Release 1.28.2

Have ./configure tolerate unknown options

.travis.yml

@@ -1,33 +1,18 @@
+addons:
+  postgresql: "9.3"
+
 before_install:
-  - sudo mv /etc/apt/sources.list.d/pgdg-source.list* /tmp
-  - sudo apt-get -qq purge postgis* postgresql*
-  - sudo apt-add-repository --yes ppa:cartodb/postgresql-9.3
-  - sudo apt-add-repository --yes ppa:cartodb/gis
-  - sudo rm -Rf /var/lib/postgresql /etc/postgresql
-  - sudo apt-add-repository --yes ppa:mapnik/nightly-2.3
   - sudo apt-get update
-  - sudo apt-get install -y postgresql-9.3-postgis-2.1
-  - sudo apt-get install -y postgresql-contrib-9.3
-  - sudo apt-get install -q libprotobuf-dev protobuf-compiler
-  - sudo apt-get install -q libmapnik-dev
-  - sudo apt-get install -q mapnik-input-plugin-gdal mapnik-input-plugin-ogr mapnik-input-plugin-postgis
-  - sudo apt-get install -y gdal-bin
-  - echo -e "local\tall\tall\ttrust\nhost\tall\tall\t127.0.0.1/32\ttrust\nhost\tall\tall\t::1/128\ttrust" |sudo tee /etc/postgresql/9.3/main/pg_hba.conf
-  - sudo service postgresql restart
+  - sudo apt-get install -y pkg-config libcairo2-dev libjpeg8-dev libgif-dev
+  - sudo apt-get install postgresql-plpython-9.3
   - createdb template_postgis
   - psql -c "CREATE EXTENSION postgis" template_postgis
 
-before_script:
-  # Tell npm to use known registrars:
-  # see http://blog.npmjs.org/post/78085451721/npms-self-signed-certificate-is-no-more
-  - npm config set ca ""
-
 env:
   - NPROCS=1 JOBS=1 PGUSER=postgres
 
 language: node_js
 node_js:
-  - "0.8"
   - "0.10"
 
 notifications:

Makefile

@@ -17,8 +17,11 @@ config/environments/test.js: config.status--test
 
 check-local: config/environments/test.js
 	./run_tests.sh ${RUNTESTFLAGS} \
-    test/unit/cartodb/*.js \
-    test/acceptance/*.js 
+	test/unit/cartodb/*.js \
+	test/unit/cartodb/cache/model/*.js \
+	test/integration/*.js \
+	test/acceptance/*.js \
+	test/acceptance/cache/*.js
 
 check-submodules:
 	PATH="$$PATH:$(srcdir)/node_modules/.bin/"; \

NEWS.md

@@ -1,3 +1,191 @@
+1.28.2 -- 2015-02-17
+--------------------
+
+Announcements:
+- Upgrades windshaft to [0.37.2](https://github.com/CartoDB/Windshaft/releases/tag/0.37.2)
+
+
+1.28.1 -- 2015-02-17
+--------------------
+
+Announcements:
+- Upgrades windshaft to [0.37.1](https://github.com/CartoDB/Windshaft/releases/tag/0.37.1)
+
+
+1.28.0 -- 2015-02-17
+--------------------
+
+Announcements:
+- Upgrades windshaft to [0.37.0](https://github.com/CartoDB/Windshaft/releases/tag/0.37.0)
+
+New features:
+ - QueryTablesApi will always use an authenticated query to retrieve last update, this allows to query affected private
+ tables last update (#253)
+
+
+1.27.0 -- 2015-02-16
+--------------------
+
+Announcements:
+- Adds default image placeholder for http renderer to use as fallback
+
+New features:
+- `named` layers type, see [MapConfig-NamedMaps-extension](docs/MapConfig-NamedMaps-extension.md)
+  - Starts using datasource per layer feature from Windshaft ([2c7bc6a](https://github.com/CartoDB/Windshaft-cartodb/commit/2c7bc6adde561b20ed955b905e3c7bcd6795d128))
+
+Bugfixes:
+- Fixes tests with beforeEach and afterEach triggers
+
+
+1.26.2 -- 2015-01-28
+--------------------
+
+Bugfixes:
+ - Accept 'open' string in templates' `auth` as authorized.
+
+
+1.26.1 -- 2015-01-28
+--------------------
+
+Announcements:
+ - Upgrades windshaft to 0.35.1, see https://github.com/CartoDB/Windshaft/pull/254
+
+
+1.26.0 -- 2015-01-27
+--------------------
+
+Announcements:
+ - Upgrades windshaft to 0.35.0, supports mapconfig version `1.3.0`
+
+
+1.25.0 -- 2015-01-26
+--------------------
+
+Announcements:
+ - No more signed maps (#227 and #238)
+    - Splits template maps endpoint into its own controller
+    - Removes TemplateMaps dependency on SignedMaps
+     - Token validation is done against the template
+     - Template is always extended with default values for auth and placeholders
+     - MapConfig is extended, in order to validate auth_tokens, with template info:
+        - template name
+        - template auth
+     - No more locks to create, update or delete templates
+        - Trusting in redis' hash semantics
+        - Some tradeoffs:
+            * A client having more templates than allowed by a race condition between limit (HLEN) check and creation (HSET)
+            * Updating a template could happen while deleting it, resulting in a new template
+            * Templates already instantiated will be accessible through their layergroup so it is possible to continue requesting tiles/grids/etc.
+     - Authorisation is now handled by template maps
+    - Template instantiation returns new instances with default values if they are missing
+
+
+New features:
+ - Basic layergroup validation on named map creation/update (#196)
+ - Add named maps surrogate keys and call invalidation on template modification/deletion (#247)
+    - Extends TemplateMaps backend with EventEmitter
+        - Emits for create, update and delete templates
+    - VarnishHttpCacheBackend will invalidate a varnish instance via HTTP PURGE method
+        - In the future there could be more backends, for instance to invalidate a CDN.
+    - NamedMapsEntry has the responsibility to generate a cache key for a named map
+        - It probably should receive a template/named map instead of owner and template name
+    - SurrogateKeysCache is responsible to tag responses with a header
+        - It also is responsible for invalidations given an Invalidation Backend
+        - In the future it could have several backends so it can invalidates different caches
+    - SurrogateKeysCache is subscribed to TemplateMaps events to do the invalidations
+
+
+1.24.0 -- 2015-01-15
+--------------------
+
+Announcements:
+ - Upgrades windshaft to 0.34.0 for retina support
+
+
+1.23.1 -- 2015-01-14
+--------------------
+
+Announcements:
+ - Regenerate npm-shrinkwrap.json
+
+
+1.23.0 -- 2015-01-14
+--------------------
+
+Announcements:
+ - Upgrades windshaft to 0.33.0
+
+New features:
+ - Sets HTTP renderer configuration in server_options
+
+
+1.22.0 -- 2015-01-13
+--------------------
+
+New features:
+ - Health check endpoint
+
+
+1.21.2 -- 2014-12-15
+--------------------
+
+Announcements:
+ - Upgrades windshaft to 0.32.4
+
+
+1.21.1 -- 2014-12-11
+--------------------
+
+Announcements:
+ - Upgrades windshaft to 0.32.2
+
+Bugfixes:
+ - Closes fd for log files on `kill -HUP` (#230)
+
+
+
+1.21.0 -- 2014-10-24
+--------------------
+
+New features:
+ - Allow a different cache-control max-age for layergroup responses
+
+
+1.20.2 -- 2014-10-20
+--------------------
+
+Announcements:
+ - Upgrades windshaft to 0.31.0
+
+
+1.20.1 -- 2014-10-17
+--------------------
+
+Announcements:
+ - Upgrades redis-mpool to 0.3.0
+
+
+1.20.0 -- 2014-10-15
+--------------------
+
+New features:
+ - Report to statsd the status of redis pools
+ - Upgrades Windshaft to start reporting redis/renderers/mapnik pool metrics
+
+Enhancements:
+ - Share one redis-mpool across the application
+
+
+1.19.0 -- 2014-10-14
+--------------------
+
+Announcements:
+ - Dropping support for npm <1.2.1
+   npm-shrinkwrap.json is incompatible when generated with npm >=1.2.1 and consumed by npm <1.2.1
+ - Upgrades windshaft to 0.28.2
+ - Generates npm-shrinkwrap.json with npm >1.2.0
+
+
 1.18.2 -- 2014-10-13
 --------------------
 

app.js

@@ -8,7 +8,8 @@
  */
 
 var path = require('path'),
-    fs = require('fs')
+    fs = require('fs'),
+    RedisPool = require('redis-mpool')
 ;
 
 
@@ -31,7 +32,7 @@ var _ = require('underscore');
 global.environment  = require(__dirname + '/config/environments/' + ENV);
 global.environment.api_hostname = require('os').hostname().split('.')[0];
 
-global.log4js = require('log4js')
+global.log4js = require('log4js');
 log4js_config = {
   appenders: [],
   replaceConsole:true
@@ -69,13 +70,25 @@ if ( global.environment.rollbar ) {
 log4js.configure(log4js_config, { cwd: __dirname });
 global.logger = log4js.getLogger();
 
+var redisOpts = _.extend(global.environment.redis, { name: 'windshaft' }),
+    redisPool = new RedisPool(redisOpts);
+
 // Include cartodb_windshaft only _after_ the "global" variable is set
 // See https://github.com/Vizzuality/Windshaft-cartodb/issues/28
-var CartodbWindshaft = require('./lib/cartodb/cartodb_windshaft');
-var serverOptions = require('./lib/cartodb/server_options')();
+var CartodbWindshaft = require('./lib/cartodb/cartodb_windshaft'),
+    serverOptions = require('./lib/cartodb/server_options')(redisPool);
 
 ws = CartodbWindshaft(serverOptions);
 
+if (global.statsClient) {
+    redisPool.on('status', function(status) {
+        var keyPrefix = 'windshaft.redis-pool.' + status.name + '.db' + status.db + '.';
+        global.statsClient.gauge(keyPrefix + 'count', status.count);
+        global.statsClient.gauge(keyPrefix + 'unused', status.unused);
+        global.statsClient.gauge(keyPrefix + 'waiting', status.waiting);
+    });
+}
+
 // Maximum number of connections for one process
 // 128 is a good number if you have up to 1024 filedescriptors
 // 4 is good if you have max 32 filedescriptors
@@ -103,8 +116,11 @@ process.on('SIGUSR2', function() {
 });
 
 process.on('SIGHUP', function() {
-  log4js.configure(log4js_config);
-  console.log('Log files reloaded');
+    global.log4js.clearAndShutdownAppenders(function() {
+        global.log4js.configure(log4js_config);
+        global.logger = log4js.getLogger();
+        console.log('Log files reloaded');
+    });
 });
 
 process.on('uncaughtException', function(err) {

config/environments/development.js.example

@@ -40,7 +40,7 @@ var config = {
     // If log_filename is given logs will be written
     // there, in append mode. Otherwise stdout is used (default).
     // Log file will be re-opened on receiving the HUP signal
-    ,log_filename: 'logs/node-windshaft.log'
+    ,log_filename: undefined
     // Templated database username for authorized user
     // Supported labels: 'user_id' (read from redis)
     ,postgres_auth_user: 'development_cartodb_user_<%= user_id %>'
@@ -63,6 +63,7 @@ var config = {
         */
         row_limit: 65535,
         simplify_geometries: true,
+        use_overviews: true, // use overviews to retrieve raster
         /*
          * Set persist_connection to false if you want
          * database connections to be closed on renderer
@@ -86,7 +87,21 @@ var config = {
       // Milliseconds since last access before renderer cache item expires
       cache_ttl: 60000,
       metatile: 4,
-      bufferSize: 64
+      bufferSize: 64,
+      statsInterval: 5000, // milliseconds between each report to statsd about number of renderers and mapnik pool status
+      http: {
+          timeout: 2000, // the timeout in ms for a http tile request
+          proxy: undefined, // the url for a proxy server
+          whitelist: [ // the whitelist of urlTemplates that can be used
+              'http://{s}.example.com/{z}/{x}/{y}.png'
+          ],
+          // image to use as placeholder when urlTemplate is not in the whitelist
+          // if provided the http renderer will use it instead of throw an error
+          fallbackImage: {
+              type: 'fs', // 'fs' and 'url' supported
+              src: __dirname + '/../../assets/default-placeholder.png'
+          }
+      }
     }
     ,millstone: {
         // Needs to be writable by server user
@@ -103,11 +118,19 @@ var config = {
         // by 2 to know how many possible connections will be
         // kept open by the server. The default is 50.
         max: 50,
+        returnToHead: true, // defines the behaviour of the pool: false => queue, true => stack
         idleTimeoutMillis: 1, // idle time before dropping connection
         reapIntervalMillis: 1, // time between cleanups
+        slowQueries: {
+            log: true,
+            elapsedThreshold: 200
+        },
         slowPool: {
             log: true, // whether a slow acquire must be logged or not
             elapsedThreshold: 25 // the threshold to determine an slow acquire must be reported or not
+        },
+        emitter: {
+            statusInterval: 5000 // time, in ms, between each status report is emitted from the pool, status is sent to statsd
         }
     }
     ,sqlapi: {
@@ -132,14 +155,25 @@ var config = {
     }
     ,varnish: {
         host: 'localhost',
-        port: 6082,
+        port: 6082, // the por for the telnet interface where varnish is listening to
+        http_port: 6081, // the port for the HTTP interface where varnish is listening to
+        purge_enabled: false, // whether the purge/invalidation mechanism is enabled in varnish or not
         secret: 'xxx',
-        ttl: 86400
+        ttl: 86400,
+        layergroupTtl: 86400 // the max-age for cache-control header in layergroup responses
     }
     // If useProfiler is true every response will be served with an
     // X-Tiler-Profile header containing elapsed timing for various 
     // steps taken for producing the response.
     ,useProfiler:true
+    // Settings for the health check available at /health
+    ,health: {
+      enabled: false,
+      username: 'localhost',
+      z: 0,
+      x: 0,
+      y: 0
+    }
 };
 
 module.exports = config;

config/environments/production.js.example

@@ -65,6 +65,7 @@ var config = {
          */
         persist_connection: false,
         simplify_geometries: true,
+        use_overviews: true, // use overviews to retrieve raster
         max_size: 500
     }
     ,mapnik_version: undefined
@@ -80,7 +81,21 @@ var config = {
       // Milliseconds since last access before renderer cache item expires
       cache_ttl: 60000,
       metatile: 4,
-      bufferSize: 64
+      bufferSize: 64,
+      statsInterval: 5000, // milliseconds between each report to statsd about number of renderers and mapnik pool status
+      http: {
+          timeout: 2000, // the timeout in ms for a http tile request
+          proxy: undefined, // the url for a proxy server
+          whitelist: [ // the whitelist of urlTemplates that can be used
+              'http://{s}.example.com/{z}/{x}/{y}.png'
+          ],
+          // image to use as placeholder when urlTemplate is not in the whitelist
+          // if provided the http renderer will use it instead of throw an error
+          fallbackImage: {
+              type: 'fs', // 'fs' and 'url' supported
+              src: __dirname + '/../../assets/default-placeholder.png'
+          }
+      }
     }
     ,millstone: {
         // Needs to be writable by server user
@@ -97,11 +112,19 @@ var config = {
         // by 2 to know how many possible connections will be
         // kept open by the server. The default is 50.
         max: 50,
+        returnToHead: true, // defines the behaviour of the pool: false => queue, true => stack
         idleTimeoutMillis: 30000, // idle time before dropping connection
         reapIntervalMillis: 1000, // time between cleanups
+        slowQueries: {
+            log: true,
+            elapsedThreshold: 200
+        },
         slowPool: {
             log: true, // whether a slow acquire must be logged or not
             elapsedThreshold: 25 // the threshold to determine an slow acquire must be reported or not
+        },
+        emitter: {
+            statusInterval: 5000 // time, in ms, between each status report is emitted from the pool, status is sent to statsd
         }
     }
     ,sqlapi: {
@@ -126,9 +149,12 @@ var config = {
     }
     ,varnish: {
         host: 'localhost',
-        port: 6082,
+        port: 6082, // the por for the telnet interface where varnish is listening to
+        http_port: 6081, // the port for the HTTP interface where varnish is listening to
+        purge_enabled: false, // whether the purge/invalidation mechanism is enabled in varnish or not
         secret: 'xxx',
-        ttl: 86400
+        ttl: 86400,
+        layergroupTtl: 86400 // the max-age for cache-control header in layergroup responses
     }
     // If useProfiler is true every response will be served with an
     // X-Tiler-Profile header containing elapsed timing for various 
@@ -149,6 +175,14 @@ var config = {
         handler: 'inline'
       }
     }
+    // Settings for the health check available at /health
+    ,health: {
+      enabled: true,
+      username: 'localhost',
+      z: 0,
+      x: 0,
+      y: 0
+    }
 };
 
 module.exports = config;

config/environments/staging.js.example

@@ -57,6 +57,7 @@ var config = {
         extent: "-20037508.3,-20037508.3,20037508.3,20037508.3",
         row_limit: 65535,
         simplify_geometries: true,
+        use_overviews: true, // use overviews to retrieve raster
         /*
          * Set persist_connection to false if you want
          * database connections to be closed on renderer
@@ -80,7 +81,21 @@ var config = {
       // Milliseconds since last access before renderer cache item expires
       cache_ttl: 60000,
       metatile: 4,
-      bufferSize: 64
+      bufferSize: 64,
+      statsInterval: 5000, // milliseconds between each report to statsd about number of renderers and mapnik pool status
+      http: {
+          timeout: 2000, // the timeout in ms for a http tile request
+          proxy: undefined, // the url for a proxy server
+          whitelist: [ // the whitelist of urlTemplates that can be used
+              'http://{s}.example.com/{z}/{x}/{y}.png'
+          ],
+          // image to use as placeholder when urlTemplate is not in the whitelist
+          // if provided the http renderer will use it instead of throw an error
+          fallbackImage: {
+              type: 'fs', // 'fs' and 'url' supported
+              src: __dirname + '/../../assets/default-placeholder.png'
+          }
+      }
     }
     ,millstone: {
         // Needs to be writable by server user
@@ -97,11 +112,19 @@ var config = {
         // by 2 to know how many possible connections will be
         // kept open by the server. The default is 50.
         max: 50,
+        returnToHead: true, // defines the behaviour of the pool: false => queue, true => stack
         idleTimeoutMillis: 30000, // idle time before dropping connection
         reapIntervalMillis: 1000, // time between cleanups
+        slowQueries: {
+            log: true,
+            elapsedThreshold: 200
+        },
         slowPool: {
             log: true, // whether a slow acquire must be logged or not
             elapsedThreshold: 25 // the threshold to determine an slow acquire must be reported or not
+        },
+        emitter: {
+            statusInterval: 5000 // time, in ms, between each status report is emitted from the pool, status is sent to statsd
         }
     }
     ,sqlapi: {
@@ -126,9 +149,12 @@ var config = {
     }
     ,varnish: {
         host: 'localhost',
-        port: 6082,
+        port: 6082, // the por for the telnet interface where varnish is listening to
+        http_port: 6081, // the port for the HTTP interface where varnish is listening to
+        purge_enabled: false, // whether the purge/invalidation mechanism is enabled in varnish or not
         secret: 'xxx',
-        ttl: 86400
+        ttl: 86400,
+        layergroupTtl: 86400 // the max-age for cache-control header in layergroup responses
     }
     // If useProfiler is true every response will be served with an
     // X-Tiler-Profile header containing elapsed timing for various 
@@ -149,6 +175,14 @@ var config = {
         handler: 'inline'
       }
     }
+    // Settings for the health check available at /health
+    ,health: {
+      enabled: false,
+      username: 'localhost',
+      z: 0,
+      x: 0,
+      y: 0
+    }
 };
 
 module.exports = config;

config/environments/test.js.example

@@ -50,13 +50,14 @@ var config = {
     ,postgres: {
         // Parameters to pass to datasource plugin of mapnik
         // See http://github.com/mapnik/mapnik/wiki/PostGIS
-        user: "testpublicuser",
+        user: "test_windshaft_publicuser",
         password: "public",
         host: '127.0.0.1',
         port: 5432,
         extent: "-20037508.3,-20037508.3,20037508.3,20037508.3",
         row_limit: 65535,
         simplify_geometries: true,
+        use_overviews: true, // use overviews to retrieve raster
         /*
          * Set persist_connection to false if you want
          * database connections to be closed on renderer
@@ -80,7 +81,23 @@ var config = {
       // Milliseconds since last access before renderer cache item expires
       cache_ttl: 60000,
       metatile: 4,
-      bufferSize: 64
+      bufferSize: 64,
+      statsInterval: 5000, // milliseconds between each report to statsd about number of renderers and mapnik pool status
+      http: {
+          timeout: 2000, // the timeout in ms for a http tile request
+          proxy: undefined, // the url for a proxy server
+          whitelist: [ // the whitelist of urlTemplates that can be used
+              'http://{s}.example.com/{z}/{x}/{y}.png',
+              // for testing purposes
+              'http://{s}.basemaps.cartocdn.com/dark_nolabels/{z}/{x}/{y}.png'
+          ],
+          // image to use as placeholder when urlTemplate is not in the whitelist
+          // if provided the http renderer will use it instead of throw an error
+          fallbackImage: {
+              type: 'fs', // 'fs' and 'url' supported
+              src: __dirname + '/../../assets/default-placeholder.png'
+          }
+      }
     }
     ,millstone: {
         // Needs to be writable by server user
@@ -97,11 +114,19 @@ var config = {
         // by 2 to know how many possible connections will be
         // kept open by the server. The default is 50.
         max: 50,
+        returnToHead: true, // defines the behaviour of the pool: false => queue, true => stack
         idleTimeoutMillis: 1, // idle time before dropping connection
         reapIntervalMillis: 1, // time between cleanups
+        slowQueries: {
+            log: true,
+            elapsedThreshold: 200
+        },
         slowPool: {
             log: true, // whether a slow acquire must be logged or not
             elapsedThreshold: 25 // the threshold to determine an slow acquire must be reported or not
+        },
+        emitter: {
+            statusInterval: 5000 // time, in ms, between each status report is emitted from the pool, status is sent to statsd
         }
     }
     ,sqlapi: {
@@ -128,14 +153,25 @@ var config = {
     }
     ,varnish: {
         host: '',
-        port: null,
+        port: null, // the por for the telnet interface where varnish is listening to
+        http_port: 6081, // the port for the HTTP interface where varnish is listening to
+        purge_enabled: false, // whether the purge/invalidation mechanism is enabled in varnish or not
         secret: 'xxx',
-        ttl: 86400
+        ttl: 86400,
+        layergroupTtl: 86400 // the max-age for cache-control header in layergroup responses
     }
     // If useProfiler is true every response will be served with an
     // X-Tiler-Profile header containing elapsed timing for various 
     // steps taken for producing the response.
     ,useProfiler:true
+    // Settings for the health check available at /health
+    ,health: {
+      enabled: false,
+      username: 'localhost',
+      z: 0,
+      x: 0,
+      y: 0
+    }
 };
 
 module.exports = config;

configure

@@ -56,9 +56,8 @@ while test -n "$1"; do
       ENVIRONMENT=`echo "$1" | cut -d= -f2`
       ;;
     *)
-      echo "Unknown option '$1'" >&2
-      usage >&2
-      exit 1
+      echo "Unused option '$1'" >&2
+      ;;
   esac
   shift
 done

docs/Map-API-internal.md

@@ -1,6 +1,6 @@
 # Kind of maps
 
-Windshaft-CartoDB supports these kind of maps:
+Windshaft-CartoDB supports the following types of maps:
 
  - [Temporary maps](#temporary-maps) (created by anyone)
    - [Detached maps](#detached-maps)
@@ -12,14 +12,14 @@ Windshaft-CartoDB supports these kind of maps:
 ## Temporary maps
 
 Temporary maps have no owners and are anonymous in nature.
-There are two kind of temporary maps:
+There are two kinds of temporary maps:
 
  - Detached maps (aka MultiLayer-API)
  - Inline maps 
 
 ### Detached maps
 
-Detached maps are maps which are configured with a request
+Detached maps are maps that are configured with a request
 obtaining a temporary token and then used by referencing
 the obtained token. The token expires automatically when unused.
 

docs/Map-API.md

@@ -1,14 +1,14 @@
 ## Maps API
 
-The CartoDB Maps API allows you to generate maps based on data hosted in your CartoDB account and style them using CartoCSS. The API generates a XYZ based URL to fetch Web Mercator projected tiles using web clients like Leaflet, Google Maps, OpenLayers.
+The CartoDB Maps API allows you to generate maps based on data hosted in your CartoDB account and you can apply custom SQL and CartoCSS to the data. The API generates a XYZ-based URL to fetch Web Mercator projected tiles using web clients such as [Leaflet](http://leafletjs.com), [Google Maps](https://developers.google.com/maps/), or [OpenLayers](http://openlayers.org/).
 
 You can create two types of maps with the Maps API:
 
 - **Anonymous maps**  
-  Maps that can be created using your CartoDB public data. Any client can change the read-only SQL and CartoCSS parameters that generate the map tiles. These maps can be created from a JavaScript application alone and no authenticated calls are needed. See [this CartoDB.js example]({{ '/cartodb-platform/cartodb-js.html' | prepend: site.baseurl }}).
+  You can create maps using your CartoDB public data. Any client can change the read-only SQL and CartoCSS parameters that generate the map tiles. These maps can be created from a JavaScript application alone and no authenticated calls are needed. See [this CartoDB.js example]({{ '/cartodb-platform/cartodb-js.html' | prepend: site.baseurl }}).
 
 - **Named maps**  
-  Maps that access to your private data. These maps require an owner to setup and modify any SQL and CartoCSS parameters and are not modifiable without new setup calls. 
+  There are also maps that have access to your private data. These maps require an owner to setup and modify any SQL and CartoCSS parameters and are not modifiable without new setup calls. 
 
 ## Quickstart
 
@@ -16,7 +16,7 @@ You can create two types of maps with the Maps API:
 
 Here is an example of how to create an anonymous map with JavaScript:
 
-{% highlight javascript %}
+```javascript
 var mapconfig = {
   "version": "1.0.1",
   "layers": [{
@@ -37,19 +37,18 @@ $.ajax({
   url: 'http://documentation.cartodb.com/api/v1/map',
   data: JSON.stringify(mapconfig),
   success: function(data) {
-    var templateUrl = 'http://documentation.cartodb.com/api/v1/map/' + data.layergroupid + '{z}/{x}/{y}.png'
+    var templateUrl = 'http://documentation.cartodb.com/api/v1/map/' + data.layergroupid + '/{z}/{x}/{y}.png'
     console.log(templateUrl);
   }
 })
-{% endhighlight %}
+```
 
 ### Named maps
 
 Let's create a named map using some private tables in a CartoDB account.
-The following API call creates a map of European countries that have a white fill color:
+The following map config sets up a map of European countries that have a white fill color:
 
-{% highlight javascript %}
-// mapconfig.json
+```javascript
 {
   "version": "0.0.1",
   "name": "test",
@@ -67,38 +66,38 @@ The following API call creates a map of European countries that have a white fil
     }]
   }
 }
-{% endhighlight %}
+```
 
-The map config needs to be sent to CartoDB's Map API using an authenticated call. Here we use a command line tool called `curl`. For more info about this tool see [this blog post](http://quickleft.com/blog/command-line-tutorials-curl) or type ``man curl`` in bash. Using `curl` the call would look like:
+The map config needs to be sent to CartoDB's Map API using an authenticated call. Here we will use a command line tool called `curl`. For more info about this tool, see [this blog post](http://quickleft.com/blog/command-line-tutorials-curl), or type ``man curl`` in bash. Using `curl`, and storing the config from above in a file `mapconfig.json`, the call would look like:
 
 <div class="code-title notitle code-request"></div>
-{% highlight bash %}
+```bash
 curl 'https://{account}.cartodb.com/api/v1/map/named?api_key=APIKEY' -H 'Content-Type: application/json' -d @mapconfig.json
-{% endhighlight %}
+```
 
-To get the `URL` to fetch the tiles you need to instantiate the map.
+To get the `URL` to fetch the tiles you need to instantiate the map, where `template_id` is the template name from the previous response.
 
 <div class="code-title notitle code-request"></div>
-{% highlight bash %}
-curl 'http://{account}.cartodb.com/api/v1/map/named/test' -H 'Content-Type: application/json'
-{% endhighlight %}
+```bash
+curl -X POST 'http://{account}.cartodb.com/api/v1/map/named/:template_id' -H 'Content-Type: application/json'
+```
 
 The response will return JSON with properties for the `layergroupid` and the timestamp (`last_updated`) of the last data modification. 
 
 Here is an example response:
 
-{% highlight javascript %}
+```javascript
 {
   "layergroupid": "c01a54877c62831bb51720263f91fb33:0",
   "last_updated": "1970-01-01T00:00:00.000Z"
 }
-{% endhighlight %}
+```
 
 You can use the `layergroupid` to instantiate a URL template for accessing tiles on the client. Here we use the `layergroupid` from the example response above in this URL template:
 
-{% highlight bash %}
-http://documentation.cartodb.com/tiles/layergroup/c01a54877c62831bb51720263f91fb33:0/{z}/{x}/{y}.png
-{% endhighlight %}
+```bash
+http://documentation.cartodb.com/api/v1/map/c01a54877c62831bb51720263f91fb33:0/{z}/{x}/{y}.png
+```
 
 ## General Concepts
 
@@ -106,7 +105,7 @@ The following concepts are the same for every endpoint in the API except when it
 
 ### Auth
 
-By default, users do not have access to private tables in CartoDB. In order to instantiate a map from private table data an API Key is required. Additionally, to include some endpoints an API Key must be included (e.g. creating a named map).
+By default, users do not have access to private tables in CartoDB. In order to instantiate a map from private table data an API Key is required. Additionally, to include some endpoints, an API Key must be included (e.g. creating a named map).
 
 To execute an authorized request, api_key=YOURAPIKEY should be added to the request URL. The param can be also passed as POST param. We **strongly advise** using HTTPS when you are performing requests that include your `api_key`.
 
@@ -114,19 +113,19 @@ To execute an authorized request, api_key=YOURAPIKEY should be added to the requ
 
 Errors are reported using standard HTTP codes and extended information encoded in JSON with this format:
 
-{% highlight javascript %}
+```javascript
 {
   "errors": [
     "access forbidden to table TABLE"
   ]
 }
-{% endhighlight %}
+```
 
 If you use JSONP, the 200 HTTP code is always returned so the JavaScript client can receive errors from the JSON object.
 
 ### CORS support
 
-All the endpoints which might be accessed using a web browser add CORS headers and allow OPTIONS method.
+All the endpoints, which might be accessed using a web browser, add CORS headers and allow OPTIONS method.
 
 ## Anonymous Maps
 
@@ -137,13 +136,13 @@ Anonymous maps allows you to instantiate a map given SQL and CartoCSS. It also a
 #### Definition
 
 <div class="code-title notitle code-request"></div>
-{% highlight html %}
+```html
 POST /api/v1/map
-{% endhighlight %}
+```
 
 #### Params
 
-{% highlight javascript %}
+```javascript
 {
   "version": "1.0.1",
   "layers": [{
@@ -156,7 +155,7 @@ POST /api/v1/map
     }
   }]
 }
-{% endhighlight %}
+```
 
 Should be a [Mapconfig](https://github.com/CartoDB/Windshaft/blob/0.19.1/doc/MapConfig-1.1.0.md).
 
@@ -167,9 +166,9 @@ The response includes:
 - **layergroupid**  
   The ID for that map, used to compose the URL for the tiles. The final URL is:
 
-  {% highlight html %}
+  ```html
   http://{account}.cartodb.com/api/v1/map/:layergroupid/{z}/{x}/{y}.png
-  {% endhighlight %}
+  ```
 
 - **updated_at**  
   The ISO date of the last time the data involved in the query was updated.
@@ -183,12 +182,12 @@ The response includes:
 #### Example
 
 <div class="code-title code-request with-result">REQUEST</div>
-{% highlight bash %}
+```bash
 curl 'http://documentation.cartodb.com/api/v1/map' -H 'Content-Type: application/json' -d @mapconfig.json
-{% endhighlight %}
+```
 
 <div class="code-title">RESPONSE</div>
-{% highlight javascript %}
+```javascript
 {
   "layergroupid":"c01a54877c62831bb51720263f91fb33:0",
   "last_updated":"1970-01-01T00:00:00.000Z"
@@ -197,33 +196,33 @@ curl 'http://documentation.cartodb.com/api/v1/map' -H 'Content-Type: application
     "https": "https://cdb.com"
   }
 }
-{% endhighlight %}
+```
 
 The tiles can be accessed using:
 
-{% highlight bash %}
+```bash
 http://documentation.cartodb.com/api/v1/map/c01a54877c62831bb51720263f91fb33:0/{z}/{x}/{y}.png
-{% endhighlight %}
+```
 
 For UTF grid tiles:
 
-{% highlight bash %}
+```bash
 http://documentation.cartodb.com/api/v1/map/c01a54877c62831bb51720263f91fb33:0/:layer/{z}/{x}/{y}.grid.json
-{% endhighlight %}
+```
 
 For attributes defined in `attributes` section:
 
-{% highlight bash %}
+```bash
 http://documentation.cartodb.com/api/v1/map/c01a54877c62831bb51720263f91fb33:0/:layer/attributes/:feature_id
-{% endhighlight %}
+```
 
 Which returns JSON with the attributes defined, like:
 
-{% highlight javascript %}
+```javascript
 { c: 1, d: 2 }
-{% endhighlight %}
+```
 
-Notice UTF Grid and attributes endpoints need an intenger parameter, ``layer``. That number is the 0-based index of the layer inside the mapconfig. So in this case 0 returns the UTF grid tiles/attributes for layer 0, the only layer in the example mapconfig. If a second layer was available it could be returned with 1, a third layer with 2, etc.
+Notice UTF Grid and attributes endpoints need an integer parameter, ``layer``. That number is the 0-based index of the layer inside the mapconfig. In this case, 0 returns the UTF grid tiles/attributes for layer 0, the only layer in the example mapconfig. If a second layer was available it could be returned with 1, a third layer with 2, etc.
 
