skips the auth gate for such methods, so endpoints like login / reset-password / change-password can be served to an unauthenticated session.

TKXNavigableAttribute class

Marks a handler method as reachable by a top-level browser navigation (address bar, opened link, window.open) — e.g. a blob/file download opened in a new tab. By default every /kx/* endpoint returns an HTML FRAGMENT meant to be loaded by the SPA (which always sends the X-KittoX: true header); the navigation guard (TKXNavigationGuardFilter) bounces any non-SPA top-level navigation to such a fragment endpoint back to the app root. This attribute opts an endpoint OUT of that guard.

TKXNotPublicAttribute class

Marks a handler method that a "public" view (one with an empty ACName) must NEVER expose anonymously. Publishing a view waives the authentication gate for its endpoints so that, e.g., a self-registration form can be rendered and submitted without a login; but that exemption must not reach destructive or privileged operations — deleting records, running a tool. Those keep requiring authentication even on a public view. An explicit [TKXAnonymous] on the same method still wins (it is a deliberate, per-endpoint decision); this attribute only removes the blanket exemption that IsPublicView would otherwise grant.