Hide your dirty laundry on the server-side

0:00Hey good evening George how's it going? Good good sunshine it's a sunshine it's just a few weeks ago we were able to see each other in person in Vegas so it's too much sunshine too much sunshine too many smart people in the room and yeah too much sunshine of all the bro from all the bright minds did you enjoy Vegas? I do you know what I did it but then I very much didn't it was the same time as the World Series and I'm a massive Toronto Blue Jays fan and the World Series did not work out for us this year. Is that the one never-ending game that I don't follow it? I was bored in the flight people were watching the game I was off board in the flight people were watching the game and then went to pub and people still watching the game and they're still like never-ending game was that I guess I guess I didn't have a chance to tell you the story I was actually at that game

1:02oh like physically I was physically at that game for the first half and then I had to leave because my flight to Vegas was leaving and I ended up in Vegas by the time the game ended so I was at the game then had to leave gone on a flight from LA to Vegas and was in Vegas before the game ended so I guess you guys will never complain about cricket test matches ever again right five days is a little different this was only six and a half hours five days that's a little different yeah but it's five days of beer and taking it slow hope it works out next year and yeah Vegas is good like professional is good Vegas is exhausting as a as a place to be but I have to say that Vegas on Halloween it's something crazy special that was something I haven't seen before with my own eyes once a year is enough though yeah I agree but I am looking

2:03forward to next year already let's talk about what really matters and yeah let's set aside whatever was vibe.co.ded that ignite that's a separate conversation altogether what it means for power pages but just curious do you see some organizations telling you that hey look and not long any power pages we can vibe code our stuff just the marketing folks at Microsoft that's the only place I hear that from okay but I don't see it affected short term in any shape of form because power pages is externally facing which vibe coded apps are not not yet anyway security folks will have a field day with those anyway the reason why we're here is something that you seem to be very excited about this is the biggest news possibly ever since the acquisition but certainly since the web API was introduced I think this is other than an API to refresh the

3:06cache which is always number one on everyone's list the fact that Microsoft recently announced server side logic so the ability to write server side code right into our power pages applications that's what's got me all hot and bothered these days tell us what does it look like hold on I'm repositioned my cop so I can do some brand management so what does it look like it looks like we can write javascript that runs on the server instead of the browser which for those kind of security folks knows they know that means that you can't the people in their browsers can't be messing with your javascript they can't see what that javascript code is so you can use it to do all sorts of things like interacting with third party APIs and have client secrets and all that sort of goodness in there and you can ensure that the logic is running exactly as you intended it not being messed within people's browsers but that kind of makes sense and I assume it runs some kind of node flavor I would assume yeah that's that would be if it's not I think they've spent way too

4:11much time with something else because that seems like the a pretty logical choice what do you think about the choice of javascript versus C sharp or CSX however you can run as a single source and we don't net 10 you can run single files I think it makes sense I think that's a language that's when people ask me who are outside of the the pro dev space when they're like hey what language should you learn that that's pretty high at the top of the list rather than you're gonna write javascript in other parts of your power pages so rather than introducing a different language why not just to go all in with the javascript let me play devil seven again here but the problem is that people think and I've spoken to a few guys and people think that oh we just lift a client script and move it to the server side and it'll work well it doesn't because you don't have client side constructs like fetch or xxml HTTP request you don't have those you have special objects that allow you to deal with with the external endpoints and submit request but they are different from your client

5:17API that's kind of transition is not going to be straightforward it's not lift and shift you'd have to write the code again skills wise yeah it's javascript I can't imagine there's too many places out there that where we're even talking about lifting and shifting existing code this should be if you're lifting and shifting you're lifting from probably C sharp or something else that was doing it yeah from that perspective if you have a number of Azure functions or companion apps that have that C sharp code in there would be nice just to take that and drop it in into the server logic yeah would be good but again I think there'd be enough work on to do that that it would probably wouldn't make sense to do it anyways so I don't mind them starting from scratch and saying hey this is going to be javascript so it's not something that that seems like it's going to be a problem to me before we dive into a little bit more details what is available to you and what is not what do you say that we've seen a few people not objecting but they voice in their concerns and