 ### Create JSONP
 
@@ -232,16 +231,13 @@ The JSONP endpoint is provided in order to allow web browsers access which don't
 #### Definition
 
 <div class="code-title notitle code-request"></div>
-{% highlight bash %}
+```bash
 GET /api/v1/map?callback=method
-{% endhighlight %}
+```
 
 #### Params
 
-- **auth_token** *(optional)*  
-  If the named map needs authorization.
-
-- **config**  
+- **config**
   Encoded JSON with the params for creating named maps (the variables defined in the template).
 
 - **lmza**  
@@ -253,23 +249,30 @@ GET /api/v1/map?callback=method
 #### Example
 
 <div class="code-title code-request with-result">REQUEST</div>
-{% highlight bash %}
-curl http://...
-{% endhighlight %}
+```bash
+curl "https://documentation.cartodb.com/api/v1/map?callback=callback&config=%7B%22version%22%3A%221.0.1%22%2C%22layers%22%3A%5B%7B%22type%22%3A%22cartodb%22%2C%22options%22%3A%7B%22sql%22%3A%22select+%2A+from+european_countries_e%22%2C%22cartocss%22%3A%22%23european_countries_e%7B+polygon-fill%3A+%23FF6600%3B+%7D%22%2C%22cartocss_version%22%3A%222.3.0%22%2C%22interactivity%22%3A%5B%22cartodb_id%22%5D%7D%7D%5D%7D"
+```
 
 <div class="code-title">RESPONSE</div>
-{% highlight javascript %}
-{
-}
-{% endhighlight %}
+```javascript
+callback({
+    layergroupid: "d9034c133262dfb90285cea26c5c7ad7:0",
+    cdn_url: {
+        "http": "http://cdb.com",
+        "https": "https://cdb.com"
+    },
+    last_updated: "1970-01-01T00:00:00.000Z"
+})
+```
 
 ### Remove
 
-Anonymous maps cannot be removed by an API call. They will expire after about five minutes but sometimes longer. If an anonymous map expires and tiles are requested from it, an error will be raised. This could happen if a user leaves a map open and after time returns to the map an attempts to interact with it in a way that requires new tiles (e.g. zoom). The client will need to go through the steps of creating the map again to fix the problem.
+Anonymous maps cannot be removed by an API call. They will expire after about five minutes but sometimes longer. If an anonymous map expires and tiles are requested from it, an error will be raised. This could happen if a user leaves a map open and after time, returns to the map and attempts to interact with it in a way that requires new tiles (e.g. zoom). The client will need to go through the steps of creating the map again to fix the problem.
+
 
 ## Named Maps
 
-Named maps are essentially the same as anonymous maps but the mapconfig is stored in the server and given a unique name. Two other big differences are that you can created named maps from private data and that users without an API Key can see them even though they are from that private data. 
+Named maps are essentially the same as anonymous maps except the mapconfig is stored on the server and the map is given a unique name. Two other big differences are: you can create named maps from private data and that users without an API Key can see them even though they are from that private data.
 
 The main two differences compared to anonymous maps are:
 
@@ -277,7 +280,7 @@ The main two differences compared to anonymous maps are:
   This allows you to control who is able to see the map based on a token auth
 
 - **templates**  
-  Since the mapconfig is static it can contain some variables so the client con modify the map appearance using those variables.
+  Since the mapconfig is static it can contain some variables so the client can modify the map's appearance using those variables.
 
 Template maps are persistent with no preset expiration. They can only be created or deleted by a CartoDB user with a valid API_KEY (see auth section).
 
@@ -286,14 +289,16 @@ Template maps are persistent with no preset expiration. They can only be created
 #### Definition
 
 <div class="code-title notitle code-request"></div>
-{% highlight html %}
+```html
 POST /api/v1/map/named
-{% endhighlight %}
+```
 
 #### Params
 
+- **api_key** is required
+
 <div class="code-title">template.json</div>
-{% highlight javascript %}
+```javascript
 {
   "version": "0.0.1",
   "name": "template_name",
@@ -328,27 +333,28 @@ POST /api/v1/map/named
     ]
   }
 }
-{% endhighlight %}
+```
 
 ##### Arguments
 
-- **name**: there can be at most 1 template with the same name for any user valid names start with a letter and only contains letter, numbers or underscores
+- **name**: There can be at most _one_ template with the same name for any user. Valid names start with a letter, and only contain letters, numbers, or underscores (_).
 - **auth**:
-  - **method** `"token"` or `"open"` (the default if no `"method"` is given)
-- **placeholders**: Variables not listed here are not substituted. Variable not provided at instantiation time trigger an error. A default is required for optional variables. Type specification is used for quoting, to avoid injections see template format section below.
-- **layergroup**: the layer list definition. This is the MapConfig explained in anonymous maps see https://github.com/CartoDB/Windshaft/blob/master/doc/MapConfig-1.1.0.md
+  - **method** `"token"` or `"open"` (the default if no `"method"` is given).
+  - **valid_tokens** when `"method"` is set to `"token"`, the values listed here allow you to instantiate the named map.
+- **placeholders**: Variables not listed here are not substituted. Variables not provided at instantiation time trigger an error. A default is required for optional variables. Type specification is used for quoting, to avoid injections see template format section below.
+- **layergroup**: the layer list definition. This is the MapConfig explained in anonymous maps. See [MapConfig documentation](https://github.com/CartoDB/Windshaft/blob/master/doc/MapConfig-1.1.0.md) for more info.
 
 #### Template Format
 
-A templated `layergroup` allows using placeholders in the "cartocss" and "sql" elements of the "option" object in any "layer" of a layergroup configuration
+A templated `layergroup` allows the use of placeholders in the "cartocss" and "sql" elements of the "option" object in any "layer" of a `layergroup` configuration
 
-Valid placeholder names start with a letter and can only contain letters, numbers or underscores. They have to be written between `<%=` and `%>` strings in order to be replaced.
+Valid placeholder names start with a letter and can only contain letters, numbers, or underscores. They have to be written between the `<%=` and `%>` strings in order to be replaced.
 
 ##### Example
 
-{% highlight javascript %}
+```javascript
 <%= my_color %>
-{% endhighlight %}
+```
 
 The set of supported placeholders for a template will need to be explicitly defined with a specific type and default value for each.
 
@@ -361,24 +367,24 @@ The placeholder type will determine the kind of escaping for the associated valu
 - **number** can only contain numerical representation
 - **css_color** can only contain color names or hex-values
 
-Placeholder default values will be used whenever new values are not provided as options at the time of creation on the client. They can also be used to test the template by creating a default version with now options provided.
+Placeholder default values will be used whenever new values are not provided as options at the time of creation on the client. They can also be used to test the template by creating a default version with new options provided.
 
 When using templates, be very careful about your selections as they can give broad access to your data if they are defined losely.
 
 <div class="code-title code-request with-result">REQUEST</div>
-{% highlight html %}
+```html
 curl -X POST \
    -H 'Content-Type: application/json' \
    -d @template.json \
-   'https://docs.cartodb.com/api/v1/map/named?api_key=APIKEY'
-{% endhighlight %}
+   'https://documentation.cartodb.com/api/v1/map/named?api_key=APIKEY'
+```
 
 <div class="code-title">RESPONSE</div>
-{% highlight javascript %}
+```javascript
 {
-  "templateid":"name",
+  "template_id":"name",
 }
-{% endhighlight %}
+```
 
 ### Instantiate
 
@@ -387,19 +393,21 @@ Instantiating a map allows you to get the information needed to fetch tiles. Tha
 #### Definition
 
 <div class="code-title notitle code-request"></div>
-{% highlight html %}
+```html
 POST /api/v1/map/named/:template_name
-{% endhighlight %}
+```
 
 #### Param
 
-{% highlight javascript %}
+- **auth_token** optional, but required when `"method"` is set to `"token"`
+
+```javascript
 // params.json
 {
- color: "#ff0000",
- cartodb_id: 3
+ "color": "#ff0000",
+ "cartodb_id": 3
 }
-{% endhighlight %}
+```
 
 The fields you pass as `params.json` depend on the variables allowed by the named map. If there are variables missing it will raise an error (HTTP 400)
 
@@ -412,29 +420,29 @@ You can initialize a template map by passing all of the required parameters in a
 Valid credentials will be needed if required by the template.
 
 <div class="code-title code-request with-result">REQUEST</div>
-{% highlight bash %}
+```bash
 curl -X POST \
   -H 'Content-Type: application/json' \
   -d @params.json \
-  'https://docs.cartodb.com/api/v1/template/@template_name?auth_token=AUTH_TOKEN'
-{% endhighlight %}
+  'https://documentation.cartodb.com/api/v1/map/named/@template_name?auth_token=AUTH_TOKEN'
+```
 
 <div class="code-title">Response</div>
-{% highlight javascript %}
+```javascript
 {
   "layergroupid": "docs@fd2861af@c01a54877c62831bb51720263f91fb33:123456788",
   "last_updated": "2013-11-14T11:20:15.000Z"
 }
-{% endhighlight %}
+```
 
 <div class="code-title">Error</div>
-{% highlight javascript %}
+```javascript
 {
   "error": "Some error string here"
 }
-{% endhighlight %}
+```
 
-You can then use the `layergroupid` for fetching tiles and grids as you would normally (see anonymous map section).  However, you'll need to show the `auth_token`, if required by the template.
+You can then use the `layergroupid` for fetching tiles and grids as you would normally (see anonymous map section).  However you'll need to show the `auth_token`, if required by the template.
 
 ### Using JSONP
 
@@ -443,62 +451,62 @@ There is also a special endpoint to be able to initialize a map using JSONP (for
 #### Definition
 
 <div class="code-title notitle code-request"></div>
-{% highlight bash %}
+```bash
 GET /api/v1/map/named/:template_name/jsonp
-{% endhighlight %}
+```
 
 #### Params
 
-- **auth_token** *(optional)* If the named map needs auth
+- **auth_token** optional, but required when `"method"` is set to `"token"`
 - **config** Encoded JSON with the params for creating named maps (the variables defined in the template)
 - **lmza** This attribute contains the same as config but LZMA compressed. It cannot be used at the same time than `config`.
 - **callback:** JSON callback name
 
 <div class="code-title code-request with-result">REQUEST</div>
-{% highlight bash %}
-curl 'https://docs.cartodb.com/api/v1/map/named/:template_name/jsonp?auth_token=AUTH_TOKEN&callback=function_name&config=template_params_json'
-{% endhighlight %}
+```bash
+curl 'https://documentation.cartodb.com/api/v1/map/named/:template_name/jsonp?auth_token=AUTH_TOKEN&callback=callback&config=template_params_json'
+```
 
 <div class="code-title">RESPONSE</div>
-{% highlight javascript %}
-callback(
+```javascript
+callback({
   "layergroupid":"c01a54877c62831bb51720263f91fb33:0",
   "last_updated":"1970-01-01T00:00:00.000Z"
   "cdn_url": {
     "http": "http://cdb.com",
     "https": "https://cdb.com"
   }
-)
-{% endhighlight %}
+})
+```
 
 This takes the `callback` function (required), `auth_token` if the template needs auth, and `config` which is the variable for the template (in cases where it has variables). 
 
-{% highlight javascript %}
+```javascript
 url += "config=" + encodeURIComponent(
 JSON.stringify({ color: 'red' });
-{% endhighlight %}
+```
 
 The response is in this format:
 
-{% highlight javascript %}
-jQuery17205720721024554223_1390996319118({
+```javascript
+callback({
   layergroupid: "dev@744bd0ed9b047f953fae673d56a47b4d:1390844463021.1401",
   last_updated: "2014-01-27T17:41:03.021Z"
 })
-{% endhighlight %}
+```
 
 ### Update
 
 #### Definition
 
 <div class="code-title notitle code-request"></div>
-{% highlight bash %}
-PUT /api/v1/map/:map_name
-{% endhighlight %}
+```bash
+PUT /api/v1/map/named/:template_name
+```
 
 #### Params
 
-Same params used to create a map.
+- **api_key** is required
 
 #### Response
 
@@ -511,58 +519,60 @@ Updating a named map removes all the named map instances so they need to be init
 #### Example
 
 <div class="code-title code-request with-result">REQUEST</div>
-{% highlight bash %}
+```bash
 curl -X PUT \
   -H 'Content-Type: application/json' \
   -d @template.json \
-  'https://docs.cartodb.com/tiles/template/:template_name?api_key=APIKEY'
-{% endhighlight %}
+  'https://documentation.cartodb.com/api/v1/map/named/:template_name?api_key=APIKEY'
+```
 
 <div class="code-title">RESPONSE</div>
-{% highlight javascript %}
+```javascript
 {
   "template_id": "@template_name"
 }
-{% endhighlight %}
+```
 
 If any template has the same name, it will be updated.
 
 If a template with the same name does NOT exist, a 400 HTTP response is generated with an error in this format:
 
-{% highlight javascript %}
+```javascript
 {
   "error": "error string here"
 }
-{% endhighlight %}
-
-Updating a template map will also remove all signatures from previously initialized maps. 
+```
 
 ### Delete 
 
-Delete the specified template map from the server and disables any previously initialized versions of the map.
+Delete the specified template map from the server and it disables any previously initialized versions of the map.
 
 #### Definition
 
 <div class="code-title notitle code-request"></div>
-{% highlight bash %}
-DELETE /template/:template_name
-{% endhighlight %}
+```bash
+DELETE /api/v1/map/named/:template_name
+```
+
+#### Params
+
+- **api_key** is required
 
 #### Example
 
 <div class="code-title code-request">REQUEST</div>
-{% highlight bash %}
-curl -X DELETE 'https://docs.cartodb.com/tiles/template/@template_name?auth_token=AUTH_TOKEN'
-{% endhighlight %}
+```bash
+curl -X DELETE 'https://documentation.cartodb.com/api/v1/map/named/:template_name?api_key=APIKEY'
+```
 
 <div class="code-title">RESPONSE</div>
-{% highlight javascript %}
+```javascript
 {
   "error": "Some error string here"
 }
-{% endhighlight %}
+```
 
-On success, a 204 (No Content) response would be issued. Otherwise a 4xx response with with an error will be returned:
+On success, a 204 (No Content) response will be issued. Otherwise a 4xx response with an error will be returned.
 
 ### Listing Available Templates
 
@@ -571,9 +581,9 @@ This allows you to get a list of all available templates.
 #### Definition
 
 <div class="code-title notitle code-request"></div>
-{% highlight bash %}
+```bash
 GET /api/v1/map/named/
-{% endhighlight %}
+```
 
 #### Params
 
@@ -582,34 +592,34 @@ GET /api/v1/map/named/
 #### Example
 
 <div class="code-title code-request with-result">REQUEST</div>
-{% highlight bash %}
-curl -X GET 'https://docs.cartodb.com/tiles/template?api_key=APIKEY'
-{% endhighlight %}
+```bash
+curl -X GET 'https://documentation.cartodb.com/api/v1/map/named?api_key=APIKEY'
+```
 
 <div class="code-title with-result">RESPONSE</div>
-{% highlight javascript %}
+```javascript
 {
    "template_ids": ["@template_name1","@template_name2"]
 }
-{% endhighlight %}
+```
 
 <div class="code-title">ERROR</div>
-{% highlight javascript %}
+```javascript
 {
    "error": "Some error string here"
 }
-{% endhighlight %}
+```
 
 ### Getting a Specific Template
 
-This gets the definition of a template
+This gets the definition of a template.
 
 #### Definition
 
 <div class="code-title notitle code-request"></div>
-{% highlight bash %}
+```bash
 GET /api/v1/map/named/:template_name
-{% endhighlight %}
+```
 
 #### Params
 
@@ -618,20 +628,234 @@ GET /api/v1/map/named/:template_name
 #### Example
 
 <div class="code-title code-request with-result">REQUEST</div>
-{% highlight bash %}
-curl -X GET 'https://docs.cartodb.com/tiles/template/@template_name?auth_token=AUTH_TOKEN'
-{% endhighlight %}
+```bash
+curl -X GET 'https://documentation.cartodb.com/api/v1/map/named/:template_name?api_key=APIKEY'
+```
 
 <div class="code-title with-result">RESPONSE</div>
-{% highlight javascript %}
+```javascript
 {
   "template": {...} // see template.json above
 }
-{% endhighlight %}
+```
 
 <div class="code-title">ERROR</div>
-{% highlight javascript %}
+```javascript
 {
   "error": "Some error string here"
 }
-{% endhighlight %}
+```
+
+### Use with CartoDB.js
+Named maps can be used with CartoDB.js by specifying a named map in a layer source as follows. Named maps are treated almost the same as other layer source types in most other ways.
+
+```js
+var layerSource = {
+  user_name: '{your_user_name}', 
+  type: 'namedmap', 
+  named_map: { 
+    name: '{template_name}', 
+	layers: [{ 
+	  layer_name: "layer1", 
+      interactivity: "column1, column2, ..." 
+	}] 
+  } 
+}
+
+cartodb.createLayer('map_dom_id',layerSource)
+  .addTo(map_object);
+
+```
+
+[CartoDB.js](http://docs.cartodb.com/cartodb-platform/cartodb-js.html) has methods for accessing your named maps.
+
+1. [layer.setParams()](http://docs.cartodb.com/cartodb-platform/cartodb-js.html#layersetparamskey-value) allows you to change the template variables (in the placeholders object) via JavaScript 
+2. [layer.setAuthToken()](http://docs.cartodb.com/cartodb-platform/cartodb-js.html#layersetauthtokenauthtoken) allows you to set the auth tokens to create the layer
+
+##Static Maps API
+
+The Static Maps API can be initiated using both named and anonymous maps using the 'layergroupid' token. The API can be used to create static images of parts of maps and thumbnails for use in web design, graphic design, print, field work, and many other applications that require standard image formats.
+
+### Maps API endpoints
+
+Begin by instantiating either a named or anonymous map using the `layergroupid token` as demonstrated in the Maps API documentation above. The `layergroupsid token` calls to the map and allows for parameters in the definition to generate static images. 
+
+##### Definition
+
+<div class="code-title notitle code-request"></div>
+```bash
+GET /api/v1/map/static/center/:token/:z/:lat/:lng/:width/:height.:format
+```
+
+##### Params
+
+* **:token**: the layergroupid token from the map instantiation
+* **:z**: the zoom level of the map
+* **:lat**: the latitude for the center of the map
+* **:lng**: the longitude for the center of the map
+* **:width**: the width in pixels for the output image
+* **:height**: the height in pixels for the output image
+* **:format**: the format for the image, supported types: `png`, `jpg`
+  * **jpg** will have a default quality of 85.
+
+#### Bounding Box
+
+##### Definition
+
+<div class="code-title notitle code-request"></div>
+```bash
+GET /api/v1/map/static/bbox/:token/:bbox/:width/:height.:format`
+```
+
+##### Params
+
+* **:token**: the layergroupid token from the map instantiation
+* **:bbox**: the bounding box in WGS 84 (EPSG:4326), comma separated values for:
+    - LowerCorner longitude, in decimal degrees (aka most western)
+    - LowerCorner latitude, in decimal degrees (aka most southern)
+    - UpperCorner longitude, in decimal degrees (aka most eastern)
+    - UpperCorner latitude, in decimal degrees (aka most northern)
+* **:width**: the width in pixels for the output image
+* **:height**: the height in pixels for the output image
+* **:format**: the format for the image, supported types: `png`, `jpg`
+  * **jpg** will have a default quality of 85.
+
+Note: you can see this endpoint as:
+
+```bash
+GET /api/v1/map/static/bbox/:token/:west,:south,:east,:north/:width/:height.:format`
+```
+
+####Layers
+
+The Static Maps API allows for multiple layers of incorporation into the `MapConfig` to allow for maximum versatility in creating a static map. The examples below were used to generate the static image example in the next section, and appear in the specific order designated.
+
+**Basemaps**
+
+```javascript
+    {
+      "type": "http",
+      "options": {
+        "urlTemplate": "http://{s}.basemaps.cartocdn.com/dark_nolabels/{z}/{x}/{y}.png",
+        "subdomains": [
+          "a",
+          "b",
+          "c"
+        ]
+      }
+    },
+```
+
+By manipulating the `"urlTemplate"` custom basemaps can be used in generating static images. Supported map types for the Static Maps API are:
+
+          'http://{s}.basemaps.cartocdn.com/dark_all/{z}/{x}/{y}.png',
+          'http://{s}.basemaps.cartocdn.com/dark_nolabels/{z}/{x}/{y}.png',
+          'http://{s}.basemaps.cartocdn.com/light_all/{z}/{x}/{y}.png',
+          'http://{s}.basemaps.cartocdn.com/light_nolabels/{z}/{x}/{y}.png',
+
+**Mapnik**
+
+```javascript
+    {
+      "type": "mapnik",
+      "options": {
+        "sql": "select null::geometry the_geom_webmercator",
+        "cartocss": "#layer {\n\tpolygon-fill: #FF3300;\n\tpolygon-opacity: 0;\n\tline-color: #333;\n\tline-width: 0;\n\tline-opacity: 0;\n}",
+        "cartocss_version": "2.2.0"
+      }
+    },
+```
+
+**CartoDB**
+
+```javascript
+    {
+      "type": "cartodb",
+      "options": {
+        "sql": "select * from park",
+        "cartocss": "/** simple visualization */\n\n#park{\n  polygon-fill: #229A00;\n  polygon-opacity: 0.7;\n  line-color: #FFF;\n  line-width: 0;\n  line-opacity: 1;\n}",
+        "cartocss_version": "2.1.1"
+      }
+    },
+```
+
+Additoinally, static images from Torque maps and other map layers can be used together to generate highly customizable and versatile static maps.
+
+
+####Caching
+
+It is important to note that generated images are cached from the live data referenced with the `layergroupid token` on the specified CartoDB account. This means that if the data changes, the cached image will also change. When linking dynamically, it is important to take into consideration the state of the data and longevity of the static image to avoid broken images or changes in how the image is displayed. To obtain a static snapshot of the map as it is today and preserve the image long-term regardless of changes in data, the image must be saved and stored locally.
+
+####Limits
+
+* While images can encompass an entirety of a map, the default limit for pixel range is 8192 x 8192.
+* Resolution limitations for jpegs are at default a quality of 85. Limitations for quality are restricted to a maximum of XXX dpi.
+* Timeout limits for generating static maps are the same across the CartoDB Editor and Platform. It is important to ensure timely processing of queries.
+
+
+### Examples
+
+After instantiating a map from a CartoDB account:
+
+<div class="code-title code-request with-result">REQUEST</div>
+```bash
+ GET /api/v1/map/static/center/4b615ff367e498e770e7d05e99181873:1420231989550.8699/14/40.71502926732618/-73.96039009094238/600/400.png
+```
+
+####Response
+<div clas="wrap"><p class="wrap-border"><img src="https://raw.githubusercontent.com/namessanti/Pictures/master/static_api.png" alt="static-api"/></p>,</div>
+
+####MapConfig
+
+For this map, the multiple layers, order, and stylings are defined by the MapConfig.
+
+```javascript
+{
+  "version": "1.3.0-alpha",
+  "layers": [
+    {
+      "type": "http",
+      "options": {
+        "urlTemplate": "http://{s}.basemaps.cartocdn.com/dark_nolabels/{z}/{x}/{y}.png",
+        "subdomains": [
+          "a",
+          "b",
+          "c"
+        ]
+      }
+    },
+    {
+      "type": "mapnik",
+      "options": {
+        "sql": "select null::geometry the_geom_webmercator",
+        "cartocss": "#layer {\n\tpolygon-fill: #FF3300;\n\tpolygon-opacity: 0;\n\tline-color: #333;\n\tline-width: 0;\n\tline-opacity: 0;\n}",
+        "cartocss_version": "2.2.0"
+      }
+    },
+    {
+      "type": "cartodb",
+      "options": {
+        "sql": "select * from park",
+        "cartocss": "/** simple visualization */\n\n#park{\n  polygon-fill: #229A00;\n  polygon-opacity: 0.7;\n  line-color: #FFF;\n  line-width: 0;\n  line-opacity: 1;\n}",
+        "cartocss_version": "2.1.1"
+      }
+    },
+    {
+      "type": "cartodb",
+      "options": {
+        "sql": "select * from residential_zoning_2009",
+        "cartocss": "/** simple visualization */\n\n#residential_zoning_2009{\n  polygon-fill: #c7eae5;\n  polygon-opacity: 1;\n  line-color: #FFF;\n  line-width: 0.2;\n  line-opacity: 0.5;\n}",
+        "cartocss_version": "2.1.1"
+      }
+    },
+    {
+      "type": "cartodb",
+      "options": {
+        "sql": "select * from nycha_developments_july2011",
+        "cartocss": "/** simple visualization */\n\n#nycha_developments_july2011{\n  polygon-fill: #ef3b2c;\n  polygon-opacity: 0.7;\n  line-color: #FFF;\n  line-width: 0;\n  line-opacity: 1;\n}",
+        "cartocss_version": "2.1.1"
+      }
+    }
+  ]
+}
+```

docs/MapConfig-NamedMaps-extension.md

@@ -0,0 +1,56 @@
+# 1. Purpose
+
+This specification describes an extension for
+[MapConfig 1.3.0](https://github.com/CartoDB/Windshaft/blob/master/doc/MapConfig-1.3.0.md) version.
+
+
+# 2. Changes over specification
+
+This extension introduces a new layer type so it's possible to use a named map by its name as a layer.
+
+## 2.1 Named layers definition
+
+```javascript
+{
+    // REQUIRED
+    // string, `named` is the only supported value
+    type: "named",
+
+    // REQUIRED
+    // object, set `named` map layers configuration
+    options: {
+
+        // REQUIRED
+        // string, the name for the named map to use
+        name: "world_borders",
+
+        // OPTIONAL
+        // object, the replacement values for the named map's template placeholders
+        // See https://github.com/CartoDB/Windshaft-cartodb/blob/master/docs/Map-API.md#instantiate-1 for more details
+        config: {
+            "color": "#000"
+        },
+
+        // OPTIONAL
+        // string array, the authorized tokens in case the named map has auth method set to `token`
+        // See https://github.com/CartoDB/Windshaft-cartodb/blob/master/docs/Map-API.md#named-maps-1 for more details
+        auth_tokens: [
+            "token1",
+            "token2"
+        ]
+    }
+}
+```
+
+## 2.2 Limitations
+
+1. A Named Map will not allow to have `named` type layers inside their templates layergroup's layers definition.
+2. A `named` layer does not allow Named Maps form other accounts, it's only possible to use Named Maps from the very
+same user account.
+
+
+# History
+
+## 1.0.0
+
+ - Initial version

docs/MultiLayer-API.md

@@ -25,4 +25,4 @@ Windshaft-CartoDB adds the following attributes in the response object
 
 ## Stats tag
 
-Windshaft-CartoDB adds support for a ``stat_tag`` element in the multilayer configuration to help [stats](Redis-stats-format) gathering.
+Windshaft-CartoDB adds support for a ``stat_tag`` element in the multilayer configuration to help [stats](https://github.com/CartoDB/Windshaft-cartodb/wiki/Redis-stats-format) gathering.

docs/Template-maps.md

@@ -5,13 +5,6 @@ layergroup configurations (instantiation).
 Template maps are persistent, can only be created and deleted by the
 CartoDB user showing a valid API_KEY.
 
-Instantiating a signed template map would result in a [signed
-map](https://github.com/CartoDB/Windshaft-cartodb/wiki/Signed-maps)
-instance that would be signed with the same signature as the template.
-
-Deleting a signed template results in deletion of all signatures created
-as a result of instantiation.
-
 
 # Template format
 
@@ -43,9 +36,6 @@ Placeholder default value will be used when not provided at
 instantiation time and could be used to test validity of the
 template by creating a default instance.
 
-Additionally you'll be able to embed an authorization
-certificate that would be used to sign any instance of the template.
-
 ```js
 // template.json 
 {
@@ -56,7 +46,6 @@ certificate that would be used to sign any instance of the template.
   name: "template_name", 
   // embedded authorization certificate
   auth: {
-   // See https://github.com/CartoDB/Windshaft-cartodb/wiki/Signed-maps
    method: "token", // or "open" (the default if no "method" is given)
    // only (required and non empty) for "token" method
    valid_tokens: ["auth_token1","auth_token2"]
@@ -92,7 +81,8 @@ certificate that would be used to sign any instance of the template.
 
 # Creating a templated map
 
-You can create a signed template map with a single call (for simplicity).
+You can create a template map with a single call (for simplicity).
+
 You'd use a POST sending JSON data:
 
 ```sh
@@ -121,10 +111,7 @@ Errors are in this form:
 
 # Updating an existing template
 
-Update of a template map implies removal all signatures from previous
-map instances.
-
-You can update a signed template map with a PUT:
+You can update a template map with a PUT:
 
 ```sh
 curl -X PUT \
@@ -243,13 +230,7 @@ or, on error:
 
 You can then use the ``layergroupid`` for fetching tiles and grids as you do
 normally ( see https://github.com/CartoDB/Windshaft/wiki/Multilayer-API).
-But you'll still have to show the ``auth_token``, if required by the template
-(see https://github.com/CartoDB/Windshaft-cartodb/wiki/Signed-maps)
-
-Instances of a signed template map will be signed with the same signature
-certificate associated with the template. Such certificate would contain
-a reference to the template identifier, so that it can be revoked every
-time the template is updated or deleted. 
+But you'll still have to show the ``auth_token``, if required by the template.
 
 ### using JSONP
 There is also a special endpoint to be able to instanciate using JSONP (for old browsers)
@@ -275,8 +256,6 @@ last_updated: "2014-01-27T17:41:03.021Z"
 ```
 # Deleting a template map
 