6:23saying instead of introducing new way to do things why don't expand old way to do things like give me access to custom actions and I'd be happy so we already have where baby I have the clients and where baby I can talk to individual page but it can not sorry individual tables but it cannot call custom actions am I right right yeah why we can't call custom actions in web API I don't quite seems like that would be a simple thing to do I don't know if there's a security side to it where it can't really enforce table permission I don't know I don't know why they haven't given us because that seems like a pretty quick way to do that but I just don't see I still think that even if you have that there's still lots you would want to do with this new server logic so I don't see them as direct competitors complimentary but I still not not necessarily having to I don't mind that as specific to power pages I've seen people talk about how like why do we have to have a new

7:25concept but I do think that having something specific to power pages I don't have a problem with it well does it leave the script that you create manage is it a new thing to manage and you think to push through lm hurdles I believe that is the case yeah I believe they're storing these I mean if you create your first kind of server logic file it seems to exist and you're saying you're doing that in VS code you're essentially getting another folder in your in your kind of folder structure there so I I do believe it's just another kind of table of data to to worry but when it comes to lm I I do think that that that is the case and security wise they're just similar to web API security so you just have new entries enable disable there are some settings to restrict cross-domain actions if you want to this service or your function to perform to talk only to a weather service for example then you can restrict the domains that it can talk to which solves

8:31the problem that I was going to hack through with my vnet explorations recently and discovery that web hooks do not own any of your vnet settings I would assume that this server site code in power pages will not honor your vnet settings either and it will allow you to talk to whatever unless you restrict it which is nice that they have specific settings at least to restrict cross-domain queries the power pages web server does not reside within your azure tenant so I can't imagine it would respect those types of things what do you mean it doesn't decide oh you mean it's hosted by Microsoft so it's by definition that not in your tenant I believe that's the case yeah okay so vnet yeah we'll do league nor vnet okay I think not I don't know if that I've seen any kind of documentation to confirm this but I believe it's running on the actual server like the power pages server I don't know that it's a I don't know whether it's a kind of a

9:36separate asset that they have running this stuff but you know whether it's on the same servers that are running your app or whether they have something else to run it but that's all going to exist in the Microsoft tenant not in your case Microsoft I hope it's Microsoft control tenant not the actual Microsoft.com tenant you never know but you never know you never know okay that's great and to all the naysayers you say oh give us better constructs to manage whatever we already have I'm saying you obviously never done payments in power pages because that server site logic single-handedly solves so many challenges that I personally came across when trying to implement payments in power pages and I mean outside of the given constructs which also don't work all the time and just managing the secrets and managing the callbacks and this and that and creating sessions and

10:41it's just a nightmare so to me like simple let's say I've got share price servers and I have a private key that allows me to access real time and I want to expose some of that license in challenges aside I want to expose some of information that come in from that service to my users to authenticate the users of my site now go and try to implement that you either exposing your secret inside your client side code or you're off on a link trying to implement it using plugins so you fake in the table then you put in plugin with the hooks and retrieve multiple and you create maybe virtual table but even if it's not virtual you fake in the service and it just becomes just perpetual or you're using power automate now that's another option that's another options yeah but here you have just a single line of code yeah no I think this is the way to do it and yeah

11:41your ability to like said the payment scenario is the obvious and it's even the video example they give you on in the blog post that announced it like there's going to be to me we've done our best to avoid implementing some of these things that require just just if you just had this it would only have been a couple lines of code but let's figure out a different way of doing it or well that'll be a future phase it never happens there's just going to be so many of these scenarios that were hey with two or three or ten lines of this new service on logic it's just it's easy it looks like it's pretty easy to use and it's going to just open up so many more possibilities where we're not talking about hey let's add some Azure functions let's add all the overhead of all these other different techniques it's just going to be a simple easy way to to achieve something that again back in the ADX Studio days was something simple to do and so it's we're finally back to where we were 15 years ago yeah it was extendable right it was easy to do which is first thing a Microsoft shot because it was easy to do but easy to do things you were not supposed to do about

12:47Azure functions people say oh it's easy to do like just wire up as a function yeah of course it's easy to wire up as a function but if you don't have if you like a small medium business that uses data verse for or uses some dynamics 365 app like sales or whatever and you have some basic figure it out and you work on that and you never deploy it as a function before and suddenly you're facing this the whole scenario of oh you need to work out which plan you use you need to deploy this as a function someone needs to maintain it someone needs to maintain secrets and make sure that they update it and it's like it's adding extra layer of complexity whilst all you need is five lines of JavaScript to figure it out yeah that is not the plan yeah I'll give you the perfect example we're working on a project right now to to add a google wallet or apple wallet like a license card to so that you can click there and download a mobile card like a rewards card