-Deletion of a template map will imply removal all instance signatures
-
 You can delete a templated map with a DELETE to ``/template/:template_name``:
 
 ```sh

docs/metrics.md

@@ -26,12 +26,11 @@ Again, each inner timer may have several inner timers.
 - **affectedTables**: time to check what are the affected tables for adding the cache channel, see *addCacheChannel*
 - **authorize**: time to authorize a request, see *authorizedByAPIKey*, *authorizedByCert*, *authorizedBySigner*
 - **authorizedByAPIKey**: time to authorize using an API KEY
-- **authorizedByCert**: time to authorize a request by a cert, see [signed map](https://github.com/CartoDB/Windshaft-cartodb/wiki/Signed-maps)
-- **authorizedBySigner**: time to authorize a request for a [signed map](https://github.com/CartoDB/Windshaft-cartodb/wiki/Signed-maps)
+- **authorizedByCert**: time to authorize a template instantiation
+- **authorizedBySigner**: time to authorize a request with auth_token
 - **findLastUpdated**: time to retrieve the last update time for a list of tables, see *affectedTables*
-- **fingerPrint**: time to create a fingerprint for a signed map
 - **generateCacheChannel**: time to generate the headers for the cache channel based on the request, see *addCacheChannel*
-- **getSignerMapKey**: time to retrieve from redis the authorized key for a signed map
+- **getSignerMapKey**: time to retrieve from redis the authorized user for a template map
 - **getTablePrivacy**: time to retrieve from redis the privacy of a table
 - **getTemplate**: time to retrieve from redis the template for a map
 - **getUserMapKey**: time to retrieve from redis the user key for a map
@@ -41,6 +40,5 @@ Again, each inner timer may have several inner timers.
 - **setDBAuth**: time to retrieve from redis and set db user and db password from a user
 - **setDBConn**: time to retrieve from redis and set db host and db name from a user
 - **setDBParams**: time to prepare all db params to be able to connect/query a database, see *setDBAuth* and *setDBConn*
-- **signMap**: time to sign in redis layergroup for a map, see signed maps
 - **tablePrivacy_getUserDBName**: time to retrieve from redis the database for a user
 

lib/cartodb/api/query_tables_api.js

@@ -1,7 +1,10 @@
-var sqlApi = require('../sql/sql_api'),
-    PSQL   = require('cartodb-psql');
+var sqlApi = require('../sql/sql_api');
+var PSQL = require('cartodb-psql');
+var Step = require('step');
 
-function QueryTablesApi() {
+function QueryTablesApi(pgConnection, metadataBackend) {
+    this.pgConnection = pgConnection;
+    this.metadataBackend = metadataBackend;
 }
 
 var affectedTableRegexCache = {
@@ -13,33 +16,12 @@ var affectedTableRegexCache = {
 
 module.exports = QueryTablesApi;
 
-QueryTablesApi.prototype.getLastUpdatedTime = function (username, api_key, tableNames, callback) {
-    var sql = 'SELECT EXTRACT(EPOCH FROM max(updated_at)) as max FROM CDB_TableMetadata m WHERE m.tabname = any (ARRAY['+
-        tableNames.map(function(t) { return "'" + t + "'::regclass"; }).join(',') +
-        '])';
 
-    // call sql api
-    sqlApi.query(username, api_key, sql, function(err, rows){
-        if (err){
-            var msg = err.message ? err.message : err;
-            callback(new Error('could not find last updated timestamp: ' + msg));
-            return;
-        }
-        // when the table has not updated_at means it hasn't been changed so a default last_updated is set
-        var last_updated = 0;
-        if(rows.length !== 0) {
-            last_updated = rows[0].max || 0;
-        }
-
-        callback(null, last_updated*1000);
-    });
-};
-
-QueryTablesApi.prototype.getAffectedTablesInQuery = function (username, options, sql, callback) {
+QueryTablesApi.prototype.getAffectedTablesInQuery = function (username, sql, callback) {
 
     var query = 'SELECT CDB_QueryTables($windshaft$' + prepareSql(sql) + '$windshaft$)';
 
-    runQuery(username, options, query, handleAffectedTablesInQueryRows, callback);
+    this.runQuery(username, query, handleAffectedTablesInQueryRows, callback);
 };
 
 function handleAffectedTablesInQueryRows(err, rows, callback) {
@@ -54,7 +36,7 @@ function handleAffectedTablesInQueryRows(err, rows, callback) {
     callback(null, tableNames);
 }
 
-QueryTablesApi.prototype.getAffectedTablesAndLastUpdatedTime = function (username, options, sql, callback) {
+QueryTablesApi.prototype.getAffectedTablesAndLastUpdatedTime = function (username, sql, callback) {
 
     var query = [
         'WITH querytables AS (',
@@ -65,7 +47,7 @@ QueryTablesApi.prototype.getAffectedTablesAndLastUpdatedTime = function (usernam
         'WHERE m.tabname = any ((SELECT tablenames from querytables)::regclass[])'
     ].join(' ');
 
-    runQuery(username, options, query, handleAffectedTablesAndLastUpdatedTimeRows, callback);
+    this.runQuery(username, query, handleAffectedTablesAndLastUpdatedTimeRows, callback);
 };
 
 function handleAffectedTablesAndLastUpdatedTimeRows(err, rows, callback) {
@@ -89,20 +71,60 @@ function handleAffectedTablesAndLastUpdatedTimeRows(err, rows, callback) {
 }
 
 
-function runQuery(username, options, query, queryHandler, callback) {
+QueryTablesApi.prototype.runQuery = function(username, query, queryHandler, callback) {
+    var self = this;
+
     if (shouldQueryPostgresDirectly()) {
-        var psql = new PSQL(options);
-        psql.query(query, function(err, resultSet) {
-            resultSet = resultSet || {};
-            var rows = resultSet.rows || [];
-            queryHandler(err, rows, callback);
-        });
+
+        var params = {};
+
+        Step(
+            function setAuth() {
+                self.pgConnection.setDBAuth(username, params, this);
+            },
+            function setConn(err) {
+                if (err) {
+                    throw err;
+                }
+                self.pgConnection.setDBConn(username, params, this);
+            },
+            function executeQuery(err) {
+                if (err) {
+                    throw err;
+                }
+                var psql = new PSQL({
+                    user: params.dbuser,
+                    pass: params.dbpass,
+                    host: params.dbhost,
+                    port: params.dbport,
+                    dbname: params.dbname
+                });
+                psql.query(query, function(err, resultSet) {
+                    resultSet = resultSet || {};
+                    var rows = resultSet.rows || [];
+                    queryHandler(err, rows, callback);
+                });
+            }
+        );
+
     } else {
-        sqlApi.query(username, options.api_key, query, function(err, rows) {
-            queryHandler(err, rows, callback);
-        });
+
+        Step(
+            function getApiKey() {
+                self.metadataBackend.getUserMapKey(username, this);
+            },
+            function executeQuery(err, apiKey) {
+                if (err) {
+                    throw err;
+                }
+                sqlApi.query(username, apiKey, query, function(err, rows) {
+                    queryHandler(err, rows, callback);
+                });
+            }
+        );
+
     }
-}
+};
 
 
 function prepareSql(sql) {

lib/cartodb/backends/pg_connection.js

@@ -0,0 +1,96 @@
+var Step = require('step');
+var _ = require('underscore');
+
+function PgConnection(metadataBackend) {
+    this.metadataBackend = metadataBackend;
+}
+
+module.exports = PgConnection;
+
+
+// Set db authentication parameters to those of the given username
+//
+// @param username the cartodb username, mapped to a database username
+//                 via CartodbRedis metadata records
+//
+// @param params the parameters to set auth options into
+//               added params are: "dbuser" and "dbpassword"
+//
+// @param callback function(err)
+//
+PgConnection.prototype.setDBAuth = function(username, params, callback) {
+    var self = this;
+
+    var user_params = {};
+    var auth_user = global.environment.postgres_auth_user;
+    var auth_pass = global.environment.postgres_auth_pass;
+    Step(
+        function getId() {
+            self.metadataBackend.getUserId(username, this);
+        },
+        function(err, user_id) {
+            if (err) throw err;
+            user_params['user_id'] = user_id;
+            var dbuser = _.template(auth_user, user_params);
+            _.extend(params, {dbuser:dbuser});
+
+            // skip looking up user_password if postgres_auth_pass
+            // doesn't contain the "user_password" label
+            if (!auth_pass || ! auth_pass.match(/\buser_password\b/) ) return null;
+
+            self.metadataBackend.getUserDBPass(username, this);
+        },
+        function(err, user_password) {
+            if (err) throw err;
+            user_params['user_password'] = user_password;
+            if ( auth_pass ) {
+                var dbpass = _.template(auth_pass, user_params);
+                _.extend(params, {dbpassword:dbpass});
+            }
+            return true;
+        },
+        function finish(err) {
+            callback(err);
+        }
+    );
+};
+
+// Set db connection parameters to those for the given username
+//
+// @param dbowner cartodb username of database owner,
+//                mapped to a database username
+//                via CartodbRedis metadata records
+//
+// @param params the parameters to set connection options into
+//               added params are: "dbname", "dbhost"
+//
+// @param callback function(err)
+//
+PgConnection.prototype.setDBConn = function(dbowner, params, callback) {
+    var self = this;
+    // Add default database connection parameters
+    // if none given
+    _.defaults(params, {
+        dbuser: global.environment.postgres.user,
+        dbpassword: global.environment.postgres.password,
+        dbhost: global.environment.postgres.host,
+        dbport: global.environment.postgres.port
+    });
+    Step(
+        function getConnectionParams() {
+            self.metadataBackend.getUserDBConnectionParams(dbowner, this);
+        },
+        function extendParams(err, dbParams){
+            if (err) throw err;
+            // we don't want null values or overwrite a non public user
+            if (params.dbuser != 'publicuser' || !dbParams.dbuser) {
+                delete dbParams.dbuser;
+            }
+            if ( dbParams ) _.extend(params, dbParams);
+            return null;
+        },
+        function finish(err) {
+            callback(err);
+        }
+    );
+};

lib/cartodb/cache/backend/varnish_http.js

@@ -0,0 +1,32 @@
+var request = require('request');
+
+function VarnishHttpCacheBackend(host, port) {
+    this.host = host;
+    this.port = port;
+}
+
+module.exports = VarnishHttpCacheBackend;
+
+/**
+ * @param cacheObject should respond to `key() -> String` method
+ * @param {Function} callback
+ */
+VarnishHttpCacheBackend.prototype.invalidate = function(cacheObject, callback) {
+    request(
+        {
+            method: 'PURGE',
+            url: 'http://' + this.host + ':' + this.port + '/key',
+            headers: {
+                'Invalidation-Match': '\\b' + cacheObject.key() + '\\b'
+            }
+        },
+        function(err, response) {
+            if (err || response.statusCode !== 204) {
+                return callback(new Error('Unable to invalidate Varnish object'));
+            }
+            return callback(null);
+        }
+    );
+};
+
+module.exports = VarnishHttpCacheBackend;

lib/cartodb/cache/model/named_maps_entry.js

@@ -0,0 +1,18 @@
+var crypto = require('crypto');
+
+function NamedMaps(owner, name) {
+    this.namespace = 'n';
+    this.owner = owner;
+    this.name = name;
+}
+
+module.exports = NamedMaps;
+
+
+NamedMaps.prototype.key = function() {
+    return this.namespace + ':' + shortHashKey(this.owner + ':' + this.name);
+};
+
+function shortHashKey(target) {
+    return crypto.createHash('sha256').update(target).digest('base64').substring(0,6);
+}

lib/cartodb/cache/surrogate_keys_cache.js

@@ -0,0 +1,26 @@
+/**
+ * @param cacheBackend should respond to `invalidate(cacheObject, callback)` method
+ * @constructor
+ */
+function SurrogateKeysCache(cacheBackend) {
+    this.cacheBackend = cacheBackend;
+}
+
+module.exports = SurrogateKeysCache;
+
+
+/**
+ * @param response should respond to `header(key, value)` method
+ * @param cacheObject should respond to `key() -> String` method
+ */
+SurrogateKeysCache.prototype.tag = function(response, cacheObject) {
+    response.header('Surrogate-Key', cacheObject.key());
+};
+
+/**
+ * @param cacheObject should respond to `key() -> String` method
+ * @param {Function} callback
+ */
+SurrogateKeysCache.prototype.invalidate = function(cacheObject, callback) {
+    this.cacheBackend.invalidate(cacheObject, callback);
+};

lib/cartodb/cartodb_windshaft.js

@@ -1,22 +1,14 @@
-
-var _ = require('underscore')
-    , Step       = require('step')
-    , Windshaft = require('windshaft')
-    , redisPool = require('redis-mpool')(_.extend(global.environment.redis, {name: 'windshaft:cartodb'}))
-    // TODO: instanciate cartoData with redisPool
-    , cartoData  = require('cartodb-redis')(global.environment.redis)
-    , SignedMaps = require('./signed_maps.js')
-    , TemplateMaps = require('./template_maps.js')
-    , Cache = require('./cache_validator')
-    , os = require('os')
-;
+var _ = require('underscore');
+var Step = require('step');
+var Windshaft = require('windshaft');
+var Cache = require('./cache_validator');
+var os = require('os');
+var HealthCheck = require('./monitoring/health_check');
 
 if ( ! process.env['PGAPPNAME'] )
   process.env['PGAPPNAME']='cartodb_tiler';
 
 var CartodbWindshaft = function(serverOptions) {
-   var debug = global.environment.debug;
-
     // Perform keyword substitution in statsd
     // See https://github.com/CartoDB/Windshaft-cartodb/issues/153
     if ( global.environment.statsd ) {
@@ -26,6 +18,13 @@ var CartodbWindshaft = function(serverOptions) {
       }
     }
 
+    var redisPool = serverOptions.redis.pool
+        || require('redis-mpool')(_.extend(global.environment.redis, {name: 'windshaft:cartodb'}));
+
+    var cartoData = require('cartodb-redis')({pool: redisPool});
+
+    var templateMaps = serverOptions.templateMaps;
+
     if(serverOptions.cache_enabled) {
         console.log("cache invalidation enabled, varnish on ", serverOptions.varnish_host, ' ', serverOptions.varnish_port);
         Cache.init(serverOptions.varnish_host, serverOptions.varnish_port, serverOptions.varnish_secret);
@@ -41,7 +40,7 @@ var CartodbWindshaft = function(serverOptions) {
           err = new Error("map state cannot be changed by unauthenticated request!");
         }
         callback(err, req);
-    }
+    };
 
     // This is for Templated maps
     //
@@ -49,11 +48,25 @@ var CartodbWindshaft = function(serverOptions) {
     //
     var template_baseurl = global.environment.base_url_templated || '(?:/maps/named|/tiles/template)';
 
-    serverOptions.signedMaps = new SignedMaps(redisPool);
-    var templateMapsOpts = {
-      max_user_templates: global.environment.maxUserTemplates
+    var SurrogateKeysCache = require('./cache/surrogate_keys_cache'),
+        NamedMapsCacheEntry = require('./cache/model/named_maps_entry'),
+        VarnishHttpCacheBackend = require('./cache/backend/varnish_http'),
+        varnishHttpCacheBackend = new VarnishHttpCacheBackend(serverOptions.varnish_host, serverOptions.varnish_http_port),
+        surrogateKeysCache = new SurrogateKeysCache(varnishHttpCacheBackend);
+
+    if (serverOptions.varnish_purge_enabled) {
+        function invalidateNamedMap(owner, templateName) {
+            surrogateKeysCache.invalidate(new NamedMapsCacheEntry(owner, templateName), function(err) {
+                if (err) {
+                    console.warn('Cache: surrogate key invalidation failed');
+                }
+            });
+        }
+
+        ['update', 'delete'].forEach(function(eventType) {
+            templateMaps.on(eventType, invalidateNamedMap);
+        });
     }
-    var templateMaps = new TemplateMaps(redisPool, serverOptions.signedMaps, templateMapsOpts);
 
     // boot
     var ws = new Windshaft.Server(serverOptions);
@@ -64,7 +77,7 @@ var CartodbWindshaft = function(serverOptions) {
       var version = wsversion();
       version.windshaft_cartodb = require('../../package.json').version;
       return version;
-    }
+    };
 
     var ws_sendResponse = ws.sendResponse;
     // GET routes for which we don't want to request any caching.
@@ -133,6 +146,27 @@ var CartodbWindshaft = function(serverOptions) {
       ws_sendError.apply(this, arguments);
     };
 
+    /*******************************************************************************************************************
+     * Routing
+     ******************************************************************************************************************/
+
+    var TemplateMapsController = require('./controllers/template_maps'),
+        templateMapsController = new TemplateMapsController(
+            ws,
+            serverOptions,
+            templateMaps,
+            cartoData,
+            template_baseurl,
+            surrogateKeysCache,
+            NamedMapsCacheEntry,
+            serverOptions.pgConnection
+        );
+    templateMapsController.register(ws);
+
+    /*******************************************************************************************************************
+     * END Routing
+     ******************************************************************************************************************/
+
     /**
      * Helper to allow access to the layer to be used in the maps infowindow popup.
      */
@@ -176,495 +210,39 @@ var CartodbWindshaft = function(serverOptions) {
 
     /**
      * Helper API to allow per table tile cache (and sql cache) to be invalidated remotely.
-     * TODO: Move?
+     * Keep endpoint for backwards compatibility
      */
     ws.del(serverOptions.base_url + '/flush_cache', function(req, res){
-        if ( req.profiler && req.profiler.statsd_client ) {
-          req.profiler.start('windshaft-cartodb.flush_cache');
-        }
         ws.doCORS(res);
-        Step(
-            function flushCache(){
-                serverOptions.flushCache(req, serverOptions.cache_enabled ? Cache : null, this);
-            },
-            function sendResponse(err, data){
-                if (err){
-                    ws.sendError(res, {error: err.message}, 500, 'DELETE CACHE', err);
-                    //ws.sendResponse(res, [500]);
-                } else {
-                    ws.sendResponse(res, [{status: 'ok'}, 200]);
+        ws.sendResponse(res, [{status: 'ok'}, 200]);
+    });
+
+    var healthCheck = new HealthCheck(cartoData, Windshaft.tilelive);
+    ws.get('/health', function(req, res) {
+        var healthConfig = global.environment.health || {};
+
+        if (!!healthConfig.enabled) {
+            var startTime = Date.now();
+            healthCheck.check(healthConfig, function(err, result) {
+                var ok = !err;
+                var response = {
+                    enabled: true,
+                    ok: ok,
+                    elapsed: Date.now() - startTime,
+                    result: result
+                };
+                if (err) {
+                    response.err = err.message;
                 }
-            }
-        );
-    });
+                res.send(response, ok ? 200 : 503);
 
-    // ---- Template maps interface starts @{
-
-    ws.userByReq = function(req) {
-        return serverOptions.userByReq(req);
-    }
-
-    // Add a template
-    ws.post(template_baseurl, function(req, res) {
-      ws.doCORS(res);
-      var that = this;
-      var response = {};
-      var cdbuser = ws.userByReq(req);
-      Step(
-        function checkPerms(){
-            serverOptions.authorizedByAPIKey(req, this);
-        },
-        function addTemplate(err, authenticated) {
-          if ( err ) throw err;
-          if (authenticated !== 1) {
-            err = new Error("Only authenticated user can create templated maps");
-            err.http_status = 403;
-            throw err;
-          }
-          var next = this;
-          if ( ! req.headers['content-type'] || req.headers['content-type'].split(';')[0] != 'application/json' )
-            throw new Error('template POST data must be of type application/json');
-          var cfg = req.body;
-          templateMaps.addTemplate(cdbuser, cfg, this);
-        },
-        function prepareResponse(err, tpl_id){
-          if ( err ) throw err;
-          // NOTE: might omit "cdbuser" if == dbowner ...
-          return { template_id: cdbuser + '@' + tpl_id };
-        },
-        function finish(err, response){
-            if ( req.profiler ) {
-              res.header('X-Tiler-Profiler', req.profiler.toJSONString());
-            }
-            if (err){
-                response = { error: ''+err };
-                var statusCode = 400;
-                if ( ! _.isUndefined(err.http_status) ) {
-                  statusCode = err.http_status;
-                }
-                ws.sendError(res, response, statusCode, 'POST TEMPLATE', err);
-            } else {
-              ws.sendResponse(res, [response, 200]);
-            }
-        }
-      );
-    });
-
-    // Update a template
-    ws.put(template_baseurl + '/:template_id', function(req, res) {
-      ws.doCORS(res);
-      var that = this;
-      var response = {};
-      var cdbuser = ws.userByReq(req);
-      var template;
-      var tpl_id;
-      Step(
-        function checkPerms(){
-            serverOptions.authorizedByAPIKey(req, this);
-        },
-        function updateTemplate(err, authenticated) {
-          if ( err ) throw err;
-          if (authenticated !== 1) {
-            err = new Error("Only authenticated user can list templated maps");
-            err.http_status = 403;
-            throw err;
-          }
-          if ( ! req.headers['content-type'] || req.headers['content-type'].split(';')[0] != 'application/json' )
-            throw new Error('template PUT data must be of type application/json');
-          template = req.body;
-          tpl_id = req.params.template_id.split('@');
-          if ( tpl_id.length > 1 ) {
-            if ( tpl_id[0] != cdbuser ) {
-              err = new Error("Invalid template id '"
-                + req.params.template_id + "' for user '" + cdbuser + "'");
-              err.http_status = 404;
-              throw err;
-            }
-            tpl_id = tpl_id[1];
-          }
-          templateMaps.updTemplate(cdbuser, tpl_id, template, this);
-        },
-        function prepareResponse(err){
-          if ( err ) throw err;
-          return { template_id: cdbuser + '@' + tpl_id };
-        },
-        function finish(err, response){
-            if ( req.profiler ) {
-              res.header('X-Tiler-Profiler', req.profiler.toJSONString());
-            }
-            if (err){
-                var statusCode = 400;
-                response = { error: ''+err };
-                if ( ! _.isUndefined(err.http_status) ) {
-                  statusCode = err.http_status;
-                }
-                ws.sendError(res, response, statusCode, 'PUT TEMPLATE', err);
-            } else {
-              ws.sendResponse(res, [response, 200]);
-            }
-        }
-      );
-    });
-
-    // Get a specific template
-    ws.get(template_baseurl + '/:template_id', function(req, res) {
-      if ( req.profiler && req.profiler.statsd_client ) {
-        req.profiler.start('windshaft-cartodb.get_template');
-      }
-      ws.doCORS(res);
-      var that = this;
-      var response = {};
-      var cdbuser = ws.userByReq(req);
-      var template;
-      var tpl_id;
-      Step(
-        function checkPerms(){
-            serverOptions.authorizedByAPIKey(req, this);
-        },
-        function updateTemplate(err, authenticated) {
-          if ( err ) throw err;
-          if (authenticated !== 1) {
-            err = new Error("Only authenticated users can get template maps");
-            err.http_status = 403;
-            throw err;
-          }
-          tpl_id = req.params.template_id.split('@');
-          if ( tpl_id.length > 1 ) {
-            if ( tpl_id[0] != cdbuser ) {
-              var err = new Error("Cannot get template id '"
-                + req.params.template_id + "' for user '" + cdbuser + "'");
-              err.http_status = 404;
-              throw err;
-            }
-            tpl_id = tpl_id[1];
-          }
-          templateMaps.getTemplate(cdbuser, tpl_id, this);
-        },
-        function prepareResponse(err, tpl_val){
-          if ( err ) throw err;
-          if ( ! tpl_val ) {
-            err = new Error("Cannot find template '" + tpl_id + "' of user '" + cdbuser + "'");
-            err.http_status = 404;
-            throw err;
-          }
-          // auth_id was added by ourselves,
-          // so we remove it before returning to the user
-          delete tpl_val.auth_id;
-          return { template: tpl_val };
-        },
-        function finish(err, response){
-            if (err){
-                var statusCode = 400;
-                response = { error: ''+err };
-                if ( ! _.isUndefined(err.http_status) ) {
-                  statusCode = err.http_status;
-                }
-                ws.sendError(res, response, statusCode, 'GET TEMPLATE', err);
-            } else {
-              ws.sendResponse(res, [response, 200]);
-            }
-        }
-      );
-    });
-
-    // Delete a specific template
-    ws.del(template_baseurl + '/:template_id', function(req, res) {
-      if ( req.profiler && req.profiler.statsd_client ) {
-        req.profiler.start('windshaft-cartodb.delete_template');
-      }
-      ws.doCORS(res);
-      var that = this;
-      var response = {};
-      var cdbuser = ws.userByReq(req);
-      var template;
-      var tpl_id;
-      Step(
-        function checkPerms(){
-            serverOptions.authorizedByAPIKey(req, this);
-        },
-        function updateTemplate(err, authenticated) {
-          if ( err ) throw err;
-          if (authenticated !== 1) {
-            err = new Error("Only authenticated users can delete template maps");
-            err.http_status = 403;
-            throw err;
-          }
-          tpl_id = req.params.template_id.split('@');
-          if ( tpl_id.length > 1 ) {
-            if ( tpl_id[0] != cdbuser ) {
-              var err = new Error("Cannot find template id '"
-                + req.params.template_id + "' for user '" + cdbuser + "'");
-              err.http_status = 404;
-              throw err;
-            }
-            tpl_id = tpl_id[1];
-          }
-          templateMaps.delTemplate(cdbuser, tpl_id, this);
-        },
-        function prepareResponse(err, tpl_val){
-          if ( err ) throw err;
-          return { status: 'ok' };
-        },
-        function finish(err, response){
-            if (err){
-                var statusCode = 400;
-                response = { error: ''+err };
-                if ( ! _.isUndefined(err.http_status) ) {
-                  statusCode = err.http_status;
-                }
-                ws.sendError(res, response, statusCode, 'DELETE TEMPLATE', err);
-            } else {
-              ws.sendResponse(res, ['', 204]);
-            }
-        }
-      );
-    });
-
-    // Get a list of owned templates 
-    ws.get(template_baseurl, function(req, res) {
-      if ( req.profiler && req.profiler.statsd_client ) {
-        req.profiler.start('windshaft-cartodb.get_template_list');
-      }
-      ws.doCORS(res);
-      var that = this;
-      var response = {};
-      var cdbuser = ws.userByReq(req);
-      Step(
-        function checkPerms(){
-            serverOptions.authorizedByAPIKey(req, this);
-        },
-        function listTemplates(err, authenticated) {
-          if ( err ) throw err;
-          if (authenticated !== 1) {
-            err = new Error("Only authenticated user can list templated maps");
-            err.http_status = 403;
-            throw err;
-          }
-          templateMaps.listTemplates(cdbuser, this);
-        },
-        function prepareResponse(err, tpl_ids){
-          if ( err ) throw err;
-          // NOTE: might omit "cbduser" if == dbowner ...
-          var ids = _.map(tpl_ids, function(id) { return cdbuser + '@' + id; })
-          return { template_ids: ids };
-        },
-        function finish(err, response){
-            var statusCode = 200;
-            if (err){
-                response = { error: ''+err };
-                if ( ! _.isUndefined(err.http_status) ) {
-                  statusCode = err.http_status;
-                }
-                ws.sendError(res, response, statusCode, 'GET TEMPLATE LIST', err);
-            } else {
-              ws.sendResponse(res, [response, statusCode]);
-            }
-        }
-      );
-    });
-
-    ws.setDBParams = function(cdbuser, params, callback) {
-      Step(
-        function setAuth() {
-          serverOptions.setDBAuth(cdbuser, params, this);
-        },
-        function setConn(err) {
-          if ( err ) throw err;
-          serverOptions.setDBConn(cdbuser, params, this);
-        },
-        function finish(err) {
-          callback(err);
-        }
-      );
-    };
-
-    ws.options(template_baseurl + '/:template_id', function(req, res) {
-      ws.doCORS(res, "Content-Type");
-      return next();
-    });
-
-    // Instantiate a template
-    function instanciateTemplate(req, res, template_params, callback) {
-      ws.doCORS(res);
-      var that = this;
-      var response = {};
-      var template;
-      var signedMaps = serverOptions.signedMaps;
-      var layergroup;
-      var layergroupid;
-      var fakereq; // used for call to createLayergroup
-      var cdbuser = ws.userByReq(req);
-      // Format of template_id: [<template_owner>]@<template_id>
-      var tpl_id = req.params.template_id.split('@');
-      if ( tpl_id.length > 1 ) {
-        if ( tpl_id[0] && tpl_id[0] != cdbuser ) {
-          var err = new Error('Cannot instanciate map of user "'
-                              + tpl_id[0] + '" on database of user "'
-                              + cdbuser + '"')
-          err.http_status = 403;
-          callback(err);
-          return;
-        }
-        tpl_id = tpl_id[1];
-      }
-      var auth_token = req.query.auth_token;
-      Step(
-        function getTemplate(){
-          templateMaps.getTemplate(cdbuser, tpl_id, this);
-        },
-        function checkAuthorized(err, data) {
-          if ( req.profiler ) req.profiler.done('getTemplate');
-          if ( err ) throw err;
-          if ( ! data ) {
-            err = new Error("Template '" + tpl_id + "' of user '" + cdbuser + "' not found");
-            err.http_status = 404;
-            throw err;
-          }
-          template = data;
-          var cert = templateMaps.getTemplateCertificate(template);
-          var authorized = false;
-          try {
-            // authorizedByCert will throw if unauthorized
-            authorized = signedMaps.authorizedByCert(cert, auth_token);
-          } catch (err) {
-            // we catch to add http_status
-            err.http_status = 403;
-            throw err;
-          }
-          if ( ! authorized ) {
-            err = new Error('Unauthorized template instanciation');
-            err.http_status = 403;
-            throw err;
-          }
-          /*if ( (! req.headers['content-type'] || req.headers['content-type'].split(';')[0] != 'application/json') && req.query.callback === undefined) {
-            throw new Error('template POST data must be of type application/json, it is instead ');
-          }*/
-          //var template_params = req.body;
-          if ( req.profiler ) req.profiler.done('authorizedByCert');
-          return templateMaps.instance(template, template_params);
-        },
-        function prepareParams(err, instance){
-          if ( req.profiler ) req.profiler.done('TemplateMaps_instance');
-          if ( err ) throw err;
-          layergroup = instance;
-          fakereq = { query: {}, params: {}, headers: _.clone(req.headers),
-            method: req.method,
-            res: res,
-            profiler: req.profiler
-          };
-          ws.setDBParams(cdbuser, fakereq.params, this);
-        },
-        function setApiKey(err){
-          if ( req.profiler ) req.profiler.done('setDBParams');
-          if ( err ) throw err;
-          cartoData.getUserMapKey(cdbuser, this);
-        },
-        function createLayergroup(err, val) {
-          if ( req.profiler ) req.profiler.done('getUserMapKey');
-          if ( err ) throw err;
-          fakereq.params.api_key = val;
-          ws.createLayergroup(layergroup, fakereq, this);
-        },
-        function signLayergroup(err, resp) {
-          // NOTE: createLayergroup uses profiler.start()/end() internally
-          //if ( req.profiler ) req.profiler.done('createLayergroup');
-          if ( err ) throw err;
-          response = resp;
-          var signer = cdbuser;
-          var map_id = response.layergroupid.split(':')[0]; // dropping last_updated 
-          var crt_id = template.auth_id; // check ?
-          if ( ! crt_id ) {
-            var errmsg = "Template '" + tpl_id + "' of user '" + cdbuser + "' has no signature";
-            // Is this really illegal ?
-            // Maybe we could just return an unsigned layergroupid
-            // in this case...
-            err = new Error(errmsg);
-            err.http_status = 403; // Forbidden, we refuse to respond to this
-            throw err;
-          }
-          signedMaps.signMap(signer, map_id, crt_id, this);
-        },
-        function prepareResponse(err) {
-          if ( req.profiler ) req.profiler.done('signMap');
-          if ( err ) throw err;
-          //console.log("Response from createLayergroup: "); console.dir(response);
-          // Add the signature part to the token!
-          var tplhash = templateMaps.fingerPrint(template).substring(0,8);
-          if ( req.profiler ) req.profiler.done('fingerPrint');
-          response.layergroupid = cdbuser + '@' + tplhash + '@' + response.layergroupid;
-          return response;
-        },
-        callback
-      );
-    }
-
-    function finish_instanciation(err, response, res, req) {
-        if ( req.profiler ) {
-          res.header('X-Tiler-Profiler', req.profiler.toJSONString());
-        }
-        if (err) {
-            var statusCode = 400;
-            response = { error: ''+err };
-            if ( ! _.isUndefined(err.http_status) ) {
-              statusCode = err.http_status;
-            }
-            if(debug) {
-              response.stack = err.stack;
-            }
-            ws.sendError(res, response, statusCode, 'POST INSTANCE TEMPLATE', err);
+            });
         } else {
-          ws.sendResponse(res, [response, 200]);
+            res.send({enabled: false, ok: true}, 200);
         }
-    }
-
-    ws.post(template_baseurl + '/:template_id', function(req, res) {
-      if ( req.profiler && req.profiler.statsd_client) {
-        req.profiler.start('windshaft-cartodb.instance_template_post');
-      }
-      Step(
-        function() {
-          if ( ! req.headers['content-type'] || req.headers['content-type'].split(';')[0] != 'application/json') {
-            throw new Error('template POST data must be of type application/json, it is instead ');
-          }
-          instanciateTemplate(req, res, req.body, this);
-        }, function(err, response) {
-          finish_instanciation(err, response, res, req);
-        }
-      );
     });
 
-    /**
-     * jsonp endpoint, allows to instanciate a template with a json call.
-     * callback query argument is mandartoy
-     */
-    ws.get(template_baseurl + '/:template_id/jsonp', function(req, res) {
-      if ( req.profiler && req.profiler.statsd_client) {
-        req.profiler.start('windshaft-cartodb.instance_template_get');
-      }
-      Step(
-        function() {
-          if ( req.query.callback === undefined || req.query.callback.length === 0) {
-            throw new Error('callback parameter should be present and be a function name');
-          }
-          var config = {};
-          if(req.query.config) {
-            try {
-              config = JSON.parse(req.query.config);
-            } catch(e) {
-              throw new Error('badformed config parameter, should be a valid JSON');
-            }
-          }
-          instanciateTemplate(req, res, config, this);
-        }, function(err, response) {
-          finish_instanciation(err, response, res, req);
-        }
-      );
-    });
-
-
-    // ---- Template maps interface ends @}
-
     return ws;
-}
+};
 
 module.exports = CartodbWindshaft;

lib/cartodb/controllers/template_maps.js

@@ -0,0 +1,479 @@
+var Step = require('step');
+var _ = require('underscore');
+
+function TemplateMapsController(app, serverOptions, templateMaps, metadataBackend, templateBaseUrl, surrogateKeysCache,
+                                NamedMapsCacheEntry, pgConnection) {
+    this.app = app;
+    this.serverOptions = serverOptions;
+    this.templateMaps = templateMaps;
+    this.metadataBackend = metadataBackend;
+    this.templateBaseUrl = templateBaseUrl;
+    this.surrogateKeysCache = surrogateKeysCache;
+    this.NamedMapsCacheEntry = NamedMapsCacheEntry;
+    this.pgConnection = pgConnection;
+}
+
+module.exports = TemplateMapsController;
+
+
+TemplateMapsController.prototype.register = function(app) {
+    app.get(this.templateBaseUrl + '/:template_id/jsonp', this.jsonp.bind(this));
+    app.post(this.templateBaseUrl, this.create.bind(this));
+    app.put(this.templateBaseUrl + '/:template_id', this.update.bind(this));
+    app.get(this.templateBaseUrl + '/:template_id', this.retrieve.bind(this));
+    app.del(this.templateBaseUrl + '/:template_id', this.destroy.bind(this));
+    app.get(this.templateBaseUrl, this.list.bind(this));
+    app.options(this.templateBaseUrl + '/:template_id', this.options.bind(this));
+    app.post(this.templateBaseUrl + '/:template_id', this.instantiate.bind(this));
+};
+
+// Add a template
+TemplateMapsController.prototype.create = function(req, res) {
+    var self = this;
+
+    this.app.doCORS(res);
+
+    var cdbuser = self.serverOptions.userByReq(req);
+
+    Step(
+        function checkPerms(){
+            self.serverOptions.authorizedByAPIKey(req, this);
+        },
+        function addTemplate(err, authenticated) {
+            if ( err ) throw err;
+            if (authenticated !== 1) {
+                err = new Error("Only authenticated user can create templated maps");
+                err.http_status = 403;
+                throw err;
+            }
+            if ( ! req.headers['content-type'] || req.headers['content-type'].split(';')[0] != 'application/json' )
+                throw new Error('template POST data must be of type application/json');
+            var cfg = req.body;
+            self.templateMaps.addTemplate(cdbuser, cfg, this);
+        },
+        function prepareResponse(err, tpl_id){
+            if ( err ) throw err;
+            // NOTE: might omit "cdbuser" if == dbowner ...
+            return { template_id: cdbuser + '@' + tpl_id };
+        },
+        function finish(err, response){
+            if ( req.profiler ) {
+                res.header('X-Tiler-Profiler', req.profiler.toJSONString());
+            }
+            if (err){
+                response = { error: ''+err };
+                var statusCode = 400;
+                if ( ! _.isUndefined(err.http_status) ) {
+                    statusCode = err.http_status;
+                }
+                self.app.sendError(res, response, statusCode, 'POST TEMPLATE', err);
+            } else {
+                self.app.sendResponse(res, [response, 200]);
+            }
+        }
+    );
+};
+
+// Update a template
+TemplateMapsController.prototype.update = function(req, res) {
+    var self = this;
+
+    this.app.doCORS(res);
+
+    var cdbuser = this.serverOptions.userByReq(req);
+    var template;
+    var tpl_id;
+    Step(
+        function checkPerms(){
+            self.serverOptions.authorizedByAPIKey(req, this);
+        },
+        function updateTemplate(err, authenticated) {
+            if ( err ) throw err;
+            if (authenticated !== 1) {
+                err = new Error("Only authenticated user can list templated maps");
+                err.http_status = 403;
+                throw err;
+            }
+            if ( ! req.headers['content-type'] || req.headers['content-type'].split(';')[0] != 'application/json' )
+                throw new Error('template PUT data must be of type application/json');
+            template = req.body;
+            tpl_id = req.params.template_id.split('@');
+            if ( tpl_id.length > 1 ) {
+                if ( tpl_id[0] != cdbuser ) {
+                    err = new Error("Invalid template id '"
+                        + req.params.template_id + "' for user '" + cdbuser + "'");
+                    err.http_status = 404;
+                    throw err;
+                }
+                tpl_id = tpl_id[1];
+            }
+            self.templateMaps.updTemplate(cdbuser, tpl_id, template, this);
+        },
+        function prepareResponse(err){
+            if ( err ) throw err;
+            return { template_id: cdbuser + '@' + tpl_id };
+        },
+        function finish(err, response){
+            if ( req.profiler ) {
+                res.header('X-Tiler-Profiler', req.profiler.toJSONString());
+            }
+            if (err){
+                var statusCode = 400;
+                response = { error: ''+err };
+                if ( ! _.isUndefined(err.http_status) ) {
+                    statusCode = err.http_status;
+                }
+                self.app.sendError(res, response, statusCode, 'PUT TEMPLATE', err);
+            } else {
+                self.app.sendResponse(res, [response, 200]);
+            }
+        }
+    );
+};
+
+// Get a specific template
+TemplateMapsController.prototype.retrieve = function(req, res) {
+    var self = this;
+
+    if ( req.profiler && req.profiler.statsd_client ) {
+        req.profiler.start('windshaft-cartodb.get_template');
+    }
+
+    this.app.doCORS(res);
+
+    var cdbuser = this.serverOptions.userByReq(req);
+    var template;
+    var tpl_id;
+    Step(
+        function checkPerms(){
+            self.serverOptions.authorizedByAPIKey(req, this);
+        },
+        function updateTemplate(err, authenticated) {
+            if ( err ) throw err;
+            if (authenticated !== 1) {
+                err = new Error("Only authenticated users can get template maps");
+                err.http_status = 403;
+                throw err;
+            }
+            tpl_id = req.params.template_id.split('@');
+            if ( tpl_id.length > 1 ) {
+                if ( tpl_id[0] != cdbuser ) {
+                    var err = new Error("Cannot get template id '"
+                        + req.params.template_id + "' for user '" + cdbuser + "'");
+                    err.http_status = 404;
+                    throw err;
+                }
+                tpl_id = tpl_id[1];
+            }
+            self.templateMaps.getTemplate(cdbuser, tpl_id, this);
+        },
+        function prepareResponse(err, tpl_val){
+            if ( err ) throw err;
+            if ( ! tpl_val ) {
+                err = new Error("Cannot find template '" + tpl_id + "' of user '" + cdbuser + "'");
+                err.http_status = 404;
+                throw err;
+            }
+            // auth_id was added by ourselves,
+            // so we remove it before returning to the user
+            delete tpl_val.auth_id;
+            return { template: tpl_val };
+        },
+        function finish(err, response){
+            if (err){
+                var statusCode = 400;
+                response = { error: ''+err };
+                if ( ! _.isUndefined(err.http_status) ) {
+                    statusCode = err.http_status;
+                }
+                self.app.sendError(res, response, statusCode, 'GET TEMPLATE', err);
+            } else {
+                self.app.sendResponse(res, [response, 200]);
+            }
+        }
+    );
+};
+
+// Delete a specific template
+TemplateMapsController.prototype.destroy = function(req, res) {
+    var self = this;
+
+    if ( req.profiler && req.profiler.statsd_client ) {
+        req.profiler.start('windshaft-cartodb.delete_template');
+    }
+    this.app.doCORS(res);
+
+    var cdbuser = this.serverOptions.userByReq(req);
+    var template;
+    var tpl_id;
+    Step(
+        function checkPerms(){
+            self.serverOptions.authorizedByAPIKey(req, this);
+        },
+        function updateTemplate(err, authenticated) {
+            if ( err ) throw err;
+            if (authenticated !== 1) {
+                err = new Error("Only authenticated users can delete template maps");
+                err.http_status = 403;
+                throw err;
+            }
+            tpl_id = req.params.template_id.split('@');
+            if ( tpl_id.length > 1 ) {
+                if ( tpl_id[0] != cdbuser ) {
+                    var err = new Error("Cannot find template id '"
+                        + req.params.template_id + "' for user '" + cdbuser + "'");
+                    err.http_status = 404;
+                    throw err;
+                }
+                tpl_id = tpl_id[1];
+            }
+            self.templateMaps.delTemplate(cdbuser, tpl_id, this);
+        },
+        function prepareResponse(err, tpl_val){
+            if ( err ) throw err;
+            return { status: 'ok' };
+        },
+        function finish(err, response){
+            if (err){
+                var statusCode = 400;
+                response = { error: ''+err };
+                if ( ! _.isUndefined(err.http_status) ) {
+                    statusCode = err.http_status;
+                }
+                self.app.sendError(res, response, statusCode, 'DELETE TEMPLATE', err);
+            } else {
+                self.app.sendResponse(res, ['', 204]);
+            }
+        }
+    );
+};
+
+// Get a list of owned templates
+TemplateMapsController.prototype.list = function(req, res) {
+    var self = this;
+
+    if ( req.profiler && req.profiler.statsd_client ) {
+        req.profiler.start('windshaft-cartodb.get_template_list');
+    }
+    this.app.doCORS(res);
+
+    var cdbuser = this.serverOptions.userByReq(req);
+
+    Step(
+        function checkPerms(){
+            self.serverOptions.authorizedByAPIKey(req, this);
+        },
+        function listTemplates(err, authenticated) {
+            if ( err ) throw err;
+            if (authenticated !== 1) {
+                err = new Error("Only authenticated user can list templated maps");
+                err.http_status = 403;
+                throw err;
+            }
+            self.templateMaps.listTemplates(cdbuser, this);
+        },
+        function prepareResponse(err, tpl_ids){
+            if ( err ) throw err;
+            // NOTE: might omit "cbduser" if == dbowner ...
+            var ids = _.map(tpl_ids, function(id) { return cdbuser + '@' + id; });
+            return { template_ids: ids };
+        },
+        function finish(err, response){
+            var statusCode = 200;
+            if (err){
+                response = { error: ''+err };
+                if ( ! _.isUndefined(err.http_status) ) {
+                    statusCode = err.http_status;
+                }
+                self.app.sendError(res, response, statusCode, 'GET TEMPLATE LIST', err);
+            } else {
+                self.app.sendResponse(res, [response, statusCode]);
+            }
+        }
+    );
+};
+
+TemplateMapsController.prototype.instantiate = function(req, res) {
+    var self = this;
+
+    if ( req.profiler && req.profiler.statsd_client) {
+        req.profiler.start('windshaft-cartodb.instance_template_post');
+    }
+    Step(
+        function() {
+            if ( ! req.headers['content-type'] || req.headers['content-type'].split(';')[0] != 'application/json') {
+                throw new Error('template POST data must be of type application/json, it is instead ');
+            }
+            self.instantiateTemplate(req, res, req.body, this);
+        }, function(err, response) {
+            self.finish_instantiation(err, response, res, req);
+        }
+    );
+};
+
+TemplateMapsController.prototype.options = function(req, res) {
+    this.app.doCORS(res, "Content-Type");
+    return next();
+};
+
+/**
+ * jsonp endpoint, allows to instantiate a template with a json call.
+ * callback query argument is mandatory
+ */
+TemplateMapsController.prototype.jsonp = function(req, res) {
+    var self = this;
+
+    if ( req.profiler && req.profiler.statsd_client) {
+        req.profiler.start('windshaft-cartodb.instance_template_get');
+    }
+    Step(
+        function() {
+            if ( req.query.callback === undefined || req.query.callback.length === 0) {
+                throw new Error('callback parameter should be present and be a function name');
+            }
+            var config = {};
+            if(req.query.config) {
+                try {
+                    config = JSON.parse(req.query.config);
+                } catch(e) {
+                    throw new Error('badformed config parameter, should be a valid JSON');
+                }
+            }
+            self.instantiateTemplate(req, res, config, this);
+        }, function(err, response) {
+            self.finish_instantiation(err, response, res, req);
+        }
+    );
+};
+
+
+// Instantiate a template
+TemplateMapsController.prototype.instantiateTemplate = function(req, res, template_params, callback) {
+    var self = this;
+
+    this.app.doCORS(res);
+
+    var template;
+    var layergroup;
+    var fakereq; // used for call to createLayergroup
+    var cdbuser = self.serverOptions.userByReq(req);
+    // Format of template_id: [<template_owner>]@<template_id>
+    var tpl_id = req.params.template_id.split('@');
+    if ( tpl_id.length > 1 ) {
+        if ( tpl_id[0] && tpl_id[0] != cdbuser ) {
+            var err = new Error('Cannot instanciate map of user "'
+                + tpl_id[0] + '" on database of user "'
+                + cdbuser + '"');
+            err.http_status = 403;
+            callback(err);
+            return;
+        }
+        tpl_id = tpl_id[1];
+    }
+    var auth_token = req.query.auth_token;
+    Step(
+        function getTemplate(){
+            self.templateMaps.getTemplate(cdbuser, tpl_id, this);
+        },
+        function checkAuthorized(err, templateValue) {
+            if ( req.profiler ) req.profiler.done('getTemplate');
+            if ( err ) throw err;
+            if ( ! templateValue ) {
+                err = new Error("Template '" + tpl_id + "' of user '" + cdbuser + "' not found");
+                err.http_status = 404;
+                throw err;
+            }
+
+            template = templateValue;
+
+            var authorized = false;
+            try {
+                authorized = self.templateMaps.isAuthorized(template, auth_token);
+            } catch (err) {
+                // we catch to add http_status
+                err.http_status = 403;
+                throw err;
+            }
+            if ( ! authorized ) {
+                err = new Error('Unauthorized template instanciation');
+                err.http_status = 403;
+                throw err;
+            }
+
+            if (req.profiler) {
+                req.profiler.done('authorizedByCert');
+            }
+
+            return self.templateMaps.instance(template, template_params);
+        },
+        function prepareParams(err, instance){
+            if ( req.profiler ) req.profiler.done('TemplateMaps_instance');
+            if ( err ) throw err;
+            layergroup = instance;
+            fakereq = { query: {}, params: {}, headers: _.clone(req.headers),
+                method: req.method,
+                res: res,
+                profiler: req.profiler
+            };
+            self.setDBParams(cdbuser, fakereq.params, this);
+        },
+        function setApiKey(err){
+            if ( req.profiler ) req.profiler.done('setDBParams');
+            if ( err ) throw err;
+            self.metadataBackend.getUserMapKey(cdbuser, this);
+        },
+        function createLayergroup(err, val) {
+            if ( req.profiler ) req.profiler.done('getUserMapKey');
+            if ( err ) throw err;
+            fakereq.params.api_key = val;
+            self.app.createLayergroup(layergroup, fakereq, this);
+        },
+        function prepareResponse(err, layergroup) {
+            if ( err ) {
+                throw err;
+            }
+            var tplhash = self.templateMaps.fingerPrint(template).substring(0,8);
+            layergroup.layergroupid = cdbuser + '@' + tplhash + '@' + layergroup.layergroupid;
+
+            self.surrogateKeysCache.tag(res, new self.NamedMapsCacheEntry(cdbuser, template.name));
+
+            return layergroup;
+        },
+        callback
+    );
+};
+
+TemplateMapsController.prototype.finish_instantiation = function(err, response, res, req) {
+    if ( req.profiler ) {
+        res.header('X-Tiler-Profiler', req.profiler.toJSONString());
+    }
+    if (err) {
+        var statusCode = 400;
+        response = { error: ''+err };
+        if ( ! _.isUndefined(err.http_status) ) {
+            statusCode = err.http_status;
+        }
+        if(global.environment.debug) {
+            response.stack = err.stack;
+        }
+        this.app.sendError(res, response, statusCode, 'POST INSTANCE TEMPLATE', err);
+    } else {
+        this.app.sendResponse(res, [response, 200]);
+    }
+};
+
+TemplateMapsController.prototype.setDBParams = function(cdbuser, params, callback) {
+    var self = this;
+    Step(
+        function setAuth() {
+            self.pgConnection.setDBAuth(cdbuser, params, this);
+        },
+        function setConn(err) {
+            if ( err ) throw err;
+            self.pgConnection.setDBConn(cdbuser, params, this);
+        },
+        function finish(err) {
+            callback(err);
+        }
+    );
+};

lib/cartodb/models/mapconfig_named_layers_adapter.js

@@ -0,0 +1,120 @@
+var queue = require('queue-async');
+var _ = require('underscore');
+var Datasource = require('windshaft').Datasource;
+
+function MapConfigNamedLayersAdapter(templateMaps) {
+    this.templateMaps = templateMaps;
+}
+
+module.exports = MapConfigNamedLayersAdapter;
+
+MapConfigNamedLayersAdapter.prototype.getLayers = function(username, layers, dbMetadata, callback) {
+    var self = this;
+
+    var adaptLayersQueue = queue(layers.length);
+
+    function adaptLayer(layer, done) {
+        if (isNamedTypeLayer(layer)) {
+
+            if (!layer.options.name) {
+                return done(new Error('Missing Named Map `name` in layer options'));
+            }
+
+            var templateName = layer.options.name;
+            var templateConfigParams = layer.options.config || {};
+            var templateAuthTokens = layer.options.auth_tokens;
+
+            self.templateMaps.getTemplate(username, templateName, function(err,  template) {
+                if (err || !template) {
+                    return done(new Error("Template '" + templateName + "' of user '" + username + "' not found"));
+                }
+
+                if (self.templateMaps.isAuthorized(template, templateAuthTokens)) {
+                    var nestedNamedLayers = template.layergroup.layers.filter(function(layer) {
+                        return layer.type === 'named';
+                    });
+
+                    if (nestedNamedLayers.length > 0) {
+                        var nestedNamedMapsError = new Error('Nested named layers are not allowed');
+                        // nestedNamedMapsError.http_status = 400;
+                        return done(nestedNamedMapsError);
+                    }
+
+                    try {
+                        var templateLayergroupConfig = self.templateMaps.instance(template, templateConfigParams);
+                        return done(null, {
+                            datasource: true,
+                            layers: templateLayergroupConfig.layers
+                        });
+                    } catch (err) {
+                        return done(err);
+                    }
+                } else {
+                    var unauthorizedError = new Error("Unauthorized '" + templateName + "' template instantiation");
+                    unauthorizedError.http_status = 403;
+                    return done(unauthorizedError);
+                }
+            });
+
+        } else {
+            return done(null, {
+                datasource: false,
+                layers: [layer]
+            });
+        }
+    }
+
+    var datasourceBuilder = new Datasource.Builder();
+
+    function layersAdaptQueueFinish(err, layersResults) {
+        if (err) {
+            return callback(err);
+        }
+
+        if (!layersResults || layersResults.length === 0) {
+            return callback(new Error('Missing layers array from layergroup config'));
+        }
+
+        var layers = [],
+            currentLayerIndex = 0;
+
+        layersResults.forEach(function(layersResult) {
+
+            layersResult.layers.forEach(function(layer) {
+                layers.push(layer);
+                if (layersResult.datasource) {
+                    datasourceBuilder.withLayerDatasource(currentLayerIndex, {
+                        user: dbAuth.dbuser
+                    });
+                }
+                currentLayerIndex++;
+            });
+
+        });
+
+        return callback(null, layers, datasourceBuilder.build());
+    }
+
+
+    var dbAuth = {};
+
+    if (_.some(layers, isNamedTypeLayer)) {
+        // Lazy load dbAuth
+        dbMetadata.setDBAuth(username, dbAuth, function(err) {
+            if (err) {
+                return callback(err);
+            }
+            layers.forEach(function(layer) {
+                adaptLayersQueue.defer(adaptLayer, layer);
+            });
+            adaptLayersQueue.awaitAll(layersAdaptQueueFinish);
+        });
+    } else {
+        return callback(null, layers, datasourceBuilder.build());
+    }
+
+};
+
+function isNamedTypeLayer(layer) {
+    return layer.type === 'named';
+}

lib/cartodb/monitoring/health_check.js

@@ -0,0 +1,90 @@
+var _    = require('underscore'),
+    dot  = require('dot'),
+    fs   = require('fs'),
+    path = require('path'),
+    Step = require('step');
+
+function HealthCheck(metadataBackend, tilelive) {
+    this.metadataBackend = metadataBackend;
+    this.tilelive = tilelive;
+}
+
+module.exports = HealthCheck;
+
+
+var mapnikOptions = {
+    query: {
+        metatile: 1,
+        poolSize: 4,
+        bufferSize: 64
+    },
+    protocol: 'mapnik:',
+    slashes: true,
+    xml: null
+};
+
+var xmlTemplate = dot.template(fs.readFileSync(path.resolve(__dirname, 'map-config.xml'), 'utf-8'));
+
+HealthCheck.prototype.check = function(config, callback) {
+
+    var self = this,
+        startTime,
+        result = {
+            redis: {
+                ok: false
+            },
+            mapnik: {
+                ok: false
+            },
+            tile: {
+                ok: false
+            }
+        };
+    mapnikXmlParams = config;
+
+    Step(
+        function getDBParams() {
+            startTime = Date.now();
+            self.metadataBackend.getAllUserDBParams(config.username, this);
+        },
+        function loadMapnik(err, dbParams) {
+            if (err) {
+                throw err;
+            }
+            result.redis = {
+                ok: !err,
+                elapsed: Date.now() - startTime,
+                size: Object.keys(dbParams).length
+            };
+            mapnikOptions.xml = xmlTemplate(mapnikXmlParams);
+
+            startTime = Date.now();
+            self.tilelive.load(mapnikOptions, this);
+        },
+        function getTile(err, source) {
+            if (err) {
+                throw err;
+            }
+
+            result.mapnik = {
+                ok: !err,
+                elapsed: Date.now() - startTime
+            };
+
+            startTime = Date.now();
+            source.getTile(config.z, config.x, config.y, this);
+        },
+        function handleTile(err, tile) {
+            result.tile = {
+                ok: !err
+            };
+
+            if (tile) {
+                result.tile.elapsed = Date.now() - startTime;
+                result.tile.size = tile.length;
+            }
+
+            callback(err, result);
+        }
+    );
+};

lib/cartodb/monitoring/map-config.xml

@@ -0,0 +1,4 @@
+<Map
+    background-color="#c33"
+    srs="+proj=longlat +ellps=WGS84 +datum=WGS84 +no_defs">
+</Map>

lib/cartodb/server_options.js

@@ -1,11 +1,11 @@
-var   _          = require('underscore')
-    , Step       = require('step')
-    , cartoData  = require('cartodb-redis')(global.environment.redis)
-    , Cache      = require('./cache_validator')
-    , QueryTablesApi   = require('./api/query_tables_api')
-    , crypto     = require('crypto')
-    , LZMA       = require('lzma').LZMA;
-  ;
+var _ = require('underscore');
+var Step = require('step');
+var QueryTablesApi = require('./api/query_tables_api');
+var PgConnection = require('./backends/pg_connection');
+var crypto = require('crypto');
+var LZMA = require('lzma').LZMA;
+var TemplateMaps = require('./template_maps.js');
+var MapConfigNamedLayersAdapter = require('./models/mapconfig_named_layers_adapter');
 
 // This is for backward compatibility with 1.3.3
 if ( _.isUndefined(global.environment.sqlapi.domain) ) {
@@ -16,16 +16,38 @@ if ( _.isUndefined(global.environment.sqlapi.domain) ) {
   }
 }
 
-module.exports = function(){
+// Whitelist query parameters and attach format
+var REQUEST_QUERY_PARAMS_WHITELIST = [
+    'sql',
+    'geom_type',
+    'cache_buster',
+    'cache_policy',
+    'callback',
+    'interactivity',
+    'map_key',
+    'api_key',
+    'auth_token',
+    'style',
+    'style_version',
+    'style_convert',
+    'config',
+    'scale_factor'
+];
 
-    var lzmaWorker = new LZMA();
+module.exports = function(redisPool) {
+    redisPool = redisPool
+        || require('redis-mpool')(_.extend(global.environment.redis, {name: 'windshaft:server_options'}));
 
-    var queryTablesApi = new QueryTablesApi();
+    var cartoData = require('cartodb-redis')({ pool: redisPool }),
+        lzmaWorker = new LZMA(),
+        pgConnection = new PgConnection(cartoData),
+        queryTablesApi = new QueryTablesApi(pgConnection, cartoData);
 
     var rendererConfig = _.defaults(global.environment.renderer || {}, {
-      cache_ttl: 60000, // milliseconds
-      metatile: 4,
-      bufferSize: 64
+        cache_ttl: 60000, // milliseconds
+        metatile: 4,
+        bufferSize: 64,
+        statsInterval: 60000
     });
 
     var me = {
@@ -61,13 +83,19 @@ module.exports = function(){
         },
         statsd: global.environment.statsd,
         renderCache: {
-          ttl: rendererConfig.cache_ttl
+            ttl: rendererConfig.cache_ttl,
+            statsInterval: rendererConfig.statsInterval
+        },
+        renderer: {
+            http: rendererConfig.http
         },
         redis: global.environment.redis,
         enable_cors: global.environment.enable_cors,
         varnish_host: global.environment.varnish.host,
         varnish_port: global.environment.varnish.port,
+        varnish_http_port: global.environment.varnish.http_port,
         varnish_secret: global.environment.varnish.secret,
+        varnish_purge_enabled: global.environment.varnish.purge_enabled,
         cache_enabled: global.environment.cache_enabled,
         log_format: global.environment.log_format,
         useProfiler: global.environment.useProfiler
@@ -77,6 +105,19 @@ module.exports = function(){
     // See http://github.com/CartoDB/Windshaft-cartodb/issues/161
     me.redis.unwatchOnRelease = false;
 
+    // Re-use redisPool
+    me.redis.pool = redisPool;
+
+    // Re-use pgConnection
+    me.pgConnection = pgConnection;
+
+    var templateMaps = new TemplateMaps(redisPool, {
+        max_user_templates: global.environment.maxUserTemplates
+    });
+    me.templateMaps = templateMaps;
+
+    var mapConfigNamedLayersAdapter = new MapConfigNamedLayersAdapter(templateMaps);
+
 /* This whole block is about generating X-Cache-Channel { */
 
     // TODO: review lifetime of elements of this cache
@@ -167,38 +208,8 @@ module.exports = function(){
             }
             return [req.params.table];
           }
-          var user, key;
-          var next = this;
-          Step (
-            function findUserKey() {
-              if ( req.params.hasOwnProperty('_authorizedBySigner') ) {
-                user = req.params._authorizedBySigner;
-                cartoData.getUserMapKey(user, this);
-              } else {
-                user = that.userByReq(req);
-                key = req.params.map_key || req.params.api_key;
-                return null;
-              }
-            },
-            function getAffected(err, data) {
-              if ( err ) throw err;
-              if ( data ) {
-                if ( req.profiler ) req.profiler.done('getSignerMapKey');
-                key = data;
-              }
-              queryTablesApi.getAffectedTablesInQuery(user, {
-                  user: req.params.dbuser,
-                  pass: req.params.dbpass,
-                  host: req.params.dbhost,
-                  port: req.params.dbport,
-                  dbname: req.params.dbname,
-                  api_key: key
-              }, sql, this); // in addCacheChannel
-            },
-            function finish(err, data) {
-              next(err,data);
-            }
-          );
+
+          queryTablesApi.getAffectedTablesInQuery(that.userByReq(req), sql, this); // in addCacheChannel
         },
         function buildCacheChannel(err, tableNames) {
           if ( err ) throw err;
@@ -269,6 +280,17 @@ module.exports = function(){
         });
     };
 
+    me.beforeLayergroupCreate = function(req, requestMapConfig, callback) {
+        mapConfigNamedLayersAdapter.getLayers(this.userByReq(req), requestMapConfig.layers, pgConnection, function(err, layers, datasource) {
+            if (err) {
+                return callback(err);
+            }
+
+            requestMapConfig.layers = layers;
+            return callback(null, requestMapConfig, datasource)
+        });
+    };
+
     me.afterLayergroupCreate = function(req, mapconfig, response, callback) {
         var token = response.layergroupid;
 
@@ -304,28 +326,16 @@ module.exports = function(){
           done();
         });
 
-        var sql = [];
-        _.each(mapconfig.layers, function(lyr) {
-          sql.push(lyr.options.sql);
-        });
-        sql = sql.join(';');
+        var sql = mapconfig.layers.map(function(layer) {
+            return layer.options.sql;
+        }).join(';');
 
         var dbName = req.params.dbname;
-        var usr    = this.userByReq(req);
-        var key    = req.params.map_key || req.params.api_key;
-
         var cacheKey = dbName + ':' + token;
 
         Step(
             function getAffectedTablesAndLastUpdatedTime() {
-                queryTablesApi.getAffectedTablesAndLastUpdatedTime(usr, {
-                    user: req.params.dbuser,
-                    pass: req.params.dbpass,
-                    host: req.params.dbhost,
-                    port: req.params.dbport,
-                    dbname: req.params.dbname,
-                    api_key: key
-                }, sql, this);
+                queryTablesApi.getAffectedTablesAndLastUpdatedTime(username, sql, this);
             },
             function handleAffectedTablesAndLastUpdatedTime(err, result) {
                 if (req.profiler) req.profiler.done('queryTablesAndLastUpdated');
@@ -338,7 +348,7 @@ module.exports = function(){
                     if ( req.query && req.query.cache_policy == 'persist' ) {
                         res.header('Cache-Control', 'public,max-age=31536000'); // 1 year
                     } else {
-                        var ttl = global.environment.varnish.ttl || 86400;
+                        var ttl = global.environment.varnish.layergroupTtl || 86400;
                         res.header('Cache-Control', 'public,max-age='+ttl+',must-revalidate');
                     }
                     res.header('Last-Modified', (new Date()).toUTCString());
@@ -380,98 +390,8 @@ module.exports = function(){
       return mat[1];
     };
 
-    // Set db authentication parameters to those of the given username
-    //
-    // @param username the cartodb username, mapped to a database username
-    //                 via CartodbRedis metadata records
-    //
-    // @param params the parameters to set auth options into
-    //               added params are: "dbuser" and "dbpassword"
-    //
-    // @param callback function(err) 
-    //
-    me.setDBAuth = function(username, params, callback) {
-
-      var user_params = {};
-      var auth_user = global.environment.postgres_auth_user;
-      var auth_pass = global.environment.postgres_auth_pass;
-      Step(
-        function getId() {
-          cartoData.getUserId(username, this);
-        },
-        function(err, user_id) {
-          if (err) throw err;
-          user_params['user_id'] = user_id;
-          var dbuser = _.template(auth_user, user_params);
-          _.extend(params, {dbuser:dbuser});
-
-          // skip looking up user_password if postgres_auth_pass
-          // doesn't contain the "user_password" label 
-          if (!auth_pass || ! auth_pass.match(/\buser_password\b/) ) return null;
-
-          cartoData.getUserDBPass(username, this);
-        },
-        function(err, user_password) {
-          if (err) throw err;
-          user_params['user_password'] = user_password;
-          if ( auth_pass ) {
-            var dbpass = _.template(auth_pass, user_params);
-            _.extend(params, {dbpassword:dbpass});
-          }
-          return true;
-        },
-        function finish(err) {
-          callback(err); 
-        }
-      );
-    };
-
-    // Set db connection parameters to those for the given username
-    //
-    // @param dbowner cartodb username of database owner,
-    //                mapped to a database username
-    //                via CartodbRedis metadata records
-    //
-    // @param params the parameters to set connection options into
-    //               added params are: "dbname", "dbhost"
-    //
-    // @param callback function(err) 
-    //
-    me.setDBConn = function(dbowner, params, callback) {
-      // Add default database connection parameters
-      // if none given
-      _.defaults(params, {
-        dbuser: global.environment.postgres.user,
-        dbpassword: global.environment.postgres.password,
-        dbhost: global.environment.postgres.host,
-        dbport: global.environment.postgres.port
-      });
-      Step(
-        function getConnectionParams() {
-            cartoData.getUserDBConnectionParams(dbowner, this);
-        },
-        function extendParams(err, dbParams){
-            if (err) throw err;
-            // we don't want null values or overwrite a non public user
-            if (params.dbuser != 'publicuser' || !dbParams.dbuser) {
-                delete dbParams.dbuser;
-            }
-            if ( dbParams ) _.extend(params, dbParams);
-            return null;
-        },
-        function finish(err) {
-          callback(err);
-        }
-      );
-    };
-
-
     // Check if a request is authorized by a signer
     //
-    // Any existing signature for the given request will verified
-    // for authorization to this specific request (may require auth_token)
-    // See https://github.com/CartoDB/Windshaft-cartodb/wiki/Signed-maps
-    //
     // @param req express request object
     // @param callback function(err, signed_by) signed_by will be
     //                 null if the request is not signed by anyone
@@ -490,11 +410,20 @@ module.exports = function(){
       var auth_token = req.params.auth_token;
 
       //console.log("Checking authorization from signer " + signer + " for resource " + layergroup_id + " with auth_token " + auth_token);
+      var mapStore = req.app.mapStore;
+      if (!mapStore) {
+          throw new Error('Unable to retrieve map configuration token');
+      }
+
+      mapStore.load(layergroup_id, function(err, mapConfig) {
+        if (err) {
+          throw err;
+        }
+
+        var authorized = me.templateMaps.isAuthorized(mapConfig.obj().template, auth_token);
+        callback(null, authorized ? signer : null);
+      });
 
-      me.signedMaps.isAuthorized(signer, layergroup_id, auth_token,
-        function(err, authorized) {
-          callback(err, authorized ? signer : null);
-        });
     };
 
     // Check if a request is authorized by api_key
@@ -559,7 +488,7 @@ module.exports = function(){
                 _.extend(req.params, { _authorizedByApiKey: true });
 
                 // authorized by api key, login as the given username and stop
-                that.setDBAuth(user, req.params, function(err) {
+                pgConnection.setDBAuth(user, req.params, function(err) {
                   callback(err, true); // authorized (or error)
                 });
             },
@@ -594,7 +523,7 @@ module.exports = function(){
 
                 // Authorized by "signed_by" !
                 _.extend(req.params, { _authorizedBySigner: signed_by });
-                that.setDBAuth(signed_by, req.params, function(err) {
+                pgConnection.setDBAuth(signed_by, req.params, function(err) {
                   if (req.profiler) req.profiler.done('setDBAuth');
                   callback(err, true); // authorized (or error)
                 });
@@ -652,9 +581,7 @@ module.exports = function(){
           return;
         }
 
-        // Whitelist query parameters and attach format
-        var good_query = ['sql', 'geom_type', 'cache_buster', 'cache_policy', 'callback', 'interactivity', 'map_key', 'api_key', 'auth_token', 'style', 'style_version', 'style_convert', 'config' ];
-        var bad_query  = _.difference(_.keys(req.query), good_query);
+        var bad_query  = _.difference(_.keys(req.query), REQUEST_QUERY_PARAMS_WHITELIST);
 
         _.each(bad_query, function(key){ delete req.query[key]; });
         req.params =  _.extend({}, req.params); // shuffle things as request is a strange array/object
@@ -710,7 +637,7 @@ module.exports = function(){
             },
             function getDatabase(err){
                 if(err) throw err;
-                that.setDBConn(user, req.params, this);
+                pgConnection.setDBConn(user, req.params, this);
             },
             function getGeometryType(err){
                 if (req.profiler) req.profiler.done('setDBConn');
@@ -794,33 +721,5 @@ module.exports = function(){
         );
     };
 
-    /**
-     * Helper to clear out tile cache on request
-     * @param req
-     * @param callback
-     */
-    me.flushCache = function(req, Cache, callback){
-        var that = this;
-
-        Step(
-            function getParams(){
-                // this is mostly to compute req.params.dbname
-                that.req2params(req, this);
-            },
-            function flushInternalCache(err){
-                // TODO: implement this, see
-                // http://github.com/Vizzuality/Windshaft-cartodb/issues/73
-                return true;
-            },
-            function flushVarnishCache(err){
-                if (err) { callback(err); return; }
-                if(Cache) {
-                  Cache.invalidate_db(req.params.dbname, req.params.table);
-                }
-                callback(null, true);
-            }
-        );
-    };
-
     return me;
 };

lib/cartodb/signed_maps.js

@@ -1,397 +0,0 @@
-var crypto    = require('crypto');
-var Step      = require('step');
-var _         = require('underscore');
-
-var debug = global.environment ? global.environment.debug : undefined;
-
-// Class handling map signatures and user certificates
-//
-// See https://github.com/CartoDB/Windshaft-cartodb/wiki/Signed-maps
-//
-// @param redis_pool an instance of a "redis-mpool"
-//        See https://github.com/CartoDB/node-redis-mpool
-//        Needs version 0.x.x of the API.
-//
-function SignedMaps(redis_pool) {
-  this.redis_pool = redis_pool;
-
-  // Database containing signatures
-  // TODO: allow configuring ?
-  // NOTE: currently it is the same as
-  //       the one containing layergroups
-  this.db_signatures = 0;
-
-  //
-  // Map signatures in redis are reference to signature certificates
-  // We have the following datastores:
-  //
-  //  1. User certificates: set of per-user authorization certificates
-  //  2. Map signatures: set of per-map certificate references 
-  //  3. Certificate applications: set of per-certificate signed maps
-
-  // User certificates (HASH:crt_id->crt_val)
-  this.key_map_crt = "map_crt|<%= signer %>";
-
-  // Map signatures (SET:crt_id)
-  this.key_map_sig = "map_sig|<%= signer %>|<%= map_id %>";
-  
-  // Certificates applications (SET:map_id)
-  //
-  // Everytime a map is signed, the map identifier (layergroup_id)
-  // is added to this set. The purpose of this set is to drop
-  // all map signatures when a certificate is removed
-  //
-  this.key_crt_sig = "crt_sig|<%= signer %>|<%= crt_id %>";
-
-};
-
-var o = SignedMaps.prototype;
-
-//--------------- PRIVATE METHODS --------------------------------
-
-o._acquireRedis = function(callback) {
-  this.redis_pool.acquire(this.db_signatures, callback);
-};
-
-o._releaseRedis = function(client) {
-  this.redis_pool.release(this.db_signatures, client);
-};
-
-/**
- * Internal function to communicate with redis
- *
- * @param redisFunc - the redis function to execute
- * @param redisArgs - the arguments for the redis function in an array
- * @param callback - function to pass results too.
- */
-o._redisCmd = function(redisFunc, redisArgs, callback) {
-  var redisClient;
-  var that = this;
-  var db = that.db_signatures;
-
-  Step(
-    function getRedisClient() {
-      that.redis_pool.acquire(db, this);
-    },
-    function executeQuery(err, data) {
-      if ( err ) throw err;
-      redisClient = data;
-      redisArgs.push(this);
-      redisClient[redisFunc.toUpperCase()].apply(redisClient, redisArgs);
-    },
-    function releaseRedisClient(err, data) {
-      if ( ! _.isUndefined(redisClient) ) that.redis_pool.release(db, redisClient);
-      callback(err, data);
-    }
-  );
-};
-
-o._getAuthMethod = function(auth) {
-  return auth.method || 'open';
-};
-
-//--------------- PUBLIC API -------------------------------------
-
-/// Check formal validity of a certificate
-//
-/// Return an Error instance if invalid, null otherwise
-///
-o.checkInvalidCertificate = function(cert) {
-  //console.log("Checking cert: "); console.dir(cert);
-  if ( cert.version !== "0.0.1" ) {
-    return new Error("Unsupported certificate version " + cert.version);
-  }
-
-  if ( ! cert.auth ) {
-console.log("Cert is : "); console.dir(cert);
-    return new Error("No certificate authorization");
-  }
-
-  var method = this._getAuthMethod(cert.auth);
-
-  switch ( method ) {
-    case 'open':
-      break;
-    case 'token':
-      if ( ! _.isArray(cert.auth.valid_tokens) )
-        return new Error("Invalid 'token' authentication: missing valid_tokens");
-      if ( ! cert.auth.valid_tokens.length )
-        return new Error("Invalid 'token' authentication: no valid_tokens");
-      break;
-    default:
-      return new Error("Unsupported authentication method: " + cert.auth.method);
-      break;
-  }
-
-  return null; // all valid
-}
-
-// Check if the given certificate authorizes waiver of "auth"
-o.authorizedByCert = function(cert, auth) {
-  auth = _.isArray(auth) ? auth : [auth];
-
-  var err = this.checkInvalidCertificate(cert);
-  if ( err ) throw err;
-
-  var method = this._getAuthMethod(cert.auth);
-
-  // Open authentication certificates are always authorized
-  if ( method === 'open' ) return true;
-
-  // Token based authentication requires valid token
-  if ( method === 'token' ) {
-    return _.intersection(cert.auth.valid_tokens, auth).length > 0;
-  }
-
-  throw new Error("Unsupported authentication method: " + cert.auth.method);
-};
-
-// Check if shown credential are authorized to access a map
-// by the given signer.
-//
-// @param signer a signer name (cartodb username)
-// @param map_id a layergroup_id
-// @param auth an authentication token, or undefined if none
-//                    (can still be authorized by signature)
-//
-// @param callback function(Error, Boolean)
-//
-o.isAuthorized = function(signer, map_id, auth, callback) {
-  var that = this;
-  var redisClient;
-  var db = that.db_signatures;
-  var authorized = false;
-  var certificate_id_list;
-  var missing_certificates = [];
-  if ( debug ) {
-    console.log("Check auth from signer '" + signer + "' on map '" + map_id + "' with auth '" + auth + "'");
-  }
-  Step(
-    function getRedisClient() {
-      that.redis_pool.acquire(db, this);
-    },
-    function getMapSignatures(err, client) {
-      if ( err ) throw err;
-      redisClient = client;
-      var map_sig_key = _.template(that.key_map_sig, {signer:signer, map_id:map_id});
-      redisClient.SMEMBERS(map_sig_key, this);
-      //that._redisCmd('SMEMBERS', [ map_sig_key ], this);
-    },
-    function getCertificates(err, crt_lst) {
-      if ( err ) throw err;
-      if ( debug ) {
-        console.log("Map '" + map_id + "' is signed by " + crt_lst.length + " certificates of user '" + signer);
-      }
-      certificate_id_list = crt_lst;
-      if ( ! crt_lst.length ) {
-        // No certs, avoid calling redis with short args list.
-        // Next step expects a list of certificate values so
-        // we directly send the empty list.
-        return crt_lst;
-      }
-      var map_crt_key = _.template(that.key_map_crt, {signer:signer});
-      //that._redisCmd('HMGET', [ map_crt_key ].concat(crt_lst), this);
-      redisClient.HMGET(map_crt_key, crt_lst, this);
-    },
-    function checkCertificates(err, certs) {
-      if ( err ) throw err;
-      for (var i=0; i<certs.length; ++i) {
-        var crt_id = certificate_id_list[i];
-        if ( _.isNull(certs[i]) ) {
-          missing_certificates.push(crt_id);
-          continue;
-        }
-        var cert;
-        try {
-          //console.log("cert " + crt_id + ": " + certs[i]);
-          cert = JSON.parse(certs[i]);
-          authorized = that.authorizedByCert(cert, auth);
-        } catch (err) {
-          console.log("Certificate " + certificate_id_list[i] + " by user '" + signer + "' is malformed: " + err);
-          continue;
-        }
-        if ( authorized ) {
-          if ( debug ) {
-            console.log("Access to map '" + map_id + "' authorized by cert '"
-                        + certificate_id_list[i] + "' of user '" + signer + "'");
-          }
-          //console.dir(cert);
-          break; // no need to further check certs
-        }
-      }
-      return null;
-    },
-    function finish(err) {
-      if ( missing_certificates.length ) {
-        console.log("WARNING: map '" + map_id + "' is signed by '" + signer
-          + "' with " + missing_certificates.length
-          + " missing certificates: "
-          + missing_certificates + " (TODO: give cleanup instructions)");
-      }
-      if ( redisClient ) that.redis_pool.release(db, redisClient);
-      callback(err, authorized);
-    }
-  );
-};
-
-// Add an authorization certificate from a user.
-//
-// @param signer a signer name (cartodb username)
-// @param cert certificate object, see
-//             http://github.com/CartoDB/Windshaft-cartodb/wiki/Signed-maps
-//
-// @param callback function(err, crt_id) return certificate id
-//
-// TODO: allow for requesting error when certificate already exists ?
-//
-o.addCertificate = function(signer, cert, callback) {
-  var crt_val = JSON.stringify(cert);
-  var crt_id = crypto.createHash('md5').update(crt_val).digest('hex');
-
-  var usr_crt_key = _.template(this.key_map_crt, {signer:signer});