13:48that sort of thing and again it's the same thing it's like we get in there and so we could use power automate or we could write an Azure and what we're doing right now is we're writing an Azure function and for something that is just a few lines of code but probably doubles the amount of overall effort now you have to have calls about okay which Azure function pricing model are we doing where we're going to store this code and it's just it's it's another architectural piece that we can now avoid so it takes some of these scenarios that before we're probably just yeah that's too complicated we're not going to do it and it makes that a lot easier does it compare to power automate specifically in the case that we're looking at right now there are some power automate you can do a lot of things but it especially with you'd have to kind of resort to custom connectors to do some of the more fancier things with power automate that I think we're going to be able to alleviate some of those kind of extra layers I don't think power automate from a performance standpoint is super awesome in terms of calling a doesn't have the same fidelity because with power

14:50automate at point you don't have any fidelity how you call it you just say I want to call this endpoint right these power automate flow you just trigger it you don't have fidelity like in server-side logic you have you have get put path to have patch don't think so now put patch yeah delete so you have fidelity of API requests that you don't get this luxury with power automate yeah absolutely that's right yeah I hope that we're going to feel like an hour talking about it all being excited but we seem to agree yeah it's a great construct we should was there it's five years ago but other than that it's great the only thing to go ahead and learn is JavaScript itself and I'm just looking at the documentation talking about objects there's something you need to learn to work with there are some kind of obvious ones like you have access to the site settings and the website and the user so which is important like your contact will authenticate it to your

15:50website and you have logger and you have call context and then two perhaps the most important ones you've got HTTP client that allows you to talk to external services and it's got pause put all the standard requests so I guess it's a wrapper around fetch standard way to request and the other one is data verse which allows you to create retrieve multiple your standard i-organization service wrapped up nicely as a JavaScript object so all the ingredients are there I'm curious what happens if I'm trying if I try to bring external libraries I guess that would be a no-no I'm not trying it yet yeah I believe what I saw was not currently possible something that's been considered but yeah I believe that they don't do not support external packages at this time

16:52fair enough at this time I mean for a civil future yeah yeah because that would be open and such a huge kind of worms very similar to struggle that you have in cxx code in custom connectors I wish to bring external libraries but that's just such a huge security challenge how long did it take to get to be able to include other libraries in a plug in like took only 15 years yeah yeah so yeah we'll talk to you in the 2040 and look forward to announcing that and you know no packages are now supported in power pages server logic okay but the interesting I'm looking forward to people trying to take it apart and poke it around and see how does it stack up against other technologies but certainly I'm looking forward to using it that would be my first choice over a client site JavaScript primarily because your laundry I don't know about your

17:54laundry mine is dirty as and I don't want to expose it to the client especially when it's white coded so do you think that you will is this kind of the end of the web API when would you still use the web API versus going through server logic interesting help me out to you I've got challenge right now I have a customer we've been using cloud inery for some time so they manage visual assets in cloud inery we need to have ability to upload in bulk I'm glad you know I already provide some widgets that you can use you don't have to deal with that so you just upload and it called you back in JavaScript and say I've uploaded this and that he's your end points so it's all nice for unauthenticated requests we looked in sorry unsigned requests we looked into signed requests where you have a little bit more control over what's going on but then again we don't want to expose out cloud inery keys on the clients I don't know it's neither here nor there and we were restricted in previous implementations we were restricted to what we can do that was

18:57before web API kind of appeared in the scene it's a long story it decide go back years and so the question now is I want to upload when I upload those images what I want is to create a date of records for each of those images and attach it to the parent record you have a product and then product images different shapes forms and aspects and so on so you upload those images and you want those images each image recorded in data versus a child record and then point into your cloud inery resource so you upload in bulk and then you need to go 20 records in for each image single record but you need to put those 20 records so web API is option we just go in on a callback you just write web API it's quite straightforward you've got all the data that you need the other one would be to upload it to the server side and this is a scenario where I think web API still takes precedent all I need is to create a single record or multiple records whatever on a callback