-  this._redisCmd('HSET', [ usr_crt_key, crt_id, crt_val ], function(err, created) {
-    // NOTE: created would be 0 if the field already existed, 1 otherwise
-    callback(err, crt_id);
-  });
-};
-
-// Remove an authorization certificate of a user, also removing
-// any signature made with the certificate.
-//
-// @param signer a signer name (cartodb username)
-// @param crt_id certificate identifier, as returned by addCertificate
-// @param callback function(err)
-//
-o.delCertificate = function(signer, crt_id, callback) {
-  var db = this.db_signatures;
-  var crt_sig_key = _.template(this.key_crt_sig, {signer:signer, crt_id:crt_id});
-  var signed_map_list;
-  var redis_client;
-  var that = this;
-  Step (
-    function getRedisClient() {
-      that._acquireRedis(this);
-    },
-    function removeCertificate(err, data) {
-      if ( err ) throw err;
-      redis_client = data;
-      // Remove the certificate (would be enough to stop authorizing uses)
-      var usr_crt_key = _.template(that.key_map_crt, {signer:signer});
-      redis_client.HDEL(usr_crt_key, crt_id, this);
-    },
-    function getMapSignatures(err, deleted) {
-      if ( err ) throw err;
-      if ( ! deleted ) {
-        // debugging (how can this be possible?)
-        console.log("WARNING: authorization certificate '" + crt_id
-          + "' by user '" + signer + "' did not exist on delete request");
-      }
-      // Get all signatures by this certificate
-      redis_client.SMEMBERS(crt_sig_key, this);
-    },
-    function delMapSignaturesReference(err, map_id_list) {
-      if ( err ) throw err;
-      signed_map_list = map_id_list;
-      if ( debug ) {
-        console.log("Certificate '" + crt_id + "' from user '" + signer
-          + "' was used to sign " + signed_map_list.length + " maps");
-      }
-      redis_client.DEL(crt_sig_key, this);
-    },
-    function delMapSignatures(err) {
-      if ( err ) throw err;
-      var crt_sig_key = _.template(that.key_crt_sig, {signer:signer, crt_id:crt_id});
-      var tx = redis_client.MULTI();
-      for (var i=0; i<signed_map_list.length; ++i) {
-        var map_id = signed_map_list[i];
-        var map_sig_key = _.template(that.key_map_sig, {signer:signer, map_id:map_id});
-        //console.log("Queuing removal of '" + crt_id + "' from '" + map_sig_key + "'");
-        tx.SREM( map_sig_key, crt_id )
-      }
-      tx.EXEC(this);
-    },
-    function reportTransaction(err, rets) {
-      if ( err ) throw err;
-      if ( debug ) {
-        for (var i=0; i<signed_map_list.length; ++i) {
-          var ret = rets[i];
-          if ( ! ret ) {
-            console.log("No signature with certificate '" + crt_id
-              + "' of user '" + signer + "' found in map '"
-              + signed_map_list[i] + "'");
-          } else {
-            console.log("Signature with certificate '" + crt_id
-              + "' of user '" + signer + "' removed from map '"
-              + signed_map_list[i] + "'");
-          }
-        }
-      }
-      return null;
-    },
-    function finish(err) {
-      if ( ! _.isUndefined(redis_client) ) {
-        that._releaseRedis(redis_client);
-      }
-      callback(err);
-    }
-  );
-};
-
-// Sign a map with a certificate reference
-//
-// @param signer a signer name (cartodb username)
-// @param map_id a layergroup_id
-// @param crt_id signature certificate identifier
-//
-// @param callback function(Error) 
-//
-o.signMap = function(signer, map_id, crt_id, callback) {
-  var that = this;
-  Step(
-    function addMapSignature() {
-      var map_sig_key = _.template(that.key_map_sig, {signer:signer, map_id:map_id});
-      if ( debug ) {
-        console.log("Adding " + crt_id + " to " + map_sig_key);
-      }
-      that._redisCmd('SADD', [ map_sig_key, crt_id ], this);
-    },
-    function addCertificateUsage(err) {
-      // Add the map to the set of maps signed by the given cert
-      if ( err ) throw err;
-      var crt_sig_key = _.template(that.key_crt_sig, {signer:signer, crt_id:crt_id});
-      that._redisCmd('SADD', [ crt_sig_key, map_id ], this);
-    },
-    function finish(err) {
-      callback(err);
-    }
-  );
-};
-
-// Sign a map with a full certificate
-//
-// @param signer a signer name (cartodb username)
-// @param map_id a layergroup_id
-// @param cert_id signature certificate identifier
-//
-// @param callback function(Error, String) return certificate id
-//
-o.addSignature = function(signer, map_id, cert, callback) {
-  var that = this;
-  var certificate_id;
-  Step(
-    function addCertificate() {
-      that.addCertificate(signer, cert, this);
-    },
-    function signMap(err, cert_id) {
-      if ( err ) throw err;
-      if ( ! cert_id ) throw new Error("addCertificate returned no certificate id");
-      certificate_id = cert_id;
-      that.signMap(signer, map_id, cert_id, this);
-    },
-    function finish(err) {
-      callback(err, certificate_id);
-    }
-  );
-};
-
-module.exports = SignedMaps;

lib/cartodb/template_maps.js

@@ -3,6 +3,11 @@ var crypto  = require('crypto'),
     _       = require('underscore'),
     dot     = require('dot');
 
+
+var EventEmitter = require('events').EventEmitter;
+var util = require('util');
+
+
 // Class handling map templates
 //
 // See http://github.com/CartoDB/Windshaft-cartodb/wiki/Template-maps
@@ -11,16 +16,16 @@ var crypto  = require('crypto'),
 //        See https://github.com/CartoDB/node-redis-mpool
 //        Needs version 0.x.x of the API.
 //
-// @param signed_maps an instance of a "signed_maps" class,
-//        See signed_maps.js
-//
 // @param opts TemplateMap options. Supported elements:
 //    'max_user_templates' limit on the number of per-user
 //
 // 
-function TemplateMaps(redis_pool, signed_maps, opts) {
+function TemplateMaps(redis_pool, opts) {
+  if (!(this instanceof TemplateMaps)) return new TemplateMaps();
+
+  EventEmitter.call(this);
+
   this.redis_pool = redis_pool;
-  this.signed_maps = signed_maps;
   this.opts = opts || {};
 
   // Database containing templates
@@ -36,18 +41,16 @@ function TemplateMaps(redis_pool, signed_maps, opts) {
   // We have the following datastores:
   //
   //  1. User templates: set of per-user map templates
-  //     NOTE: each template would have an associated auth
-  //           reference, see signed_maps.js
 
   // User templates (HASH:tpl_id->tpl_val)
   this.key_usr_tpl = dot.template("map_tpl|{{=it.owner}}");
-
-  // User template locks (HASH:tpl_id->ctime)
-  this.key_usr_tpl_lck = dot.template("map_tpl|{{=it.owner}}|locks");
-
-  this.lock_ttl = this.opts['lock_ttl'] || 5000;
 }
 
+util.inherits(TemplateMaps, EventEmitter);
+
+module.exports = TemplateMaps;
+
+
 var o = TemplateMaps.prototype;
 
 //--------------- PRIVATE METHODS --------------------------------
@@ -56,14 +59,6 @@ o._userTemplateLimit = function() {
   return this.opts['max_user_templates'] || 0;
 };
 
-o._acquireRedis = function(callback) {
-  this.redis_pool.acquire(this.db_signatures, callback);
-};
-
-o._releaseRedis = function(client) {
-  this.redis_pool.release(this.db_signatures, client);
-};
-
 /**
  * Internal function to communicate with redis
  *
@@ -93,35 +88,6 @@ o._redisCmd = function(redisFunc, redisArgs, callback) {
   );
 };
 
-// @param callback function(err, obtained)
-o._obtainTemplateLock = function(owner, tpl_id, callback) {
-    var that = this,
-        lockKey = this.key_usr_tpl_lck({owner:owner});
-    Step (
-        function obtainLock() {
-            that._redisCmd('HGET', [lockKey, tpl_id], this);
-        },
-        function checkLock(err, lockTime) {
-            if (err) { throw err; }
-
-            var _newLockTime = Date.now();
-            if (!lockTime || ((_newLockTime - lockTime) > that.lock_ttl)) {
-                that._redisCmd('HSET', [lockKey, tpl_id, _newLockTime], this);
-            } else {
-                throw new Error("Template '" + tpl_id + "' of user '" + owner + "' is locked");
-            }
-        },
-        function finish(err, hsetValue) {
-            callback(err, !!hsetValue);
-        }
-    );
-};
-
-// @param callback function(err, deleted)
-o._releaseTemplateLock = function(owner, tpl_id, callback) {
-    this._redisCmd('HDEL', [this.key_usr_tpl_lck({owner:owner}), tpl_id], callback);
-};
-
 var _reValidIdentifier = /^[a-zA-Z][0-9a-zA-Z_]*$/;
 o._checkInvalidTemplate = function(template) {
   if ( template.version != '0.0.1' ) {
@@ -135,6 +101,11 @@ o._checkInvalidTemplate = function(template) {
     return new Error("Invalid characters in template name '" + tplname + "'");
   }
 
+  var invalidError = isInvalidLayergroup(template.layergroup);
+  if (invalidError) {
+    return invalidError;
+  }
+
   var placeholders = template.placeholders || {};
 
   var placeholderKeys = Object.keys(placeholders);
@@ -152,29 +123,62 @@ o._checkInvalidTemplate = function(template) {
       }
   }
 
-  // Check certificate validity
-  var cert = this.getTemplateCertificate(template);
-  var err = this.signed_maps.checkInvalidCertificate(cert);
-  if ( err ) return err;
+    var auth = template.auth || {};
 
-  // TODO: run more checks over template format ?
+    switch ( auth.method ) {
+        case 'open':
+            break;
+        case 'token':
+            if ( ! _.isArray(auth.valid_tokens) )
+                return new Error("Invalid 'token' authentication: missing valid_tokens");
+            if ( ! auth.valid_tokens.length )
+                return new Error("Invalid 'token' authentication: no valid_tokens");
+            break;
+        default:
+            return new Error("Unsupported authentication method: " + auth.method);
+            break;
+    }
+
+    return false;
 };
 
+function isInvalidLayergroup(layergroup) {
+    if (!layergroup) {
+        return new Error('Missing layergroup');
+    }
+
+    var layers = layergroup.layers;
+
+    if (!_.isArray(layers) || layers.length === 0) {
+        return new Error('Missing or empty layers array from layergroup config');
+    }
+
+    var invalidLayers = layers
+        .map(function(layer, layerIndex) {
+            return layer.options ? null : layerIndex;
+        })
+        .filter(function(layerIndex) {
+            return layerIndex !== null;
+        });
+
+    if (invalidLayers.length) {
+        return new Error('Missing `options` in layergroup config for layers: ' + invalidLayers.join(', '));
+    }
+
+    return false;
+}
+
+function templateDefaults(template) {
+    var templateAuth = _.defaults({}, template.auth || {}, {
+        method: 'open'
+    });
+    return _.defaults({ auth: templateAuth }, template, {
+        placeholders: {}
+    });
+}
+
 //--------------- PUBLIC API -------------------------------------
 
-// Extract a signature certificate from a template
-//
-// The certificate will be ready to be passed to
-// SignedMaps.addCertificate or SignedMaps.authorizedByCert
-//
-o.getTemplateCertificate = function(template) {
-  return {
-      version: '0.0.1',
-      template_id: template.name,
-      auth: template.auth
-  };
-};
-
 // Add a template
 //
 // NOTE: locks user+template_name or fails
@@ -188,102 +192,58 @@ o.getTemplateCertificate = function(template) {
 //        Return template identifier (only valid for given user)
 //
 o.addTemplate = function(owner, template, callback) {
-  var invalidError = this._checkInvalidTemplate(template);
-  if ( invalidError ) {
-    callback(invalidError);
-    return;
-  }
-  var tplname = template.name;
+    var self = this;
 
-  // Procedure:
-  //
-  // - Check against limit
-  // 0. Obtain a lock for user+template_name, fail if impossible
-  // 1. Check no other template exists with the same name
-  // 2. Install certificate extracted from template, extending
-  //    it to contain a name to properly salt things out.
-  // 3. Modify the template object to reference certificate by id
-  // 4. Install template
-  // 5. Release lock
-  //
-  //
+    template = templateDefaults(template);
 
-  var usr_tpl_key = this.key_usr_tpl({owner:owner});
-  var gotLock = false;
-  var that = this;
-  var limit = that._userTemplateLimit();
-  Step(
-    function checkLimit() {
-      if ( ! limit ) return 0;
-      that._redisCmd('HLEN', [ usr_tpl_key ], this);
-    },
-    // try to obtain a lock
-    function obtainLock(err, len) {
-      if ( err ) throw err;
-      if ( limit && len >= limit ) {
-        throw new Error("User '" + owner + "' reached limit on number of templates (" + len + "/" + limit + ")");
-      }
-      that._obtainTemplateLock(owner, tplname, this);
-    },
-    function getExistingTemplate(err, locked) {
-      if ( err ) throw err;
-      if ( ! locked ) {
-        // Already locked
-        throw new Error("Template '" + tplname + "' of user '" + owner + "' is locked");
-      }
-      gotLock = true;
-      that._redisCmd('HEXISTS', [ usr_tpl_key, tplname ], this);
-    },
-    function installCertificate(err, exists) {
-      if ( err ) throw err;
-      if ( exists ) {
-        throw new Error("Template '" + tplname + "' of user '" + owner + "' already exists"); 
-      }
-      var cert = that.getTemplateCertificate(template);
-      that.signed_maps.addCertificate(owner, cert, this);
-    },
-    function installTemplate(err, crt_id) {
-      if ( err ) throw err;
-      template.auth_id = crt_id;
-      var tpl_val = JSON.stringify(template);
-      that._redisCmd('HSET', [ usr_tpl_key, tplname, tpl_val ], this);
-    },
-    function releaseLock(err, newfield) {
-      if ( ! err && ! newfield ) {
-        console.log("ERROR: addTemplate overridden existing template '"
-          + tplname + "' of '" + owner
-          + "' -- HSET returned " + overridden + ": someone added it without locking ?");
-        // TODO: how to recover this ?!
-      }
-
-      if ( err && ! gotLock ) throw err;
-
-      // release the lock
-      var next = this;
-      that._releaseTemplateLock(owner, tplname, function(e, d) {
-        if ( e ) {
-          console.log("Error removing lock on template '" + tplname
-            + "' of user '" + owner + "': " + e);
-        } else if ( ! d ) {
-          console.log("ERROR: lock on template '" + tplname
-            + "' of user '" + owner + "' externally removed during insert!");
-        }
-        next(err);
-      });
-    },
-    function finish(err) {
-      callback(err, tplname);
+    var invalidError = this._checkInvalidTemplate(template);
+    if ( invalidError ) {
+        return callback(invalidError);
     }
+
+    var templateName = template.name;
+    var userTemplatesKey = this.key_usr_tpl({ owner:owner });
+    var limit = this._userTemplateLimit();
+
+    Step(
+        function checkLimit() {
+            if ( ! limit ) {
+                return 0;
+            }
+            self._redisCmd('HLEN', [ userTemplatesKey ], this);
+        },
+        function installTemplateIfDoesNotExist(err, numberOfTemplates) {
+            if ( err ) {
+                throw err;
+            }
+            if ( limit && numberOfTemplates >= limit ) {
+                throw new Error("User '" + owner + "' reached limit on number of templates " +
+                    "("+ numberOfTemplates + "/" + limit + ")");
+            }
+            self._redisCmd('HSETNX', [ userTemplatesKey, templateName, JSON.stringify(template) ], this);
+        },
+        function validateInstallation(err, wasSet) {
+            if ( err ) {
+                throw err;
+            }
+            if ( ! wasSet ) {
+                throw new Error("Template '" + templateName + "' of user '" + owner + "' already exists");
+            }
+
+            return true;
+        },
+        function finish(err) {
+            if (!err) {
+                self.emit('add', owner, templateName, template);
+            }
+
+            callback(err, templateName, template);
+        }
   );
 };
 
 // Delete a template
 //
-// NOTE: locks user+template_name or fails
-//
-// Also deletes associated authentication certificate, which
-// in turn deletes all instance signatures
-//
 // @param owner cartodb username of the template owner
 //
 // @param tpl_id template identifier as returned
@@ -292,82 +252,28 @@ o.addTemplate = function(owner, template, callback) {
 // @param callback function(err)
 //
 o.delTemplate = function(owner, tpl_id, callback) {
-  var usr_tpl_key = this.key_usr_tpl({owner:owner});
-  var gotLock = false;
-  var that = this;
-  Step(
-    // try to obtain a lock
-    function obtainLock() {
-      that._obtainTemplateLock(owner, tpl_id, this);
-    },
-    function getExistingTemplate(err, locked) {
-      if ( err ) throw err;
-      if ( ! locked ) {
-        // Already locked
-        throw new Error("Template '" + tpl_id + "' of user '" + owner + "' is locked");
-      }
-      gotLock = true;
-      that._redisCmd('HGET', [ usr_tpl_key, tpl_id ], this);
-    },
-    function delCertificate(err, tplval) {
-      if ( err ) throw err;
-      if ( ! tplval ) {
-        throw new Error("Template '" + tpl_id + "' of user '" + owner + "' does not exist"); 
-      }
-      var tpl = JSON.parse(tplval);
-      if ( ! tpl.auth_id ) {
-        // not sure this is an error, in case we'll ever
-        // allow unsigned templates...
-        console.log("ERROR: installed template '" + tpl_id
-            + "' of user '" + owner + "' has no auth_id reference: "); console.dir(tpl);
-        return null;
-      }
-      var next = this;
-      that.signed_maps.delCertificate(owner, tpl.auth_id, function(err) {
-        if ( err ) {
-          var msg = "ERROR: could not delete certificate '"
-                  + tpl.auth_id + "' associated with template '"
-                  + tpl_id + "' of user '" + owner + "': " + err;
-          // I'm actually not sure we want this event to be fatal
-          // (avoiding a deletion of the template itself) 
-          next(new Error(msg));
-        } else {
-          next();
-        }
-      });
-    },
-    function delTemplate(err) {
-      if ( err ) throw err;
-      that._redisCmd('HDEL', [ usr_tpl_key, tpl_id ], this);
-    },
-    function releaseLock(err, deleted) {
-      if ( ! err && ! deleted ) {
-          console.log("ERROR: template '" + tpl_id
-            + "' of user '" + owner + "' externally removed during delete!");
-      }
+    var self = this;
+    Step(
+        function deleteTemplate() {
+            self._redisCmd('HDEL', [ self.key_usr_tpl({ owner:owner }), tpl_id ], this);
+        },
+        function handleDeletion(err, deleted) {
+            if (err) {
+                throw err;
+            }
+            if (!deleted) {
+                throw new Error("Template '" + tpl_id + "' of user '" + owner + "' does not exist");
+            }
+            return true;
+        },
+        function finish(err) {
+            if (!err) {
+                self.emit('delete', owner, tpl_id);
+            }
 
-      if ( ! gotLock ) {
-        if ( err ) throw err;
-        return null;
-      }
-
-      // release the lock
-      var next = this;
-      that._releaseTemplateLock(owner, tpl_id, function(e, d) {
-        if ( e ) {
-          console.log("Error removing lock on template '" + tpl_id
-            + "' of user '" + owner + "': " + e);
-        } else if ( ! d ) {
-          console.log("ERROR: lock on template '" + tpl_id
-            + "' of user '" + owner + "' externally removed during delete!");
+            callback(err);
         }
-        next(err);
-      });
-    },
-    function finish(err) {
-      callback(err);
-    }
-  );
+    );
 };
 
 // Update a template
@@ -387,104 +293,54 @@ o.delTemplate = function(owner, tpl_id, callback) {
 // @param callback function(err)
 //        
 o.updTemplate = function(owner, tpl_id, template, callback) {
+    var self = this;
 
-  var invalidError = this._checkInvalidTemplate(template);
-  if ( invalidError ) {
-    callback(invalidError);
-    return;
-  }
+    template = templateDefaults(template);
 
-  var tplname = template.name;
+    var invalidError = this._checkInvalidTemplate(template);
 
-  if ( tpl_id != tplname ) {
-    callback(new Error("Cannot update name of a map template ('" + tpl_id + "' != '" + tplname + "')"));
-    return;
-  }
-
-  var usr_tpl_key = this.key_usr_tpl({owner:owner});
-  var gotLock = false;
-  var that = this;
-  Step(
-    // try to obtain a lock
-    function obtainLock() {
-      that._obtainTemplateLock(owner, tpl_id, this);
-    },
-    function getExistingTemplate(err, locked) {
-      if ( err ) throw err;
-      if ( ! locked ) {
-        // Already locked
-        throw new Error("Template '" + tpl_id + "' of user '" + owner + "' is locked");
-      }
-      gotLock = true;
-      that._redisCmd('HGET', [ usr_tpl_key, tpl_id ], this);
-    },
-    function delOldCertificate(err, tplval) {
-      if ( err ) throw err;
-      if ( ! tplval ) {
-        throw new Error("Template '" + tpl_id + "' of user '"
-                         + owner +"' does not exist");
-      }
-      var tpl = JSON.parse(tplval);
-      if ( ! tpl.auth_id ) {
-        // not sure this is an error, in case we'll ever
-        // allow unsigned templates...
-        console.log("ERROR: installed template '" + tpl_id
-            + "' of user '" + owner + "' has no auth_id reference: "); console.dir(tpl);
-        return null;
-      }
-      var next = this;
-      that.signed_maps.delCertificate(owner, tpl.auth_id, function(err) {
-        if ( err ) {
-          var msg = "ERROR: could not delete certificate '"
-                  + tpl.auth_id + "' associated with template '"
-                  + tpl_id + "' of user '" + owner + "': " + err;
-          // I'm actually not sure we want this event to be fatal
-          // (avoiding a deletion of the template itself) 
-          next(new Error(msg));
-        } else {
-          next();
-        }
-      });
-    },
-    function installNewCertificate(err) {
-      if ( err ) throw err;
-      var cert = that.getTemplateCertificate(template);
-      that.signed_maps.addCertificate(owner, cert, this);
-    },
-    function updTemplate(err, crt_id) {
-      if ( err ) throw err;
-      template.auth_id = crt_id;
-      var tpl_val = JSON.stringify(template);
-      that._redisCmd('HSET', [ usr_tpl_key, tplname, tpl_val ], this);
-    },
-    function releaseLock(err, newfield) {
-      if ( ! err && newfield ) {
-          console.log("ERROR: template '" + tpl_id
-            + "' of user '" + owner + "' externally removed during update!");
-      }
-
-      if ( ! gotLock ) {
-        if ( err ) throw err;
-        return null;
-      }
-
-      // release the lock
-      var next = this;
-      that._releaseTemplateLock(owner, tpl_id, function(e, d) {
-        if ( e ) {
-          console.log("Error removing lock on template '" + tpl_id
-            + "' of user '" + owner + "': " + e);
-        } else if ( ! d ) {
-          console.log("ERROR: lock on template '" + tpl_id
-            + "' of user '" + owner + "' externally removed during update!");
-        }
-        next(err);
-      });
-    },
-    function finish(err) {
-      callback(err);
+    if ( invalidError ) {
+        return callback(invalidError);
     }
-  );
+
+    var templateName = template.name;
+
+    if ( tpl_id != templateName ) {
+        return callback(new Error("Cannot update name of a map template ('" + tpl_id + "' != '" + templateName + "')"));
+    }
+
+    var userTemplatesKey = this.key_usr_tpl({ owner:owner });
+
+    Step(
+        function getExistingTemplate() {
+            self._redisCmd('HGET', [ userTemplatesKey, tpl_id ], this);
+        },
+        function updateTemplate(err, currentTemplate) {
+            if (err) {
+                throw err;
+            }
+            if (!currentTemplate) {
+                throw new Error("Template '" + tpl_id + "' of user '" + owner + "' does not exist");
+            }
+            self._redisCmd('HSET', [ userTemplatesKey, templateName, JSON.stringify(template) ], this);
+        },
+        function handleTemplateUpdate(err, didSetNewField) {
+            if (err) {
+                throw err;
+            }
+            if (didSetNewField) {
+                console.warn('New template created on update operation');
+            }
+            return true;
+        },
+        function finish(err) {
+            if (!err) {
+                self.emit('update', owner, templateName, template);
+            }
+
+            callback(err, template);
+        }
+    );
 };
 
 // List user templates
@@ -509,20 +365,47 @@ o.listTemplates = function(owner, callback) {
 //        Return full template definition
 //
 o.getTemplate = function(owner, tpl_id, callback) {
-  var that = this;
-  Step(
-    function getTemplate() {
-      that._redisCmd('HGET', [ that.key_usr_tpl({owner:owner}), tpl_id ], this);
-    },
-    function parseTemplate(err, tpl_val) {
-      if ( err ) throw err;
-      // Should we strip auth_id ?
-      return JSON.parse(tpl_val);
-    },
-    function finish(err, tpl) {
-      callback(err, tpl);
+    var self = this;
+    Step(
+        function getTemplate() {
+            self._redisCmd('HGET', [ self.key_usr_tpl({owner:owner}), tpl_id ], this);
+        },
+        function parseTemplate(err, tpl_val) {
+            if ( err ) throw err;
+            return JSON.parse(tpl_val);
+        },
+        function finish(err, tpl) {
+            callback(err, tpl);
+        }
+    );
+};
+
+o.isAuthorized = function(template, authTokens) {
+    if (!template) {
+        return false;
     }
-  );
+
+    authTokens = _.isArray(authTokens) ? authTokens : [authTokens];
+
+    var templateAuth = template.auth;
+
+    if (!templateAuth) {
+        return false;
+    }
+
+    if (_.isString(templateAuth) && templateAuth === 'open') {
+        return true;
+    }
+
+    if (templateAuth.method === 'open') {
+        return true;
+    }
+
+    if (templateAuth.method === 'token') {
+        return _.intersection(templateAuth.valid_tokens, authTokens).length > 0;
+    }
+
+    return false;
 };
 
 // Perform placeholder substitutions on a template
@@ -594,6 +477,13 @@ o.instance = function(template, params) {
     if ( lyropt.sql) lyropt.sql = _replaceVars(lyropt.sql, all_params);
     // Anything else ?
   }
+
+  // extra information about the template
+  layergroup.template = {
+    name: template.name,
+    auth: template.auth
+  };
+
   return layergroup;
 };
 
@@ -604,5 +494,3 @@ o.fingerPrint = function(template) {
     .digest('hex')
   ;
 };
-
-module.exports = TemplateMaps;

package.json

@@ -1,7 +1,7 @@
 {
     "private": true,
     "name": "windshaft-cartodb",
-    "version": "1.18.2",
+    "version": "1.28.2",
     "description": "A map tile server for CartoDB",
     "keywords": [
       "cartodb"
@@ -25,14 +25,15 @@
         "node-varnish": "https://github.com/Vizzuality/node-varnish/tarball/0.3.0",
         "underscore"  : "~1.6.0",
         "dot": "~1.0.2",
-        "windshaft": "https://github.com/CartoDB/Windshaft/tarball/0.28.1",
+        "windshaft": "~0.37.2",
         "step": "~0.0.5",
+        "queue-async": "~1.0.7",
         "request": "~2.9.203",
-        "cartodb-redis": "https://github.com/CartoDB/node-cartodb-redis/tarball/0.11.0",
-        "cartodb-psql": "https://github.com/CartoDB/node-cartodb-psql/tarball/0.4.0",
-        "redis-mpool": "https://github.com/CartoDB/node-redis-mpool/tarball/0.1.0",
+        "cartodb-redis": "~0.11.0",
+        "cartodb-psql": "~0.4.0",
+        "redis-mpool": "~0.3.0",
         "lzma": "~1.3.7",
-        "log4js": "~0.6.17",
+        "log4js": "https://github.com/CartoDB/log4js-node/tarball/cdb",
         "rollbar": "~0.3.13"
     },
     "devDependencies": {
@@ -43,5 +44,9 @@
     },
     "scripts": {
         "test": "make check"
+    },
+    "engines": {
+        "node": ">=0.8 <0.11",
+        "npm": ">=1.2.1"
     }
 }

test/acceptance/cache/surrogate_keys_invalidation.js

@@ -0,0 +1,218 @@
+var assert      = require('../../support/assert');
+var redis       = require('redis');
+var Step        = require('step');
+
+var helper = require(__dirname + '/../../support/test_helper');
+
+var SqlApiEmulator = require(__dirname + '/../../support/SQLAPIEmu.js');
+
+var NamedMapsCacheEntry = require(__dirname + '/../../../lib/cartodb/cache/model/named_maps_entry');
+var SurrogateKeysCache = require(__dirname + '/../../../lib/cartodb/cache/surrogate_keys_cache');
+
+var CartodbWindshaft = require(__dirname + '/../../../lib/cartodb/cartodb_windshaft');
+var ServerOptions = require(__dirname + '/../../../lib/cartodb/server_options');
+var serverOptions = ServerOptions();
+
+
+suite('templates surrogate keys', function() {
+
+    var sqlApiServer;
+    var redisClient = redis.createClient(global.environment.redis.port);
+
+    // Enable Varnish purge for tests
+    serverOptions.varnish_purge_enabled = true;
+
+    var server = new CartodbWindshaft(serverOptions);
+
+    var templateOwner = 'localhost',
+        templateName = 'acceptance',
+        expectedTemplateId = templateOwner + '@' + templateName,
+        template = {
+            version: '0.0.1',
+            name: templateName,
+            auth: {
+                method: 'open'
+            },
+            layergroup:  {
+                version: '1.2.0',
+                layers: [
+                    {
+                        options: {
+                            sql: 'select 1 cartodb_id, null::geometry as the_geom_webmercator',
+                            cartocss: '#layer { marker-fill:blue; }',
+                            cartocss_version: '2.3.0'
+                        }
+                    }
+                ]
+            }
+        },
+        expectedBody = { template_id: expectedTemplateId };
+
+    suiteSetup(function(done) {
+        sqlApiServer = new SqlApiEmulator(global.environment.sqlapi.port, done);
+    });
+
+    var surrogateKeysCacheInvalidateFn = SurrogateKeysCache.prototype.invalidate;
+
+    function createTemplate(callback) {
+        var postTemplateRequest = {
+            url: '/tiles/template?api_key=1234',
+            method: 'POST',
+            headers: {
+                host: templateOwner,
+                'Content-Type': 'application/json'
+            },
+            data: JSON.stringify(template)
+        };
+
+        Step(
+            function postTemplate() {
+                var next = this;
+                assert.response(server,
+                    postTemplateRequest,
+                    {
+                        status: 200
+                    },
+                    function(res) {
+                        next(null, res);
+                    }
+                );
+            },
+            function rePostTemplate(err, res) {
+                if (err) {
+                    throw err;
+                }
+                var parsedBody = JSON.parse(res.body);
+                assert.deepEqual(parsedBody, expectedBody);
+                return true;
+            },
+            function finish(err) {
+                callback(err);
+            }
+        );
+    }
+
+    test("update template calls surrogate keys invalidation", function(done) {
+        var cacheEntryKey;
+        var surrogateKeysCacheInvalidateMethodInvoked = false;
+        SurrogateKeysCache.prototype.invalidate = function(cacheEntry) {
+            cacheEntryKey = cacheEntry.key();
+            surrogateKeysCacheInvalidateMethodInvoked = true;
+        };
+
+        Step(
+            function createTemplateToUpdate() {
+                createTemplate(this);
+            },
+            function putValidTemplate(err) {
+                if (err) {
+                    throw err;
+                }
+                var updateTemplateRequest = {
+                    url: '/tiles/template/' + expectedTemplateId + '/?api_key=1234',
+                    method: 'PUT',
+                    headers: {
+                        host: templateOwner,
+                        'Content-Type': 'application/json'
+                    },
+                    data: JSON.stringify(template)
+                };
+                var next = this;
+                assert.response(server,
+                    updateTemplateRequest,
+                    {
+                        status: 200
+                    },
+                    function(res) {
+                        next(null, res);
+                    }
+                );
+            },
+            function checkValidUpdate(err, res) {
+                if (err) {
+                    throw err;
+                }
+                var parsedBody = JSON.parse(res.body);
+                assert.deepEqual(parsedBody, expectedBody);
+
+                assert.ok(surrogateKeysCacheInvalidateMethodInvoked);
+                assert.equal(cacheEntryKey, new NamedMapsCacheEntry(templateOwner, templateName).key());
+
+                return null;
+            },
+            function finish(err) {
+                if ( err ) {
+                    return done(err);
+                }
+                redisClient.keys("map_*|localhost", function(err, keys) {
+                    if ( err ) {
+                        return done(err);
+                    }
+                    redisClient.del(keys, function(err) {
+                        return done(err);
+                    });
+                });
+            }
+        );
+    });
+
+    test("delete template calls surrogate keys invalidation", function(done) {
+
+        var cacheEntryKey;
+        var surrogateKeysCacheInvalidateMethodInvoked = false;
+        SurrogateKeysCache.prototype.invalidate = function(cacheEntry) {
+            cacheEntryKey = cacheEntry.key();
+            surrogateKeysCacheInvalidateMethodInvoked = true;
+        };
+
+        Step(
+            function createTemplateToDelete() {
+                createTemplate(this);
+            },
+            function deleteValidTemplate(err) {
+                if (err) {
+                    throw err;
+                }
+                var deleteTemplateRequest = {
+                    url: '/tiles/template/' + expectedTemplateId + '/?api_key=1234',
+                    method: 'DELETE',
+                    headers: {
+                        host: templateOwner,
+                        'Content-Type': 'application/json'
+                    }
+                };
+                var next = this;
+                assert.response(server,
+                    deleteTemplateRequest,
+                    {
+                        status: 204
+                    },
+                    function(res) {
+                        next(null, res);
+                    }
+                );
+            },
+            function checkValidUpdate(err) {
+                if (err) {
+                    throw err;
+                }
+
+                assert.ok(surrogateKeysCacheInvalidateMethodInvoked);
+                assert.equal(cacheEntryKey, new NamedMapsCacheEntry(templateOwner, templateName).key());
+
+                return null;
+            },
+            function finish(err) {
+                done(err);
+            }
+        );
+    });
+
+    suiteTeardown(function(done) {
+        SurrogateKeysCache.prototype.invalidate = surrogateKeysCacheInvalidateFn;
+        // Enable Varnish purge for tests
+        serverOptions.varnish_purge_enabled = false;
+        sqlApiServer.close(done);
+    });
+
+});

test/acceptance/health_check.js

@@ -0,0 +1,74 @@
+var helper = require(__dirname + '/../support/test_helper');
+
+var assert      = require('../support/assert');
+var CartodbWindshaft = require(__dirname + '/../../lib/cartodb/cartodb_windshaft');
+var serverOptions = require(__dirname + '/../../lib/cartodb/server_options')();
+var server = new CartodbWindshaft(serverOptions);
+
+suite('health checks', function () {
+
+    function resetHealthConfig() {
+        global.environment.health = {
+            enabled: true,
+            username: 'localhost',
+            z: 0,
+            x: 0,
+            y: 0
+        };
+    }
+
+    var healthCheckRequest = {
+        url: '/health',
+        method: 'GET',
+        headers: {
+            host: 'localhost'
+        }
+    };
+
+    test('returns 200 and ok=true with enabled configuration', function (done) {
+        resetHealthConfig();
+
+        assert.response(server,
+            healthCheckRequest,
+            {
+                status: 200
+            },
+            function (res, err) {
+                assert.ok(!err);
+
+                var parsed = JSON.parse(res.body);
+
+                assert.ok(parsed.enabled);
+                assert.ok(parsed.ok);
+
+                done();
+            }
+        );
+    });
+
+    test('fails for invalid user because it is not in redis', function (done) {
+        resetHealthConfig();
+
+        global.environment.health.username = 'invalid';
+
+        assert.response(server,
+            healthCheckRequest,
+            {
+                status: 503
+            },
+            function (res, err) {
+                assert.ok(!err);
+
+                var parsed = JSON.parse(res.body);
+
+                assert.equal(parsed.enabled, true);
+                assert.equal(parsed.ok, false);
+
+                assert.equal(parsed.result.redis.ok, false);
+
+                done();
+            }
+        );
+    });
+
+});

test/acceptance/multilayer.js

@@ -24,8 +24,6 @@ server.setMaxListeners(0);
 
 [true, false].forEach(function(cdbQueryTablesFromPostgresEnabledValue) {
 
-global.environment.enabledFeatures = {cdbQueryTablesFromPostgres: cdbQueryTablesFromPostgresEnabledValue};
-
 suite('multilayer:postgres=' + cdbQueryTablesFromPostgresEnabledValue, function() {
 
     var redis_client = redis.createClient(global.environment.redis.port);
@@ -38,6 +36,7 @@ suite('multilayer:postgres=' + cdbQueryTablesFromPostgresEnabledValue, function(
     var test_database = test_user + '_db';
 
     suiteSetup(function(done){
+      global.environment.enabledFeatures = { cdbQueryTablesFromPostgres: cdbQueryTablesFromPostgresEnabledValue };
       sqlapi_server = new SQLAPIEmu(global.environment.sqlapi.port, done);
     });
 
@@ -112,15 +111,17 @@ suite('multilayer:postgres=' + cdbQueryTablesFromPostgresEnabledValue, function(
               assert.ok(cc); 
               var dbname = test_database;
               assert.equal(cc.substring(0, dbname.length), dbname);
-              var jsonquery = cc.substring(dbname.length+1);
-              var sentquery = JSON.parse(jsonquery);
-              var expectedQuery = [layergroup.layers[0].options.sql, ';', layergroup.layers[1].options.sql].join('');
-              assert.equal(sentquery.q, 'WITH querytables AS ( SELECT * FROM CDB_QueryTables($windshaft$'
-                + expectedQuery
-                + '$windshaft$) as tablenames )'
-                + ' SELECT (SELECT tablenames FROM querytables), EXTRACT(EPOCH FROM max(updated_at)) as max'
-                + ' FROM CDB_TableMetadata m'
-                + ' WHERE m.tabname = any ((SELECT tablenames from querytables)::regclass[])');
+              if (!cdbQueryTablesFromPostgresEnabledValue) { // only test if it was using the SQL API
+                  var jsonquery = cc.substring(dbname.length + 1);
+                  var sentquery = JSON.parse(jsonquery);
+                  var expectedQuery = [layergroup.layers[0].options.sql, ';', layergroup.layers[1].options.sql].join('');
+                  assert.equal(sentquery.q, 'WITH querytables AS ( SELECT * FROM CDB_QueryTables($windshaft$'
+                      + expectedQuery
+                      + '$windshaft$) as tablenames )'
+                      + ' SELECT (SELECT tablenames FROM querytables), EXTRACT(EPOCH FROM max(updated_at)) as max'
+                      + ' FROM CDB_TableMetadata m'
+                      + ' WHERE m.tabname = any ((SELECT tablenames from querytables)::regclass[])');
+              }
 
               assert.imageEqualsFile(res.body, 'test/fixtures/test_table_0_0_0_multilayer1.png', IMAGE_EQUALS_HIGHER_TOLERANCE_PER_MIL,
                 function(err, similarity) {
@@ -337,7 +338,7 @@ suite('multilayer:postgres=' + cdbQueryTablesFromPostgresEnabledValue, function(
         layers: [
            { options: {
                sql: 'select 1 as cartodb_id, '
-                  + 'ST_Buffer(!bbox!, -32*greatest(!pixel_width!,!pixel_height!)) as the_geom_webmercator',
+                  + 'ST_Buffer(!bbox!, -32*greatest(!pixel_width!,!pixel_height!)) as the_geom_webmercator from test_table limit 1',
                cartocss: '#layer { polygon-fill:red; }', 
                cartocss_version: '2.0.1',
                interactivity: 'cartodb_id'
@@ -388,21 +389,23 @@ suite('multilayer:postgres=' + cdbQueryTablesFromPostgresEnabledValue, function(
 
               // Check X-Cache-Channel
               var cc = res.headers['x-cache-channel'];
-              assert.ok(cc); 
+              assert.ok(cc);
               var dbname = test_database;
               assert.equal(cc.substring(0, dbname.length), dbname);
-              var jsonquery = cc.substring(dbname.length+1);
-              var sentquery = JSON.parse(jsonquery);
-              var expectedQuery = layergroup.layers[0].options.sql
-                  .replace(/!bbox!/g, 'ST_MakeEnvelope(0,0,0,0)')
-                  .replace(/!pixel_width!/g, '1')
-                  .replace(/!pixel_height!/g, '1');
-              assert.equal(sentquery.q, 'WITH querytables AS ( SELECT * FROM CDB_QueryTables($windshaft$'
-                  + expectedQuery
-                  + '$windshaft$) as tablenames )'
-                  + ' SELECT (SELECT tablenames FROM querytables), EXTRACT(EPOCH FROM max(updated_at)) as max'
-                  + ' FROM CDB_TableMetadata m'
-                  + ' WHERE m.tabname = any ((SELECT tablenames from querytables)::regclass[])');
+              if (!cdbQueryTablesFromPostgresEnabledValue) { // only test if it was using the SQL API
+                  var jsonquery = cc.substring(dbname.length + 1);
+                  var sentquery = JSON.parse(jsonquery);
+                  var expectedQuery = layergroup.layers[0].options.sql
+                      .replace(/!bbox!/g, 'ST_MakeEnvelope(0,0,0,0)')
+                      .replace(/!pixel_width!/g, '1')
+                      .replace(/!pixel_height!/g, '1');
+                  assert.equal(sentquery.q, 'WITH querytables AS ( SELECT * FROM CDB_QueryTables($windshaft$'
+                      + expectedQuery
+                      + '$windshaft$) as tablenames )'
+                      + ' SELECT (SELECT tablenames FROM querytables), EXTRACT(EPOCH FROM max(updated_at)) as max'
+                      + ' FROM CDB_TableMetadata m'
+                      + ' WHERE m.tabname = any ((SELECT tablenames from querytables)::regclass[])');
+              }
 
               assert.imageEqualsFile(res.body, 'test/fixtures/test_multilayer_bbox.png', IMAGE_EQUALS_TOLERANCE_PER_MIL,
                 function(err, similarity) {
@@ -428,18 +431,20 @@ suite('multilayer:postgres=' + cdbQueryTablesFromPostgresEnabledValue, function(
               assert.ok(cc); 
               var dbname = test_database;
               assert.equal(cc.substring(0, dbname.length), dbname);
-              var jsonquery = cc.substring(dbname.length+1);
-              var sentquery = JSON.parse(jsonquery);
-              var expectedQuery = layergroup.layers[0].options.sql
-                  .replace('!bbox!', 'ST_MakeEnvelope(0,0,0,0)')
-                  .replace('!pixel_width!', '1')
-                  .replace('!pixel_height!', '1');
-              assert.equal(sentquery.q, 'WITH querytables AS ( SELECT * FROM CDB_QueryTables($windshaft$'
-                  + expectedQuery
-                  + '$windshaft$) as tablenames )'
-                  + ' SELECT (SELECT tablenames FROM querytables), EXTRACT(EPOCH FROM max(updated_at)) as max'
-                  + ' FROM CDB_TableMetadata m'
-                  + ' WHERE m.tabname = any ((SELECT tablenames from querytables)::regclass[])');
+              if (!cdbQueryTablesFromPostgresEnabledValue) { // only test if it was using the SQL API
+                  var jsonquery = cc.substring(dbname.length + 1);
+                  var sentquery = JSON.parse(jsonquery);
+                  var expectedQuery = layergroup.layers[0].options.sql
+                      .replace('!bbox!', 'ST_MakeEnvelope(0,0,0,0)')
+                      .replace('!pixel_width!', '1')
+                      .replace('!pixel_height!', '1');
+                  assert.equal(sentquery.q, 'WITH querytables AS ( SELECT * FROM CDB_QueryTables($windshaft$'
+                      + expectedQuery
+                      + '$windshaft$) as tablenames )'
+                      + ' SELECT (SELECT tablenames FROM querytables), EXTRACT(EPOCH FROM max(updated_at)) as max'
+                      + ' FROM CDB_TableMetadata m'
+                      + ' WHERE m.tabname = any ((SELECT tablenames from querytables)::regclass[])');
+              }
 
               assert.imageEqualsFile(res.body, 'test/fixtures/test_multilayer_bbox.png', IMAGE_EQUALS_TOLERANCE_PER_MIL,
                 function(err, similarity) {
@@ -1218,8 +1223,10 @@ suite('multilayer:postgres=' + cdbQueryTablesFromPostgresEnabledValue, function(
           var parsedBody = JSON.parse(res.body);
           var token_components = parsedBody.layergroupid.split(':');
           expected_token = token_components[0];
-          var last_request = sqlapi_server.getLastRequest();
-          assert.equal(last_request.method, 'POST');
+          if (!cdbQueryTablesFromPostgresEnabledValue) { // only test if it was using the SQL API
+              var last_request = sqlapi_server.getLastRequest();
+              assert.equal(last_request.method, 'POST');
+          }
           return null;
         },
         function cleanup(err) {
@@ -1283,6 +1290,7 @@ suite('multilayer:postgres=' + cdbQueryTablesFromPostgresEnabledValue, function(
       );
     });
 
+    if (!cdbQueryTablesFromPostgresEnabledValue) { // only test if it was using the SQL API
     // See https://github.com/CartoDB/Windshaft-cartodb/issues/167
     test("lack of response from sql-api will result in a timeout", function(done) {
 
@@ -1323,6 +1331,94 @@ suite('multilayer:postgres=' + cdbQueryTablesFromPostgresEnabledValue, function(
         }
       );
     });
+    }
+
+    var layergroupTtlRequest = {
+        url: '/tiles/layergroup?config=' + encodeURIComponent(JSON.stringify({
+            version: '1.0.0',
+            layers: [
+                { options: {
+                    sql: 'select * from test_table limit 2',
+                    cartocss: '#layer { marker-fill:red; marker-width:32; marker-allow-overlap:true; }',
+                    cartocss_version: '2.0.1'
+                } }
+            ]
+        })),
+        method: 'GET',
+        headers: {host: 'localhost'}
+    };
+    var layergroupTtlResponseExpectation = {
+        status: 200
+    };
+
+    test("cache control for layergroup default value", function(done) {
+        global.environment.varnish.layergroupTtl = null;
+
+        assert.response(server, layergroupTtlRequest, layergroupTtlResponseExpectation,
+            function(res) {
+                assert.equal(res.headers['cache-control'], 'public,max-age=86400,must-revalidate');
+
+                done();
+            }
+        );
+    });
+
+    test("cache control for layergroup uses configuration for max-age", function(done) {
+        var layergroupTtl = 300;
+        global.environment.varnish.layergroupTtl = layergroupTtl;
+
+        assert.response(server, layergroupTtlRequest, layergroupTtlResponseExpectation,
+            function(res) {
+                assert.equal(res.headers['cache-control'], 'public,max-age=' + layergroupTtl + ',must-revalidate');
+
+                done();
+            }
+        );
+    });
+
+
+    test("it's not possible to override authorization with a crafted layergroup", function(done) {
+
+        var layergroup =  {
+            version: '1.0.0',
+            layers: [
+                {
+                    options: {
+                        sql: 'select * from test_table_private_1',
+                        cartocss: '#layer { marker-fill:red; }',
+                        cartocss_version: '2.3.0',
+                        interactivity: 'cartodb_id'
+                    }
+                }
+            ],
+            template: {
+                auth: {
+                    method: "open"
+                },
+                name: "open"
+            }
+        };
+
+        assert.response(
+            server,
+            {
+                url: '/api/v1/map?signer=localhost',
+                method: 'POST',
+                headers: {
+                    host: 'localhost',
+                    'Content-Type': 'application/json'
+                },
+                data: JSON.stringify(layergroup)
+            },
+            {
+                status: 403
+            },
+            function(res, err) {
+                assert.ok(res.body.match(/permission denied for relation test_table_private_1/));
+                done();
+            }
+        );
+    });
 
 
     suiteTeardown(function(done) {

test/acceptance/named_layers.js

@@ -0,0 +1,527 @@
+var test_helper = require('../support/test_helper');
+
+var assert = require('../support/assert');
+var CartodbWindshaft = require(__dirname + '/../../lib/cartodb/cartodb_windshaft');
+var serverOptions = require(__dirname + '/../../lib/cartodb/server_options')();
+var server = new CartodbWindshaft(serverOptions);
+
+var RedisPool = require('redis-mpool');
+var TemplateMaps = require('../../lib/cartodb/template_maps.js');
+
+var Step = require('step');
+var _ = require('underscore');
+
+suite('named_layers', function() {
+    // configure redis pool instance to use in tests
+    var redisPool = RedisPool(global.environment.redis);
+
+    var templateMaps = new TemplateMaps(redisPool, {
+        max_user_templates: global.environment.maxUserTemplates
+    });
+
+    var wadusLayer = {
+        type: 'cartodb',
+        options: {
+            sql: 'select 1 cartodb_id, null::geometry the_geom_webmercator',
+            cartocss: '#layer { marker-fill: <%= color %>; }',
+            cartocss_version: '2.3.0'
+        }
+    };
+
+    var username = 'localhost';
+
+    var templateName = 'valid_template';
+    var template = {
+        version: '0.0.1',
+        name: templateName,
+        auth: {
+            method: 'open'
+        },
+        "placeholders": {
+            "color": {
+                "type": "css_color",
+                "default": "#cc3300"
+            }
+        },
+        layergroup: {
+            layers: [
+                wadusLayer
+            ]
+        }
+    };
+
+    var tokenAuthTemplateName = 'auth_valid_template';
+    var tokenAuthTemplate = {
+        version: '0.0.1',
+        name: tokenAuthTemplateName,
+        auth: {
+            method: 'token',
+            valid_tokens: ['valid1', 'valid2']
+        },
+        placeholders: {
+            color: {
+                "type": "css_color",
+                "default": "#cc3300"
+            }
+        },
+        layergroup: {
+            layers: [
+                wadusLayer
+            ]
+        }
+    };
+
+
+    var namedMapLayer = {
+        type: 'named',
+        options: {
+            name: templateName,
+            config: {},
+            auth_tokens: []
+        }
+    };
+
+    var nestedNamedMapTemplateName = 'nested_template';
+    var nestedNamedMapTemplate = {
+        version: '0.0.1',
+        name: nestedNamedMapTemplateName,
+        auth: {
+            method: 'open'
+        },
+        layergroup: {
+            layers: [
+                namedMapLayer
+            ]
+        }
+    };
+
+    suiteSetup(function(done) {
+        global.environment.enabledFeatures = {cdbQueryTablesFromPostgres: true};
+        templateMaps.addTemplate(username, nestedNamedMapTemplate, function(err) {
+            if (err) {
+                return done(err);
+            }
+            templateMaps.addTemplate(username, tokenAuthTemplate, function(err) {
+                if (err) {
+                    return done(err);
+                }
+                templateMaps.addTemplate(username, template, function(err) {
+                    return done(err);
+                });
+            });
+        });
+    });
+
+    test('should fail for non-existing template name', function(done) {
+        var layergroup =  {
+            version: '1.3.0',
+            layers: [
+                {
+                    type: 'named',
+                    options: {
+                        name: 'nonexistent'
+                    }
+                }
+            ]
+        };
+
+        Step(
+            function createLayergroup() {
+                var next = this;
+                assert.response(server,
+                    {
+                        url: '/tiles/layergroup',
+                        method: 'POST',
+                        headers: {
+                            host: 'localhost',
+                            'Content-Type': 'application/json'
+                        },
+                        data: JSON.stringify(layergroup)
+                    },
+                    {
+                        status: 400
+                    },
+                    function(res, err) {
+                        next(err, res);
+                    }
+                );
+            },
+            function checkLayergroup(err, response) {
+                if (err) {
+                    throw err;
+                }
+
+                var parsedBody = JSON.parse(response.body);
+                assert.deepEqual(parsedBody, { errors: ["Template 'nonexistent' of user 'localhost' not found"] });
+
+                return null;
+            },
+            function finish(err) {
+                done(err);
+            }
+        );
+    });
+
+    test('should return 403 if not properly authorized', function(done) {
+
+        var layergroup =  {
+            version: '1.3.0',
+            layers: [
+                {
+                    type: 'named',
+                    options: {
+                        name: tokenAuthTemplateName,
+                        config: {},
+                        auth_tokens: ['token1']
+                    }
+                }
+            ]
+        };
+
+        Step(
+            function createLayergroup() {
+                var next = this;
+                assert.response(server,
+                    {
+                        url: '/tiles/layergroup',
+                        method: 'POST',
+                        headers: {
+                            host: 'localhost',
+                            'Content-Type': 'application/json'
+                        },
+                        data: JSON.stringify(layergroup)
+                    },
+                    {
+                        status: 403
+                    },
+                    function(res, err) {
+                        next(err, res);
+                    }
+                );
+            },
+            function checkLayergroup(err, response) {
+                if (err) {
+                    throw err;
+                }
+
+                var parsedBody = JSON.parse(response.body);
+                assert.deepEqual(
+                    parsedBody,
+                    { errors: [ "Unauthorized 'auth_valid_template' template instantiation" ] }
+                );
+
+                return null;
+            },
+            function finish(err) {
+                done(err);
+            }
+        );
+
+    });
+
+    test('should return 200 and layergroup if properly authorized', function(done) {
+
+        var layergroup =  {
+            version: '1.3.0',
+            layers: [
+                {
+                    type: 'named',
+                    options: {
+                        name: tokenAuthTemplateName,
+                        config: {},
+                        auth_tokens: ['valid1']
+                    }
+                }
+            ]
+        };
+
+        Step(
+            function createLayergroup() {
+                var next = this;
+                assert.response(server,
+                    {
+                        url: '/tiles/layergroup',
+                        method: 'POST',
+                        headers: {
+                            host: 'localhost',
+                            'Content-Type': 'application/json'
+                        },
+                        data: JSON.stringify(layergroup)
+                    },
+                    {
+                        status: 200
+                    },
+                    function(res, err) {
+                        next(err, res);
+                    }
+                );
+            },
+            function checkLayergroup(err, response) {
+                if (err) {
+                    throw err;
+                }
+
+                var parsedBody = JSON.parse(response.body);
+                assert.ok(parsedBody.layergroupid);
+                assert.ok(parsedBody.last_updated);
+
+                return null;
+            },
+            function finish(err) {
+                done(err);
+            }
+        );
+
+    });
+
+    test('should return 400 for nested named map layers', function(done) {
+
+        var layergroup =  {
+            version: '1.3.0',
+            layers: [
+                {
+                    type: 'named',
+                    options: {
+                        name: nestedNamedMapTemplateName
+                    }
+                }
+            ]
+        };
+
+        Step(
+            function createLayergroup() {
+                var next = this;
+                assert.response(server,
+                    {
+                        url: '/tiles/layergroup',
+                        method: 'POST',
+                        headers: {
+                            host: 'localhost',
+                            'Content-Type': 'application/json'
+                        },
+                        data: JSON.stringify(layergroup)
+                    },
+                    {
+                        status: 400
+                    },
+                    function(res, err) {
+                        next(err, res);
+                    }
+                );
+            },
+            function checkLayergroup(err, response) {
+                if (err) {
+                    throw err;
+                }
+
+                var parsedBody = JSON.parse(response.body);
+                assert.deepEqual(parsedBody, { errors: [ 'Nested named layers are not allowed' ] });
+
+                return null;
+            },
+            function finish(err) {
+                done(err);
+            }
+        );
+
+    });
+
+    test('should return 200 and layergroup with private tables', function(done) {
+
+        var privateTableTemplateName = 'private_table_template';
+        var privateTableTemplate = {
+            version: '0.0.1',
+            name: privateTableTemplateName,
+            auth: {
+                method: 'open'
+            },
+            layergroup: {
+                layers: [
+                    {
+                        type: 'cartodb',
+                        options: {
+                            sql: 'select * from test_table_private_1',
+                            cartocss: '#layer { marker-fill: #cc3300; }',
+                            cartocss_version: '2.3.0'
+                        }
+                    }
+                ]
+            }
+        };
+
+        var layergroup =  {
+            version: '1.3.0',
+            layers: [
+                {
+                    type: 'named',
+                    options: {
+                        name: privateTableTemplateName
+                    }
+                }
+            ]
+        };
+
+        Step(
+            function createTemplate() {
+                templateMaps.addTemplate(username, privateTableTemplate, this);
+            },
+            function createLayergroup(err) {
+                if (err) {
+                    throw err;
+                }
+
+                var next = this;
+                assert.response(server,
+                    {
+                        url: '/tiles/layergroup',
+                        method: 'POST',
+                        headers: {
+                            host: 'localhost',
+                            'Content-Type': 'application/json'
+                        },
+                        data: JSON.stringify(layergroup)
+                    },
+                    {
+                        status: 200
+                    },
+                    function(res, err) {
+                        next(err, res);
+                    }
+                );
+            },
+            function checkLayergroup(err, response) {
+                if (err) {
+                    throw err;
+                }
+
+                var parsedBody = JSON.parse(response.body);
+                assert.ok(parsedBody.layergroupid);
+                assert.ok(parsedBody.last_updated);
+
+                return parsedBody.layergroupid;
+            },
+            function requestTile(err, layergroupId) {
+                if (err) {
+                    throw err;
+                }
+
+                var next = this;
+                assert.response(server,
+                    {
+                        url: '/tiles/layergroup/' + layergroupId + '/0/0/0.png',
+                        method: 'GET',
+                        headers: {
+                            host: 'localhost'
+                        },
+                        encoding: 'binary'
+                    },
+                    {
+                        status: 200,
+                        headers: {
+                            'content-type': 'image/png'
+                        }
+                    },
+                    function(res, err) {
+                        next(err, res);
+                    }
+                );
+            },
+            function handleTileResponse(err, res) {
+                if (err) {
+                    throw err;
+                }
+                test_helper.checkCache(res);
+                return true;
+            },
+            function deleteTemplate(err) {
+                var next = this;
+                templateMaps.delTemplate(username, privateTableTemplate, function(/*delErr*/) {
+                    // ignore deletion error
+                    next(err);
+                });
+            },
+            function finish(err) {
+                done(err);
+            }
+        );
+
+    });
+
+    test('should return 403 when private table is accessed from non named layer', function(done) {
+
+        var layergroup =  {
+            version: '1.3.0',
+            layers: [
+                {
+                    type: 'cartodb',
+                    options: {
+                        sql: 'select * from test_table_private_1',
+                        cartocss: '#layer { marker-fill: #cc3300; }',
+                        cartocss_version: '2.3.0'
+                    }
+                },
+                {
+                    type: 'named',
+                    options: {
+                        name: templateName
+                    }
+                }
+            ]
+        };
+
+        Step(
+            function createLayergroup() {
+                var next = this;
+                assert.response(server,
+                    {
+                        url: '/tiles/layergroup',
+                        method: 'POST',
+                        headers: {
+                            host: 'localhost',
+                            'Content-Type': 'application/json'
+                        },
+                        data: JSON.stringify(layergroup)
+                    },
+                    {
+                        status: 403
+                    },
+                    function(res, err) {
+                        next(err, res);
+                    }
+                );
+            },
+            function checkLayergroup(err, response) {
+                if (err) {
+                    throw err;
+                }
+
+                var parsedBody = JSON.parse(response.body);
+                assert.ok(parsedBody.errors[0].match(/permission denied for relation test_table_private_1/));
+
+                return null;
+            },
+            function finish(err) {
+                done(err);
+            }
+        );
+
+    });
+
+
+    suiteTeardown(function(done) {
+        global.environment.enabledFeatures = {cdbQueryTablesFromPostgres: false};
+        templateMaps.delTemplate(username, nestedNamedMapTemplateName, function(err) {
+            if (err) {
+                return done(err);
+            }
+            templateMaps.delTemplate(username, tokenAuthTemplateName, function(err) {
+                if (err) {
+                    return done(err);
+                }
+                templateMaps.delTemplate(username, templateName, function(err) {
+                    return done(err);
+                });
+            });
+        });
+    });
+});

test/acceptance/server.js

@@ -20,10 +20,7 @@ server.setMaxListeners(0);
 
 [true, false].forEach(function(cdbQueryTablesFromPostgresEnabledValue) {
 
-global.environment.enabledFeatures = {cdbQueryTablesFromPostgres: cdbQueryTablesFromPostgresEnabledValue};
-
-suite('multilayer:postgres=' + cdbQueryTablesFromPostgresEnabledValue, function() {
-
+suite('server:postgres=' + cdbQueryTablesFromPostgresEnabledValue, function() {
 
     var redis_client = redis.createClient(global.environment.redis.port);
     var sqlapi_server;
@@ -47,8 +44,9 @@ suite('multilayer:postgres=' + cdbQueryTablesFromPostgresEnabledValue, function(
     // A couple of styles to use during testing
     var test_style_black_200 = "#test_table{marker-fill:black;marker-line-color:red;marker-width:10}";
     var test_style_black_210 = "#test_table{marker-fill:black;marker-line-color:red;marker-width:20}";
-    
+
     suiteSetup(function(done){
+      global.environment.enabledFeatures = { cdbQueryTablesFromPostgres: cdbQueryTablesFromPostgresEnabledValue };
       sqlapi_server = new SQLAPIEmu(global.environment.sqlapi.port, done);
     });
 
@@ -1152,10 +1150,12 @@ suite('multilayer:postgres=' + cdbQueryTablesFromPostgresEnabledValue, function(
             assert(cc, 'Missing X-Cache-Channel');
             var dbname = test_database;
             assert.equal(cc.substring(0, dbname.length), dbname);
-            var jsonquery = cc.substring(dbname.length+1);
-            var sentquery = JSON.parse(jsonquery);
-            assert.equal(sentquery.api_key, qo.map_key);
-            assert.equal(sentquery.q, 'SELECT CDB_QueryTables($windshaft$' + qo.sql + '$windshaft$)');
+            if (!cdbQueryTablesFromPostgresEnabledValue) { // only test if it was using the SQL API
+                var jsonquery = cc.substring(dbname.length + 1);
+                var sentquery = JSON.parse(jsonquery);
+                assert.equal(sentquery.api_key, qo.map_key);
+                assert.equal(sentquery.q, 'SELECT CDB_QueryTables($windshaft$' + qo.sql + '$windshaft$)');
+            }
             return null;
           },
           function finish(err) {
@@ -1164,6 +1164,7 @@ suite('multilayer:postgres=' + cdbQueryTablesFromPostgresEnabledValue, function(
         );
     });
 
+    if (!cdbQueryTablesFromPostgresEnabledValue) { // only test if it was a post if it's using the SQL API
     test("passes hostname header to sqlapi", function(done){
         var qo = {
           sql: "SELECT * from gadm4",
@@ -1195,7 +1196,9 @@ suite('multilayer:postgres=' + cdbQueryTablesFromPostgresEnabledValue, function(
           }
         );
     });
+    }
 
+    if (!cdbQueryTablesFromPostgresEnabledValue) { // only test if it was using the SQL API
     test("requests to skip cache on sqlapi error", function(done){
         var qo = {
           sql: "SELECT g.cartodb_id, g.codineprov, t.the_geom_webmercator "
@@ -1228,6 +1231,7 @@ suite('multilayer:postgres=' + cdbQueryTablesFromPostgresEnabledValue, function(
           }
         );
     });
+    }
 
     // Zoom is a special variable
     test("Specifying zoom level in CartoCSS does not need a 'zoom' variable in SQL output", function(done){

test/acceptance/templates.js

@@ -5,6 +5,7 @@ var querystring = require('querystring');
 var semver      = require('semver');
 var Step        = require('step');
 var strftime    = require('strftime');
+var NamedMapsCacheEntry = require(__dirname + '/../../lib/cartodb/cache/model/named_maps_entry');
 var SQLAPIEmu   = require(__dirname + '/../support/SQLAPIEmu.js');
 var redis_stats_db = 5;
 
@@ -26,9 +27,8 @@ server.setMaxListeners(0);
 
 [true, false].forEach(function(cdbQueryTablesFromPostgresEnabledValue) {
 
-global.environment.enabledFeatures = {cdbQueryTablesFromPostgres: cdbQueryTablesFromPostgresEnabledValue};
-
 suite('template_api:postgres=' + cdbQueryTablesFromPostgresEnabledValue, function() {
+    serverOptions.channelCache = {};
 
     var redis_client = redis.createClient(global.environment.redis.port);
     var sqlapi_server;
@@ -36,6 +36,7 @@ suite('template_api:postgres=' + cdbQueryTablesFromPostgresEnabledValue, functio
     var expected_last_updated = new Date(expected_last_updated_epoch).toISOString();
 
     suiteSetup(function(done){
+      global.environment.enabledFeatures = { cdbQueryTablesFromPostgres: cdbQueryTablesFromPostgresEnabledValue };
       sqlapi_server = new SQLAPIEmu(global.environment.sqlapi.port, done);
       // TODO: check redis is clean ?
     });
@@ -57,6 +58,29 @@ suite('template_api:postgres=' + cdbQueryTablesFromPostgresEnabledValue, functio
         }
     };
 
+    function makeTemplate(templateName) {
+        return {
+            version: '0.0.1',
+            name: templateName || 'acceptance1',
+            auth: { method: 'open' },
+            layergroup:  {
+                version: '1.0.0',
+                    layers: [
+                    { options: {
+                        sql: 'select cartodb_id, ST_Translate(the_geom_webmercator, -5e6, 0) as the_geom_webmercator from test_table limit 2 offset 2',
+                        cartocss: '#layer { marker-fill:blue; marker-allow-overlap:true; }',
+                        cartocss_version: '2.0.2',
+                        interactivity: 'cartodb_id'
+                    } }
+                ]
+            }
+        };
+    }
+
+    function extendDefaultsTemplate(template) {
+        return _.extend({}, template, {auth: {method: 'open'}, placeholders: {}});
+    }
+
     test("can add template, returning id", function(done) {
 
       var errors = [];
@@ -118,15 +142,12 @@ suite('template_api:postgres=' + cdbQueryTablesFromPostgresEnabledValue, functio
                 if ( m.match(/^map_(tpl|crt)|/) )
                   return m;
               });
-              if ( todrop.length != 2 ) {
+              if ( todrop.length !== 1 ) {
                 errors.push(new Error("Unexpected keys in redis: " + todrop));
               } else {
                 if ( todrop.indexOf('map_tpl|localhost') == -1 ) {
                   errors.push(new Error("Missing 'map_tpl|localhost' key in redis"));
                 }
-                if ( todrop.indexOf('map_crt|localhost') == -1 ) {
-                  errors.push(new Error("Missing 'map_crt|localhost' key in redis"));
-                }
               }
               redis_client.del(todrop, function(err) {
                 if ( err ) errors.push(err.message);
@@ -457,15 +478,12 @@ suite('template_api:postgres=' + cdbQueryTablesFromPostgresEnabledValue, functio
                 if ( m.match(/^map_(tpl|crt)|/) )
                   return m;
               });
-              if ( todrop.length != 2 ) {
+              if ( todrop.length !== 1 ) {
                 errors.push(new Error("Unexpected keys in redis: " + todrop));
               } else {
                 if ( todrop.indexOf('map_tpl|localhost') == -1 ) {
                   errors.push(new Error("Missing 'map_tpl|localhost' key in redis"));
                 }
-                if ( todrop.indexOf('map_crt|localhost') == -1 ) {
-                  errors.push(new Error("Missing 'map_crt|localhost' key in redis"));
-                }
               }
               redis_client.del(todrop, function(err) {
                 if ( err ) errors.push(err.message);
@@ -492,7 +510,7 @@ suite('template_api:postgres=' + cdbQueryTablesFromPostgresEnabledValue, functio
               url: '/tiles/template?api_key=1234',
               method: 'POST',
               headers: {host: 'localhost', 'Content-Type': 'application/json' },
-              data: JSON.stringify(template_acceptance1)
+              data: JSON.stringify(makeTemplate())
           }
           assert.response(server, post_request, {},
             function(res) { next(null, res); });
@@ -530,7 +548,7 @@ suite('template_api:postgres=' + cdbQueryTablesFromPostgresEnabledValue, functio
               url: '/tiles/template/unexistent/?api_key=1234',
               method: 'PUT',
               headers: {host: 'localhost', 'Content-Type': 'application/json' },
-              data: JSON.stringify(template_acceptance1)
+              data: JSON.stringify(makeTemplate())
           }
           var next = this;
           assert.response(server, put_request, {},
@@ -548,7 +566,7 @@ suite('template_api:postgres=' + cdbQueryTablesFromPostgresEnabledValue, functio
               url: '/tiles/template/' + tpl_id + '/?api_key=1234',
               method: 'PUT',
               headers: {host: 'localhost', 'Content-Type': 'application/json' },
-              data: JSON.stringify(template_acceptance1)
+              data: JSON.stringify(makeTemplate())
           }
           var next = this;
           assert.response(server, put_request, {},
@@ -572,15 +590,12 @@ suite('template_api:postgres=' + cdbQueryTablesFromPostgresEnabledValue, functio
                 if ( m.match(/^map_(tpl|crt)|/) )
                   return m;
               });
-              if ( todrop.length != 2 ) {
+              if ( todrop.length !== 1 ) {
                 errors.push(new Error("Unexpected keys in redis: " + todrop));
               } else {
                 if ( todrop.indexOf('map_tpl|localhost') == -1 ) {
                   errors.push(new Error("Missing 'map_tpl|localhost' key in redis"));
                 }
-                if ( todrop.indexOf('map_crt|localhost') == -1 ) {
-                  errors.push(new Error("Missing 'map_crt|localhost' key in redis"));
-                }
               }
               redis_client.del(todrop, function(err) {
                 if ( err ) errors.push(err.message);
@@ -607,7 +622,7 @@ suite('template_api:postgres=' + cdbQueryTablesFromPostgresEnabledValue, functio
               url: '/tiles/template?api_key=1234',
               method: 'POST',
               headers: {host: 'localhost', 'Content-Type': 'application/json' },
-              data: JSON.stringify(template_acceptance1)
+              data: JSON.stringify(makeTemplate())
           }
           assert.response(server, post_request, {},
             function(res) { next(null, res); });
@@ -653,7 +668,7 @@ suite('template_api:postgres=' + cdbQueryTablesFromPostgresEnabledValue, functio
           var parsed = JSON.parse(res.body);
           assert.ok(parsed.hasOwnProperty('template'),
             "Missing 'template' from response body: " + res.body);
-          assert.deepEqual(template_acceptance1, parsed.template);
+          assert.deepEqual(extendDefaultsTemplate(makeTemplate()), parsed.template);
           return null;
         },
         function finish(err) {
@@ -664,15 +679,12 @@ suite('template_api:postgres=' + cdbQueryTablesFromPostgresEnabledValue, functio
                 if ( m.match(/^map_(tpl|crt)|/) )
                   return m;
               });
-              if ( todrop.length != 2 ) {
+              if ( todrop.length !== 1 ) {
                 errors.push(new Error("Unexpected keys in redis: " + todrop));
               } else {
                 if ( todrop.indexOf('map_tpl|localhost') == -1 ) {
                   errors.push(new Error("Missing 'map_tpl|localhost' key in redis"));
                 }
-                if ( todrop.indexOf('map_crt|localhost') == -1 ) {
-                  errors.push(new Error("Missing 'map_crt|localhost' key in redis"));
-                }
               }
               redis_client.del(todrop, function(err) {
                 if ( err ) errors.push(err.message);
@@ -699,7 +711,7 @@ suite('template_api:postgres=' + cdbQueryTablesFromPostgresEnabledValue, functio
               url: '/tiles/template?api_key=1234',
               method: 'POST',
               headers: {host: 'localhost', 'Content-Type': 'application/json' },
-              data: JSON.stringify(template_acceptance1)
+              data: JSON.stringify(makeTemplate())
           }
           assert.response(server, post_request, {},
             function(res) { next(null, res); });
@@ -728,7 +740,7 @@ suite('template_api:postgres=' + cdbQueryTablesFromPostgresEnabledValue, functio
           var parsed = JSON.parse(res.body);
           assert.ok(parsed.hasOwnProperty('template'),
             "Missing 'template' from response body: " + res.body);
-          assert.deepEqual(template_acceptance1, parsed.template);
+          assert.deepEqual(extendDefaultsTemplate(makeTemplate()), parsed.template);
           var del_request = {
               url: '/tiles/template/' + tpl_id,
               method: 'DELETE',
@@ -1011,16 +1023,10 @@ suite('template_api:postgres=' + cdbQueryTablesFromPostgresEnabledValue, functio
           assert.response(server, get_request, {},
             function(res) { next(null, res); });
         },
-        function checkTileDeleted(err, res) {
+        function checkTileAvailable(err, res) {
           if ( err ) throw err;
-          assert.equal(res.statusCode, 403,
-            'Unexpected statusCode fetch tile after signature revokal: '
-            + res.statusCode + ':' + res.body); 
-          var parsed = JSON.parse(res.body);
-          assert.ok(parsed.hasOwnProperty('error'),
-            "Missing 'error' from response body: " + res.body);
-          assert.ok(parsed.error.match(/permission denied/i),
-            'Unexpected error for unauthorized access : ' + parsed.error);
+          assert.equal(res.statusCode, 200, 'Tile should be accessible');
+          assert.equal(res.headers['content-type'], "image/png");
           return null;
         },
         function finish(err) {
@@ -1230,16 +1236,10 @@ suite('template_api:postgres=' + cdbQueryTablesFromPostgresEnabledValue, functio
           assert.response(server, get_request, {},
             function(res) { next(null, res); });
         },
-        function checkTileDeleted(err, res) {
+        function checkTorqueTileAvailable(err, res) {
           if ( err ) throw err;
-          assert.equal(res.statusCode, 403,
-            'Unexpected statusCode fetch tile after signature revokal: '
-            + res.statusCode + ':' + res.body); 
-          var parsed = JSON.parse(res.body);
-          assert.ok(parsed.hasOwnProperty('error'),
-            "Missing 'error' from response body: " + res.body);
-          assert.ok(parsed.error.match(/permission denied/i),
-            'Unexpected error for unauthorized access : ' + parsed.error);
+          assert.equal(res.statusCode, 200, 'Torque tile should be accessible');
+          assert.equal(res.headers['content-type'], "application/json; charset=utf-8");
           return null;
         },
         function finish(err) {
@@ -1426,16 +1426,10 @@ suite('template_api:postgres=' + cdbQueryTablesFromPostgresEnabledValue, functio
           assert.response(server, get_request, {},
             function(res) { next(null, res); });
         },
-        function checkTileDeleted(err, res) {
+        function checkLayerAttributesAvailable(err, res) {
           if ( err ) throw err;
-          assert.equal(res.statusCode, 403, 
-            'Unexpected statusCode fetch tile after signature revokal: '
-            + res.statusCode + ':' + res.body); 
-          var parsed = JSON.parse(res.body);
-          assert.ok(parsed.hasOwnProperty('error'),
-            "Missing 'error' from response body: " + res.body);
-          assert.ok(parsed.error.match(/permission denied/i),
-            'Unexpected error for unauthorized access : ' + parsed.error);
+          assert.equal(res.statusCode, 200, 'Layer attributes should be accessible');
+          assert.equal(res.headers['content-type'], "application/json; charset=utf-8");
           return null;
         },
         function finish(err) {
@@ -1597,6 +1591,7 @@ suite('template_api:postgres=' + cdbQueryTablesFromPostgresEnabledValue, functio
           assert.equal(res.statusCode, 200, res.statusCode + ': ' + res.body);
           // See https://github.com/CartoDB/Windshaft-cartodb/issues/176
           helper.checkCache(res);
+          helper.checkSurrogateKey(res, new NamedMapsCacheEntry('localhost', template_acceptance_open.name).key());
           return null;
         },
         function finish(err) {
@@ -1612,10 +1607,9 @@ suite('template_api:postgres=' + cdbQueryTablesFromPostgresEnabledValue, functio
           version: '0.0.1',
           name: 'acceptance_open_jsonp_params',
           auth: { method: 'open' },
-          /*
           placeholders: {
             color: { type: "css_color", default: "red" }
-          },*/
+          },
           layergroup:  {
             version: '1.0.0',
             layers: [
@@ -1668,9 +1662,11 @@ suite('template_api:postgres=' + cdbQueryTablesFromPostgresEnabledValue, functio
         function checkInstanciation(err, res)
         {
           if ( err ) throw err;
+            console.log(err, res.body, res.headers);
           assert.equal(res.statusCode, 200, res.statusCode + ': ' + res.body);
           // See https://github.com/CartoDB/Windshaft-cartodb/issues/176
-          helper.checkNoCache(res);
+          helper.checkCache(res);
+          helper.checkSurrogateKey(res, new NamedMapsCacheEntry('localhost', template_acceptance_open.name).key());
           return null;
         },
         function finish(err) {
@@ -1852,6 +1848,7 @@ suite('template_api:postgres=' + cdbQueryTablesFromPostgresEnabledValue, functio
           assert.ok(parsed.hasOwnProperty('layergroupid'),
             "Missing 'layergroupid' from response body: " + res.body);
           layergroupid = parsed.layergroupid;
+          helper.checkSurrogateKey(res, new NamedMapsCacheEntry('localhost', template_acceptance2.name).key());
           return null;
         },
         function updateTemplate(err, res)
@@ -1896,6 +1893,7 @@ suite('template_api:postgres=' + cdbQueryTablesFromPostgresEnabledValue, functio
           assert.ok(parsed.hasOwnProperty('layergroupid'),
             "Missing 'layergroupid' from response body: " + res.body);
           assert.ok(layergroupid != parsed.layergroupid);
+          helper.checkSurrogateKey(res, new NamedMapsCacheEntry('localhost', template_acceptance2.name).key());
           return null;
         },
         function finish(err) {
@@ -1906,15 +1904,12 @@ suite('template_api:postgres=' + cdbQueryTablesFromPostgresEnabledValue, functio
                 if ( m.match(/^map_(tpl|crt)|/) )
                   return m;
               });
-              if ( todrop.length != 2 ) {
+              if ( todrop.length !== 1 ) {
                 errors.push(new Error("Unexpected keys in redis: " + todrop));
               } else {
                 if ( todrop.indexOf('map_tpl|localhost') == -1 ) {
                   errors.push(new Error("Missing 'map_tpl|localhost' key in redis"));
                 }
-                if ( todrop.indexOf('map_crt|localhost') == -1 ) {
-                  errors.push(new Error("Missing 'map_crt|localhost' key in redis"));
-                }
               }
               redis_client.del(todrop, function(err) {
                 if ( err ) errors.push(err.message);
@@ -1928,6 +1923,182 @@ suite('template_api:postgres=' + cdbQueryTablesFromPostgresEnabledValue, functio
       );
     });
 
+
+    test("can use an http layer", function(done) {
+
+        var username = 'localhost';
+
+        var httpTemplateName = 'acceptance_http';
+        var httpTemplate =  {
+            version: '0.0.1',
+            name: httpTemplateName,