20:02from external service and I've got all the data I don't need to feed all there is no secret to manage all I have is the record to create it's a one line of code if I delegate it to a server logic suddenly I have to deal with the for each one calling server logic but there's no advantage on the server side I would do the same one line of code yes I will have an external layer of extra security but I don't see any benefits of delegating it to the server logic so I'd say that's a good scenario where client side API still makes sense if all you need is to create a retrieve records at point in time and that works perfectly from the client side I don't see any advantage unless I'm doing some processing haven't said that if my requirements included hey look you need to look at the upload the image you need to push it through cloudinary AI transformations

21:05you need to aspect ratio and let cloud owner to figure out the best image and things like that so there's a lot of cloud in your API that you can call and deal with the uploaded image if I wanted to include that post upload processing I probably would move to a server side and say hey look if I do need to include some transformations and making sure that the best angle is selected and things like that then yeah so if it includes five steps extra steps and for those steps I would need my cloud in your key then I would definitely go with the server side logic yeah I'm just one curious if they had if the features had come around in the other order if we had server logic and then they announced hey now you have web API would we really be excited about the web API would we just be saying this is just giving us we could have done this anyway so are there certain cases where it just may be more efficient to go directly to the web API probably but would

22:06we really care because it's like yeah the server logic gave us everything we needed anyways but that's an interesting way to look at it yeah if you start in a new project you can mandate that say hey we're not using we're not going to use web API we're just using server side logic and that's it quite possible would you be able to implement everything that's the question on the surface it looks like yes and there is no reason for you to venture on the client side there's nothing you can do on the client side with the web API that you can't do with the server side logic it's an extra layer but hey look that's not our compute capacity it's just I've always found enabling the web API just that's always a little bit scary so if you can avoid that then you still have to enable server side logic you need to say server logic slash enabled true or something like that right yeah but with the web API you got to enable it like we're a table right if you can avoid enabling server side or the web API for a particular table if you don't

23:11otherwise need it and you hide it behind that wrapper that is the server side logic feels a bit safer I'm just looking at the docs and something that I think was added a little bit later because I haven't seen in their regional drop interacting with Microsoft Graph and SharePoint so that's answer the questions that you had about companion apps and I remember even them the all days and you did presentations multiple presentations on the topic how to wire up SharePoint using companion app by wire up it's no longer embedded piece but more intelligent than you you manage the same permissions you flow onto the smart app that operates on documents in SharePoint but for that you need server side logic and that's where companion apps would come in do you see the death of companion apps

24:11because of server side logic I think I mean from we talked about the one to include other packages I think that there's probably still some some companion apps that are probably complicated enough that would you really want to do it with just some kind of JavaScript files living in so I think there's probably some still some complicated companion apps but I know a lot of the companion apps that were done were just say we had a secret like we had to write our 10 lines like we had no choice that was the only way to do it maybe not death but the not even retirement but a very light workload for companion apps moving forward I would say is what I would see yeah like that so when you have a complex functionality definitely we're talking about new deployments if you already have companion app right and perfectly well don't touch it don't just rewire it for the sake of rewiring the next step would be take it for a spin go through some external integrations really interesting examples with graph and SharePoint that gives you

25:13some extra data that you don't have otherwise or you need to jump through some hoops to get it even in your Azure function getting graph data it's not trivial and would be interesting to see how people wire it to all the agent like you whatever agent 365 people would immediately jump and try to wire some AI pieces to that let's see if that makes any sense would you use it as opposed to having a web chat like web chat control is notoriously difficult to wire like copilot agent non-trivial to wire to power pages like out of the box you click and it seems to be wired but if you want to do it yourself there's no set of instructions that allows you to walk through and wire it the way you want it that seems to be a big gap into how easy or difficult it is to wire something trivial like a chat agent I'm surprised that's not one of their not one of their examples

26:18the fact that their example is with the graph and SharePoint and not something copilot related is a bit surprising well leaves room for a bunch of LinkedIn posts about how how exciting and the game changer it is but this one certainly introduces functionality I personally wish was a long time ago perhaps I would consider power pages for projects I never considered before because of yeah complexity of wiring stuff for even trivial functionality and this one certainly solves this closes the gap where complexity is just not enough to justify the whole layer of server-side components Azure functions services that you need to deploy this one goes with your power pages lm right if you bring Azure function in you have another thing to deploy outside of your power platform lm so yeah it doesn't make anything possible we couldn't do before it

27:24just makes doing a lot of things we did do before a lot easier on that very succulent summary succulent let's let's wrap it off thank you very much all right I can't find a I can't think of a better ending in succulent okay thank you very much until next time thank you thank you thank you thank you thank you