+            layergroup:  {
+                version: '1.3.0',
+                layers: [
+                    {
+                        type: "http",
+                        options: {
+                            urlTemplate: "http://{s}.basemaps.cartocdn.com/dark_nolabels/{z}/{x}/{y}.png",
+                            subdomains: [
+                                "a",
+                                "b",
+                                "c"
+                            ]
+                        }
+                    },
+                    {
+                        type: 'cartodb',
+                        options: {
+                            sql: "select * from test_table_private_1",
+                            cartocss: '#layer { marker-fill:blue; }',
+                            cartocss_version: '2.0.2',
+                            interactivity: 'cartodb_id'
+                        }
+                    }
+                ]
+            }
+        };
+
+        var template_params = {};
+
+        var errors = [];
+        var expectedTemplateId = username + '@' + httpTemplateName;
+        var layergroupid;
+        Step(
+            function createTemplate()
+            {
+                var next = this;
+                assert.response(
+                    server,
+                    {
+                        url: '/tiles/template?api_key=1234',
+                        method: 'POST',
+                        headers: {
+                            host: username,
+                            'Content-Type': 'application/json'
+                        },
+                        data: JSON.stringify(httpTemplate)
+                    },
+                    {
+                        status: 200
+                    },
+                    function(res, err) {
+                        next(err, res);
+                    }
+                );
+            },
+            function instantiateTemplate(err, res) {
+                if (err) {
+                    throw err;
+                }
+                assert.deepEqual(JSON.parse(res.body), { template_id: expectedTemplateId });
+                var next = this;
+                assert.response(
+                    server,
+                    {
+                        url: '/tiles/template/' + expectedTemplateId,
+                        method: 'POST',
+                        headers: {
+                            host: username,
+                            'Content-Type': 'application/json'
+                        },
+                        data: JSON.stringify(template_params)
+                    },
+                    {
+                        status: 200
+                    },
+                    function(res) {
+                        next(null, res);
+                    }
+                );
+            },
+            function fetchTile(err, res) {
+                if (err) {
+                    throw err;
+                }
+
+                var parsed = JSON.parse(res.body);
+                assert.ok(parsed.hasOwnProperty('layergroupid'), "Missing 'layergroupid' from response body: " + res.body);
+                layergroupid = parsed.layergroupid;
+
+                var next = this;
+                assert.response(
+                    server,
+                    {
+                        url: '/tiles/layergroup/' + layergroupid + '/all/0/0/0.png',
+                        method: 'GET',
+                        headers: {
+                            host: username
+                        },
+                        encoding: 'binary'
+                    },
+                    {
+                        status: 200
+                    },
+                    function(res) {
+                        next(null, res);
+                    }
+                );
+            },
+            function checkTile(err, res) {
+                if (err) {
+                    throw err;
+                }
+                assert.equal(res.headers['content-type'], "image/png");
+                return null;
+            },
+            function deleteTemplate(err) {
+                if (err) {
+                    throw err;
+                }
+                var next = this;
+                assert.response(
+                    server,
+                    {
+                        url: '/tiles/template/' + expectedTemplateId + '?api_key=1234',
+                        method: 'DELETE',
+                        headers: {
+                            host: username
+                        }
+                    },
+                    {
+                        status: 204
+                    },
+                    function(res, err) {
+                        next(err, res);
+                    }
+                );
+            },
+            function finish(err) {
+                if (err) {
+                    errors.push(err);
+                }
+                redis_client.keys("map_*|localhost", function(err, keys) {
+                    if ( err ) errors.push(err.message);
+                    var todrop = _.map(keys, function(m) {
+                        if ( m.match(/^map_(tpl|crt)|/) )
+                            return m;
+                    });
+                    if ( todrop.length ) {
+                        errors.push(new Error("Unexpected keys in redis: " + todrop));
+                        redis_client.del(todrop, function(err) {
+                            if ( err ) errors.push(err.message);
+                            if ( errors.length ) {
+                                done(new Error(errors));
+                            }
+                            else done(null);
+                        });
+                    } else {
+                        if ( errors.length ) {
+                            done(new Error(errors));
+                        }
+                        else done(null);
+                    }
+                });
+            }
+        );
+    });
+
     suiteTeardown(function(done) {
 
         // This test will add map_style records, like

test/integration/mapconfig_named_layers_datasource.js

@@ -0,0 +1,298 @@
+var test_helper = require('../support/test_helper');
+
+var assert = require('assert');
+var RedisPool = require('redis-mpool');
+var TemplateMaps = require('../../lib/cartodb/template_maps.js');
+var PgConnection = require(__dirname + '/../../lib/cartodb/backends/pg_connection');
+var MapConfigNamedLayersAdapter = require('../../lib/cartodb/models/mapconfig_named_layers_adapter');
+
+var Step = require('step');
+var _ = require('underscore');
+
+// configure redis pool instance to use in tests
+var redisPool = RedisPool(global.environment.redis);
+var pgConnection = new PgConnection(require('cartodb-redis')({ pool: redisPool }));
+
+var templateMaps = new TemplateMaps(redisPool, {
+    max_user_templates: global.environment.maxUserTemplates
+});
+
+var mapConfigNamedLayersAdapter = new MapConfigNamedLayersAdapter(templateMaps);
+
+var wadusSql = 'select 1 wadusLayer, null::geometry the_geom_webmercator';
+var wadusLayer = {
+    type: 'cartodb',
+    options: {
+        sql: wadusSql,
+        cartocss: '#layer { marker-fill: black; }',
+        cartocss_version: '2.3.0'
+    }
+};
+
+var wadusTemplateSql = 'select 1 wadusTemplateLayer, null::geometry the_geom_webmercator';
+var wadusTemplateLayer = {
+    type: 'cartodb',
+    options: {
+        sql: wadusTemplateSql,
+        cartocss: '#layer { marker-fill: <%= color %>; }',
+        cartocss_version: '2.3.0'
+    }
+};
+
+var wadusMapnikSql = 'select 1 wadusMapnikLayer, null::geometry the_geom_webmercator';
+var wadusMapnikLayer = {
+    type: 'mapnik',
+    options: {
+        sql: wadusMapnikSql,
+        cartocss: '#layer { polygon-fill: <%= polygon_color %>; }',
+        cartocss_version: '2.3.0'
+    }
+};
+
+var username = 'localhost';
+
+var templateName = 'valid_template';
+var template = {
+    version: '0.0.1',
+    name: templateName,
+    auth: {
+        method: 'open'
+    },
+    "placeholders": {
+        "color": {
+            "type": "css_color",
+            "default": "#cc3300"
+        }
+    },
+    layergroup: {
+        layers: [
+            wadusTemplateLayer
+        ]
+    }
+};
+
+var multipleLayersTemplateName = 'multiple_valid_template';
+var multipleLayersTemplate = {
+    version: '0.0.1',
+    name: multipleLayersTemplateName,
+    auth: {
+        method: 'token',
+        valid_tokens: ['valid1', 'valid2']
+    },
+    "placeholders": {
+        "polygon_color": {
+            "type": "css_color",
+            "default": "green"
+        },
+        "color": {
+            "type": "css_color",
+            "default": "red"
+        }
+    },
+    layergroup: {
+        layers: [
+            wadusMapnikLayer,
+            wadusTemplateLayer
+        ]
+    }
+};
+
+suite('named_layers datasources', function() {
+    suiteSetup(function(done) {
+        templateMaps.addTemplate(username, template, function(err) {
+            if (err) {
+                return done(err);
+            }
+            templateMaps.addTemplate(username, multipleLayersTemplate, done);
+        });
+    });
+
+    function makeNamedMapLayerConfig(layers) {
+        return {
+            version: '1.3.0',
+            layers: layers
+        };
+    }
+
+    var simpleNamedLayer = {
+        type: 'named',
+        options: {
+            name: templateName
+        }
+    };
+
+    var multipleLayersNamedLayer = {
+        type: 'named',
+        options: {
+            name: multipleLayersTemplateName,
+            auth_tokens: ['valid2']
+        }
+    };
+
+    var testScenarios = [
+        {
+            desc: 'without datasource for non-named layers',
+            config: makeNamedMapLayerConfig([wadusLayer]),
+            test: function(err, layers, datasource, done) {
+                assert.ok(!err);
+                assert.equal(layers.length, 1);
+
+                assert.equal(layers[0].type, 'cartodb');
+                assert.equal(layers[0].options.sql, wadusSql);
+                assert.equal(datasource.getLayerDatasource(0), undefined);
+
+                done();
+            }
+        },
+
+        {
+            desc: 'with datasource for the named layer but not for the normal',
+            config: makeNamedMapLayerConfig([wadusLayer, simpleNamedLayer]),
+            test: function(err, layers, datasource, done) {
+                assert.ok(!err);
+                assert.equal(layers.length, 2);
+
+                assert.equal(layers[0].type, 'cartodb');
+                assert.equal(layers[0].options.sql, wadusSql);
+                assert.equal(datasource.getLayerDatasource(0), undefined);
+
+                assert.equal(layers[1].type, 'cartodb');
+                assert.equal(layers[1].options.sql, wadusTemplateSql);
+                var layerDatasource = datasource.getLayerDatasource(1);
+                assert.notEqual(layerDatasource, undefined);
+                assert.ok(layerDatasource.user);
+
+                done();
+            }
+        },
+
+        {
+            desc: 'with datasource for the multiple layers in the named but not for the normal',
+            config: makeNamedMapLayerConfig([wadusLayer, multipleLayersNamedLayer]),
+            test: function(err, layers, datasource, done) {
+                assert.ok(!err);
+                assert.equal(layers.length, 3);
+
+                assert.equal(layers[0].type, 'cartodb');
+                assert.equal(layers[0].options.sql, wadusSql);
+                assert.equal(datasource.getLayerDatasource(0), undefined);
+
+                assert.equal(layers[1].type, 'mapnik');
+                assert.equal(layers[1].options.sql, wadusMapnikSql);
+                var layerDatasource = datasource.getLayerDatasource(1);
+                assert.notEqual(layerDatasource, undefined);
+                assert.ok(layerDatasource.user);
+
+                assert.equal(layers[2].type, 'cartodb');
+                assert.equal(layers[2].options.sql, wadusTemplateSql);
+                layerDatasource = datasource.getLayerDatasource(2);
+                assert.notEqual(layerDatasource, undefined);
+                assert.ok(layerDatasource.user);
+
+                done();
+            }
+        },
+
+        {
+            desc: 'all with datasource because all are named',
+            config: makeNamedMapLayerConfig([multipleLayersNamedLayer, simpleNamedLayer]),
+            test: function(err, layers, datasource, done) {
+                assert.ok(!err);
+                assert.equal(layers.length, 3);
+
+                assert.equal(layers[0].type, 'mapnik');
+                assert.equal(layers[0].options.sql, wadusMapnikSql);
+                var layerDatasource = datasource.getLayerDatasource(0);
+                assert.notEqual(layerDatasource, undefined);
+                assert.ok(layerDatasource.user);
+
+                assert.equal(layers[1].type, 'cartodb');
+                assert.equal(layers[1].options.sql, wadusTemplateSql);
+                layerDatasource = datasource.getLayerDatasource(1);
+                assert.notEqual(layerDatasource, undefined);
+                assert.ok(layerDatasource.user);
+
+                assert.equal(layers[2].type, 'cartodb');
+                assert.equal(layers[2].options.sql, wadusTemplateSql);
+                layerDatasource = datasource.getLayerDatasource(2);
+                assert.notEqual(layerDatasource, undefined);
+                assert.ok(layerDatasource.user);
+
+                done();
+            }
+        },
+
+        {
+            desc: 'with a mix of datasource and no datasource depending if layers are named or not',
+            config: makeNamedMapLayerConfig([simpleNamedLayer, multipleLayersNamedLayer, wadusLayer, simpleNamedLayer, wadusLayer, multipleLayersNamedLayer]),
+            test: function(err, layers, datasource, done) {
+
+                assert.ok(!err);
+                assert.equal(layers.length, 8);
+
+                assert.equal(layers[0].type, 'cartodb');
+                assert.equal(layers[0].options.sql, wadusTemplateSql);
+                var layerDatasource = datasource.getLayerDatasource(0);
+                assert.notEqual(layerDatasource, undefined);
+                assert.ok(layerDatasource.user);
+
+                assert.equal(layers[1].type, 'mapnik');
+                assert.equal(layers[1].options.sql, wadusMapnikSql);
+                layerDatasource = datasource.getLayerDatasource(1);
+                assert.notEqual(layerDatasource, undefined);
+                assert.ok(layerDatasource.user);
+
+                assert.equal(layers[2].type, 'cartodb');
+                assert.equal(layers[2].options.sql, wadusTemplateSql);
+                layerDatasource = datasource.getLayerDatasource(2);
+                assert.notEqual(layerDatasource, undefined);
+                assert.ok(layerDatasource.user);
+
+                assert.equal(layers[3].type, 'cartodb');
+                assert.equal(layers[3].options.sql, wadusSql);
+                assert.equal(datasource.getLayerDatasource(3), undefined);
+
+                assert.equal(layers[4].type, 'cartodb');
+                assert.equal(layers[4].options.sql, wadusTemplateSql);
+                layerDatasource = datasource.getLayerDatasource(4);
+                assert.notEqual(layerDatasource, undefined);
+                assert.ok(layerDatasource.user);
+
+                assert.equal(layers[5].type, 'cartodb');
+                assert.equal(layers[5].options.sql, wadusSql);
+                assert.equal(datasource.getLayerDatasource(5), undefined);
+
+                assert.equal(layers[6].type, 'mapnik');
+                assert.equal(layers[6].options.sql, wadusMapnikSql);
+                layerDatasource = datasource.getLayerDatasource(6);
+                assert.notEqual(layerDatasource, undefined);
+                assert.ok(layerDatasource.user);
+
+                assert.equal(layers[7].type, 'cartodb');
+                assert.equal(layers[7].options.sql, wadusTemplateSql);
+                layerDatasource = datasource.getLayerDatasource(7);
+                assert.notEqual(layerDatasource, undefined);
+                assert.ok(layerDatasource.user);
+
+                done();
+            }
+        }
+    ];
+
+    testScenarios.forEach(function(testScenario) {
+        test('should return a list of layers ' + testScenario.desc, function(done) {
+            mapConfigNamedLayersAdapter.getLayers(username, testScenario.config.layers, pgConnection, function(err, layers, datasource) {
+                testScenario.test(err, layers, datasource, done);
+            });
+        });
+    });
+
+    suiteTeardown(function(done) {
+        templateMaps.delTemplate(username, templateName, function(err) {
+            if (err) {
+                return done(err);
+            }
+            templateMaps.delTemplate(username, multipleLayersTemplateName, done);
+        });
+    });
+});

test/integration/mapconfig_named_layers_expanded.js

@@ -0,0 +1,312 @@
+var testHelper = require('../support/test_helper');
+
+var assert = require('assert');
+var RedisPool = require('redis-mpool');
+var TemplateMaps = require('../../lib/cartodb/template_maps.js');
+var PgConnection = require(__dirname + '/../../lib/cartodb/backends/pg_connection');
+var MapConfigNamedLayersAdapter = require('../../lib/cartodb/models/mapconfig_named_layers_adapter');
+
+var Step = require('step');
+var _ = require('underscore');
+
+suite('mapconfig_named_layers_adapter', function() {
+
+    // configure redis pool instance to use in tests
+    var redisPool = RedisPool(global.environment.redis);
+    var pgConnection = new PgConnection(require('cartodb-redis')({ pool: redisPool }));
+
+    var templateMaps = new TemplateMaps(redisPool, {
+        max_user_templates: global.environment.maxUserTemplates
+    });
+
+    var mapConfigNamedLayersAdapter = new MapConfigNamedLayersAdapter(templateMaps);
+
+    var wadusLayer = {
+        type: 'cartodb',
+        options: {
+            sql: 'select 1 cartodb_id, null::geometry the_geom_webmercator',
+            cartocss: '#layer { marker-fill: <%= color %>; }',
+            cartocss_version: '2.3.0'
+        }
+    };
+
+    var wadusMapnikLayer = {
+        type: 'mapnik',
+        options: {
+            sql: 'select 1 cartodb_id, null::geometry the_geom_webmercator',
+            cartocss: '#layer { polygon-fill: <%= polygon_color %>; }',
+            cartocss_version: '2.3.0'
+        }
+    };
+
+    var username = 'localhost';
+
+    var templateName = 'valid_template';
+    var template = {
+        version: '0.0.1',
+        name: templateName,
+        auth: {
+            method: 'open'
+        },
+        "placeholders": {
+            "color": {
+                "type": "css_color",
+                "default": "#cc3300"
+            }
+        },
+        layergroup: {
+            layers: [
+                wadusLayer
+            ]
+        }
+    };
+
+    var tokenAuthTemplateName = 'auth_valid_template';
+    var tokenAuthTemplate = {
+        version: '0.0.1',
+        name: tokenAuthTemplateName,
+        auth: {
+            method: 'token',
+            valid_tokens: ['valid1', 'valid2']
+        },
+        layergroup: {
+            layers: [
+                wadusLayer
+            ]
+        }
+    };
+
+    var multipleLayersTemplateName = 'multiple_valid_template';
+    var multipleLayersTemplate = {
+        version: '0.0.1',
+        name: multipleLayersTemplateName,
+        auth: {
+            method: 'token',
+            valid_tokens: ['valid1', 'valid2']
+        },
+        "placeholders": {
+            "polygon_color": {
+                "type": "css_color",
+                "default": "green"
+            },
+            "color": {
+                "type": "css_color",
+                "default": "red"
+            }
+        },
+        layergroup: {
+            layers: [
+                wadusMapnikLayer,
+                wadusLayer
+            ]
+        }
+    };
+
+    var namedMapLayer = {
+        type: 'named',
+        options: {
+            name: templateName,
+            config: {},
+            auth_tokens: []
+        }
+    };
+
+    var nestedNamedMapTemplateName = 'nested_template';
+    var nestedNamedMapTemplate = {
+        version: '0.0.1',
+        name: nestedNamedMapTemplateName,
+        auth: {
+            method: 'open'
+        },
+        layergroup: {
+            layers: [
+                namedMapLayer
+            ]
+        }
+    };
+
+    function makeNamedMapLayerConfig(options) {
+        return {
+            version: '1.3.0',
+            layers: [
+                {
+                    type: 'named',
+                    options: options
+                }
+            ]
+        };
+    }
+
+
+    suiteSetup(function(done) {
+        templateMaps.addTemplate(username, template, done);
+    });
+
+    test('should fail for named map layer with missing name', function(done) {
+        var missingNamedMapLayerConfig = makeNamedMapLayerConfig({
+            config: {}
+        });
+        mapConfigNamedLayersAdapter.getLayers(username, missingNamedMapLayerConfig.layers, pgConnection, function(err, layers, datasource) {
+            assert.ok(err);
+            assert.ok(!layers);
+            assert.ok(!datasource);
+            assert.equal(err.message, 'Missing Named Map `name` in layer options');
+
+            done();
+        });
+    });
+
+    test('should fail for non-existing template name', function(done) {
+        var missingTemplateName = 'wadus';
+        var nonExistentNamedMapLayerConfig = makeNamedMapLayerConfig({
+            name: missingTemplateName
+        });
+        mapConfigNamedLayersAdapter.getLayers(username, nonExistentNamedMapLayerConfig.layers, pgConnection, function(err, layers, datasource) {
+            assert.ok(err);
+            assert.ok(!layers);
+            assert.ok(!datasource);
+            assert.equal(err.message, "Template '" + missingTemplateName + "' of user '" + username + "' not found");
+
+            done();
+        });
+    });
+
+    test('should fail if not properly authorized', function(done) {
+        templateMaps.addTemplate(username, tokenAuthTemplate, function(err) {
+            if (err) {
+                return done(err);
+            }
+
+            var nonAuthTokensNamedMapLayerConfig = makeNamedMapLayerConfig({
+                name: tokenAuthTemplateName
+            });
+            mapConfigNamedLayersAdapter.getLayers(username, nonAuthTokensNamedMapLayerConfig.layers, pgConnection, function(err, layers, datasource) {
+                assert.ok(err);
+                assert.ok(!layers);
+                assert.ok(!datasource);
+                assert.equal(err.message, "Unauthorized '" + tokenAuthTemplateName + "' template instantiation");
+
+                templateMaps.delTemplate(username, tokenAuthTemplateName, done);
+            });
+        });
+    });
+
+    test('should fail for nested named map layers', function(done) {
+        templateMaps.addTemplate(username, nestedNamedMapTemplate, function(err) {
+            if (err) {
+                return done(err);
+            }
+
+            var nestedNamedMapLayerConfig = makeNamedMapLayerConfig({
+                name: nestedNamedMapTemplateName
+            });
+            mapConfigNamedLayersAdapter.getLayers(username, nestedNamedMapLayerConfig.layers, pgConnection, function(err, layers, datasource) {
+                assert.ok(err);
+                assert.ok(!layers);
+                assert.ok(!datasource);
+                assert.equal(err.message, 'Nested named layers are not allowed');
+
+                templateMaps.delTemplate(username, nestedNamedMapTemplateName, done);
+            });
+        });
+    });
+
+    test('should return an expanded list of layers for a named map layer', function(done) {
+        var validNamedMapMapLayerConfig = makeNamedMapLayerConfig({
+            name: templateName
+        });
+        mapConfigNamedLayersAdapter.getLayers(username, validNamedMapMapLayerConfig.layers, pgConnection, function(err, layers, datasource) {
+            assert.ok(!err);
+            assert.ok(layers.length, 1);
+            assert.ok(layers[0].type, 'cartodb');
+            assert.notEqual(datasource.getLayerDatasource(0), undefined);
+
+            done();
+        });
+    });
+
+    test('should return on auth=token with valid tokens provided', function(done) {
+        templateMaps.addTemplate(username, tokenAuthTemplate, function(err) {
+            if (err) {
+                return done(err);
+            }
+
+            var validAuthTokensNamedMapLayerConfig = makeNamedMapLayerConfig({
+                name: tokenAuthTemplateName,
+                auth_tokens: ['valid1']
+            });
+            mapConfigNamedLayersAdapter.getLayers(username, validAuthTokensNamedMapLayerConfig.layers, pgConnection, function(err, layers, datasource) {
+                assert.ok(!err);
+                assert.equal(layers.length, 1);
+                assert.notEqual(datasource.getLayerDatasource(0), undefined);
+
+                templateMaps.delTemplate(username, tokenAuthTemplateName, done);
+            });
+        });
+    });
+
+    test('should return an expanded list of layers for a named map layer, multiple layers version', function(done) {
+        templateMaps.addTemplate(username, multipleLayersTemplate, function(err) {
+            if (err) {
+                return done(err);
+            }
+
+            var multipleLayersNamedMapLayerConfig = makeNamedMapLayerConfig({
+                name: multipleLayersTemplateName,
+                auth_tokens: ['valid2']
+            });
+            mapConfigNamedLayersAdapter.getLayers(username, multipleLayersNamedMapLayerConfig.layers, pgConnection, function(err, layers, datasource) {
+                assert.ok(!err);
+                assert.equal(layers.length, 2);
+
+                assert.equal(layers[0].type, 'mapnik');
+                assert.equal(layers[0].options.cartocss, '#layer { polygon-fill: green; }');
+                assert.notEqual(datasource.getLayerDatasource(0), undefined);
+
+                assert.equal(layers[1].type, 'cartodb');
+                assert.equal(layers[1].options.cartocss, '#layer { marker-fill: red; }');
+                assert.notEqual(datasource.getLayerDatasource(1), undefined);
+
+                templateMaps.delTemplate(username, multipleLayersTemplateName, done);
+            });
+        });
+    });
+
+    test('should replace template params with the given config', function(done) {
+        templateMaps.addTemplate(username, multipleLayersTemplate, function(err) {
+            if (err) {
+                return done(err);
+            }
+
+            var color = '#cc3300',
+                polygonColor = '#ff9900';
+
+            var multipleLayersNamedMapLayerConfig = makeNamedMapLayerConfig({
+                name: multipleLayersTemplateName,
+                config: {
+                    polygon_color: polygonColor,
+                    color: color
+                },
+                auth_tokens: ['valid2']
+            });
+            mapConfigNamedLayersAdapter.getLayers(username, multipleLayersNamedMapLayerConfig.layers, pgConnection, function(err, layers, datasource) {
+                assert.ok(!err);
+                assert.equal(layers.length, 2);
+
+                assert.equal(layers[0].type, 'mapnik');
+                assert.equal(layers[0].options.cartocss, '#layer { polygon-fill: ' + polygonColor + '; }');
+                assert.notEqual(datasource.getLayerDatasource(0), undefined);
+
+                assert.equal(layers[1].type, 'cartodb');
+                assert.equal(layers[1].options.cartocss, '#layer { marker-fill: ' + color + '; }');
+                assert.notEqual(datasource.getLayerDatasource(1), undefined);
+
+                templateMaps.delTemplate(username, multipleLayersTemplateName, done);
+            });
+        });
+    });
+
+    suiteTeardown(function(done) {
+        templateMaps.delTemplate(username, templateName, done);
+    });
+});

test/support/assert.js

@@ -246,9 +246,10 @@ assert.response = function(server, req, res, msg){
                     assert.equal(
                         response.statusCode,
                         status,
-                        msg + 'Invalid response status code.\n'
+                        msg + colorize('Invalid response status code.\n'
                             + '    Expected: [green]{' + status + '}\n'
-                            + '    Got: [red]{' + response.statusCode + '}'
+                            + '    Got: [red]{' + response.statusCode + '}\n'
+                            + '    Response body: ' + response.body)
                     );
                 }
 
@@ -280,3 +281,16 @@ assert.response = function(server, req, res, msg){
       }
 };
 
+/**
+ * Colorize the given string using ansi-escape sequences.
+ * Disabled when --boring is set.
+ *
+ * @param {String} str
+ * @return {String}
+ */
+function colorize(str) {
+    var colors = { bold: 1, red: 31, green: 32, yellow: 33 };
+    return str.replace(/\[(\w+)\]\{([^]*?)\}/g, function(_, color, str) {
+        return '\x1B[' + colors[color] + 'm' + str + '\x1B[0m';
+    });
+}

test/support/prepare_db.sh

@@ -78,6 +78,12 @@ if test x"$PREPARE_PGSQL" = xyes; then
     sed "s/:TESTPASS/${TESTPASS}/" | 
     psql -v ON_ERROR_STOP=1 ${TEST_DB} || exit 1
 
+  psql -c "CREATE EXTENSION plpythonu;" ${TEST_DB}
+  curl -L -s https://github.com/CartoDB/cartodb-postgresql/raw/cdb/scripts-available/CDB_QueryStatements.sql -o sql/CDB_QueryStatements.sql
+  curl -L -s https://github.com/CartoDB/cartodb-postgresql/raw/cdb/scripts-available/CDB_QueryTables.sql -o sql/CDB_QueryTables.sql
+  cat sql/CDB_QueryStatements.sql sql/CDB_QueryTables.sql |
+    psql -v ON_ERROR_STOP=1 ${TEST_DB} || exit 1
+
 fi
 
 if test x"$PREPARE_REDIS" = xyes; then

test/support/sql/CDB_QueryStatements.sql

@@ -0,0 +1,14 @@
+-- Return an array of statements found in the given query text
+--
+-- Regexp curtesy of Hubert Lubaczewski (depesz)
+-- Implemented in plpython for performance reasons
+--
+CREATE OR REPLACE FUNCTION CDB_QueryStatements(query text) 
+RETURNS SETOF TEXT AS $$
+  import re
+  pat = re.compile( r'''((?:[^'"$;]+|"[^"]*"|'[^']*'|(\$[^$]*\$).*?\2)+)''', re.DOTALL )
+  for match in pat.findall(query):
+    cleaned = match[0].strip()
+    if ( cleaned ):
+      yield cleaned
+$$ language 'plpythonu' IMMUTABLE STRICT;

test/support/sql/CDB_QueryTables.sql

@@ -0,0 +1,67 @@
+-- Return an array of table names scanned by a given query
+--
+-- Requires PostgreSQL 9.x+
+--
+CREATE OR REPLACE FUNCTION CDB_QueryTables(query text)
+RETURNS name[]
+AS $$
+DECLARE
+  exp XML;
+  tables NAME[];
+  rec RECORD;
+  rec2 RECORD;
+BEGIN
+  
+  tables := '{}';
+
+  FOR rec IN SELECT CDB_QueryStatements(query) q LOOP
+
+    IF NOT ( rec.q ilike 'select %' or rec.q ilike 'with %' ) THEN
+      --RAISE WARNING 'Skipping %', rec.q;
+      CONTINUE;
+    END IF;
+
+    BEGIN
+      EXECUTE 'EXPLAIN (FORMAT XML, VERBOSE) ' || rec.q INTO STRICT exp;
+    EXCEPTION WHEN others THEN
+      -- TODO: if error is 'relation "xxxxxx" does not exist', take xxxxxx as
+      --       the affected table ?
+      RAISE WARNING 'CDB_QueryTables cannot explain query: % (%: %)', rec.q, SQLSTATE, SQLERRM;
+      RAISE EXCEPTION '%', SQLERRM;
+      CONTINUE;
+    END;
+
+    -- Now need to extract all values of <Relation-Name>
+
+    -- RAISE DEBUG 'Explain: %', exp;
+
+    FOR rec2 IN WITH
+      inp AS (
+        SELECT
+          xpath('//x:Relation-Name/text()', exp, ARRAY[ARRAY['x', 'http://www.postgresql.org/2009/explain']]) as x,
+          xpath('//x:Relation-Name/../x:Schema/text()', exp, ARRAY[ARRAY['x', 'http://www.postgresql.org/2009/explain']]) as s
+      )
+      SELECT unnest(x)::name as p, unnest(s)::name as sc from inp
+    LOOP
+      -- RAISE DEBUG 'tab: %', rec2.p;
+      -- RAISE DEBUG 'sc: %', rec2.sc;
+      tables := array_append(tables, (rec2.sc || '.' || rec2.p)::name);
+    END LOOP;
+
+    -- RAISE DEBUG 'Tables: %', tables;
+
+  END LOOP;
+
+  -- RAISE DEBUG 'Tables: %', tables;
+
+  -- Remove duplicates and sort by name
+  IF array_upper(tables, 1) > 0 THEN
+    WITH dist as ( SELECT DISTINCT unnest(tables)::text as p ORDER BY p )
+       SELECT array_agg(p) from dist into tables;
+  END IF;
+
+  --RAISE DEBUG 'Tables: %', tables;
+
+  return tables;
+END
+$$ LANGUAGE 'plpgsql' VOLATILE STRICT;

test/support/sql/windshaft.test.sql

@@ -177,3 +177,15 @@ CREATE TABLE test_table_private_1 (
 INSERT INTO test_table_private_1 SELECT * from test_table;
 
 GRANT ALL ON TABLE test_table_private_1 TO :TESTUSER;
+
+CREATE TABLE IF NOT EXISTS
+  CDB_TableMetadata (
+    tabname regclass not null primary key,
+    updated_at timestamp with time zone not null default now()
+  );
+
+INSERT INTO CDB_TableMetadata (tabname, updated_at) VALUES ('test_table'::regclass, '2009-02-13T23:31:30.123Z');
+INSERT INTO CDB_TableMetadata (tabname, updated_at) VALUES ('test_table_private_1'::regclass, '2009-02-13T23:31:30.123Z');
+
+-- GRANT SELECT ON CDB_TableMetadata TO :PUBLICUSER;
+GRANT SELECT ON CDB_TableMetadata TO :TESTUSER;

test/support/test_helper.js

@@ -50,10 +50,16 @@ function checkCache(res) {
     assert.ok(res.headers.hasOwnProperty('last-modified'));
 }
 
+function checkSurrogateKey(res, expectedKey) {
+    assert.ok(res.headers.hasOwnProperty('surrogate-key'));
+    assert.equal(res.headers['surrogate-key'], expectedKey);
+}
+
 
 module.exports = {
   lzma_compress_to_base64: lzma_compress_to_base64,
   checkNoCache: checkNoCache,
+  checkSurrogateKey: checkSurrogateKey,
   checkCache: checkCache
 };
 

test/unit/cartodb/cache/model/named_maps_entry.test.js

@@ -0,0 +1,29 @@
+var assert = require('assert');
+var _ = require('underscore');
+var NamedMapsCacheEntry = require('../../../../../lib/cartodb/cache/model/named_maps_entry');
+
+suite('cache named_maps_entry', function() {
+
+    var namedMapOwner = 'foo',
+        namedMapName = 'wadus_name',
+        namedMapsCacheEntry = new NamedMapsCacheEntry(namedMapOwner, namedMapName),
+        entryKey = namedMapsCacheEntry.key();
+
+    test('key is a string', function() {
+        assert.ok(_.isString(entryKey));
+    });
+
+    test('key is 8 chars length', function() {
+        assert.equal(entryKey.length, 8);
+        var entryKeyParts = entryKey.split(':');
+        assert.equal(entryKeyParts.length, 2);
+        assert.equal(entryKeyParts[0], 'n');
+    });
+
+    test('key is name spaced for named maps', function() {
+        var entryKeyParts = entryKey.split(':');
+        assert.equal(entryKeyParts.length, 2);
+        assert.equal(entryKeyParts[0], 'n');
+    });
+
+});

test/unit/cartodb/signed_maps.test.js

@@ -1,109 +0,0 @@
-var assert = require('assert')
-  //, _ = require('underscore')
-  , RedisPool = require('redis-mpool')
-  , SignedMaps = require('../../../lib/cartodb/signed_maps.js')
-  , test_helper = require('../../support/test_helper')
-  , Step = require('step')
-  , tests = module.exports = {};
-
-suite('signed_maps', function() {
-
-    // configure redis pool instance to use in tests
-    var redis_pool = RedisPool(global.environment.redis);
-    
-    test('can sign map with open and token-based auth', function(done) {
-      var smap = new SignedMaps(redis_pool);
-      assert.ok(smap);
-      var sig = 'sig1';
-      var map = 'map1';
-      var tok = 'tok1';
-      var crt = {
-        version:'0.0.1',
-        layergroup_id:map,
-        auth: {}
-      };
-      var crt1_id; // by token
-      var crt2_id; // open
-      Step(
-        function() {
-          smap.isAuthorized(sig,map,tok,this);
-        },
-        function checkAuthFailure1(err, authorized) {
-          if ( err ) throw err;
-          assert.ok(!authorized, "unexpectedly authorized");
-          crt.auth.method = 'token';
-          crt.auth.valid_tokens = [tok];
-          smap.addSignature(sig, map, crt, this)
-        },
-        function getCert1(err, id) {
-          if ( err ) throw err;
-          assert.ok(id, "undefined signature id");
-          crt1_id = id; // keep note of it
-//console.log("Certificate 1 is " + crt1_id);
-          smap.isAuthorized(sig,map,'',this);
-        },
-        function checkAuthFailure2(err, authorized) {
-          if ( err ) throw err;
-          assert.ok(!authorized, "unexpectedly authorized");
-          smap.isAuthorized(sig,map,tok,this);
-        },
-        function checkAuthSuccess1(err, authorized) {
-          if ( err ) throw err;
-          assert.ok(authorized, "unauthorized :(");
-          crt.auth.method = 'open';
-          delete crt.auth.valid_tokens;
-          smap.addSignature(sig, map, crt, this)
-        },
-        function getCert2(err, id) {
-          if ( err ) throw err;
-          assert.ok(id, "undefined signature id");
-          crt2_id = id; // keep note of it
-//console.log("Certificate 2 is " + crt2_id);
-          smap.isAuthorized(sig,map,'arbitrary',this);
-        },
-        function checkAuthSuccess2_delCert2(err, authorized) {
-          if ( err ) throw err;
-          assert.ok(authorized, "unauthorized :(");
-          var next = this;
-          smap.delCertificate(sig, crt2_id, function(e) {
-            if (e) next(e);
-            else smap.isAuthorized(sig,map,'arbitrary',next);
-          });
-        },
-        function checkAuthFailure3_delCert2(err, authorized) {
-          if ( err ) throw err;
-          assert.ok(!authorized, "unexpectedly authorized");
-          smap.delCertificate(sig, crt1_id, this);
-        },
-        function finish(err) {
-          done(err);
-        }
-      );
-    });
-
-    test('can validate certificates', function(done) {
-      var smap = new SignedMaps(redis_pool);
-      assert.ok(smap);
-      Step(
-        function invalidVersion() {
-          var cert = { version: '-1' };
-          var err = smap.checkInvalidCertificate(cert);
-          assert.ok(err);
-          assert.equal(err.message, "Unsupported certificate version -1");
-          return null;
-        },
-        function invalidTokenAuth() {
-          var cert = { version: '0.0.1', auth: { method:'token', valid_token:[] } };
-          var err = smap.checkInvalidCertificate(cert);
-          assert.ok(err);
-          assert.equal(err.message, "Invalid 'token' authentication: missing valid_tokens");
-          return null;
-        },
-        function finish(err) {
-          done(err);
-        }
-      );
-    });
-
-    
-});

test/unit/cartodb/template_maps.test.js

@@ -1,31 +1,42 @@
 var assert = require('assert')
   //, _ = require('underscore')
   , RedisPool = require('redis-mpool')
-  , SignedMaps = require('../../../lib/cartodb/signed_maps.js')
   , TemplateMaps = require('../../../lib/cartodb/template_maps.js')
   , test_helper = require('../../support/test_helper')
   , Step = require('step')
+  , _ = require('underscore')
   , tests = module.exports = {};
 
 suite('template_maps', function() {
 
   // configure redis pool instance to use in tests
   var redis_pool = RedisPool(global.environment.redis);
-  var signed_maps = new SignedMaps(redis_pool);
+
+    var wadusLayer = {
+        options: {
+            sql: 'select 1 cartodb_id, null::geometry the_geom_webmercator',
+            cartocss: '#layer { marker-fill:blue; }',
+            cartocss_version: '2.3.0'
+        }
+    };
 
     var validTemplate = {
         version:'0.0.1',
         name: 'first',
         auth: {},
-        layergroup: {}
+        layergroup: {
+            layers: [
+                wadusLayer
+            ]
+        }
     };
     var owner = 'me';
     
   test('does not accept template with unsupported version', function(done) {
-    var tmap = new TemplateMaps(redis_pool, signed_maps);
+    var tmap = new TemplateMaps(redis_pool);
     assert.ok(tmap);
     var tpl = { version:'6.6.6',
-      name:'k', auth: {}, layergroup: {} };
+      name:'k', auth: {}, layergroup: {layers:[wadusLayer]} };
     Step(
       function() {
         tmap.addTemplate('me', tpl, this);
@@ -42,10 +53,10 @@ suite('template_maps', function() {
   });
 
   test('does not accept template with missing name', function(done) {
-    var tmap = new TemplateMaps(redis_pool, signed_maps);
+    var tmap = new TemplateMaps(redis_pool);
     assert.ok(tmap);
     var tpl = { version:'0.0.1',
-      auth: {}, layergroup: {} };
+      auth: {}, layergroup: {layers:[wadusLayer]} };
     Step(
       function() {
         tmap.addTemplate('me', tpl, this);
@@ -62,10 +73,10 @@ suite('template_maps', function() {
   });
 
   test('does not accept template with invalid name', function(done) {
-    var tmap = new TemplateMaps(redis_pool, signed_maps);
+    var tmap = new TemplateMaps(redis_pool);
     assert.ok(tmap);
     var tpl = { version:'0.0.1',
-      auth: {}, layergroup: {} };
+      auth: {}, layergroup: {layers:[wadusLayer]} };
     var invalidnames = [ "ab|", "a b", "a@b", "1ab", "_x", "", " x", "x " ];
     var testNext = function() {
       if ( ! invalidnames.length ) { done(); return; }
@@ -88,11 +99,11 @@ suite('template_maps', function() {
   });
 
   test('does not accept template with invalid placeholder name', function(done) {
-    var tmap = new TemplateMaps(redis_pool, signed_maps);
+    var tmap = new TemplateMaps(redis_pool);
     assert.ok(tmap);
     var tpl = { version:'0.0.1',
       name: "valid", placeholders: {},
-      auth: {}, layergroup: {} };
+      auth: {}, layergroup: {layers:[wadusLayer]} };
     var invalidnames = [ "ab|", "a b", "a@b", "1ab", "_x", "", " x", "x " ];
     var testNext = function() {
       if ( ! invalidnames.length ) { done(); return; }
@@ -116,11 +127,11 @@ suite('template_maps', function() {
   });
 
   test('does not accept template with missing placeholder default', function(done) {
-    var tmap = new TemplateMaps(redis_pool, signed_maps);
+    var tmap = new TemplateMaps(redis_pool);
     assert.ok(tmap);
     var tpl = { version:'0.0.1',
       name: "valid", placeholders: { v: {} },
-      auth: {}, layergroup: {} };
+      auth: {}, layergroup: {layers:[wadusLayer]} };
     tmap.addTemplate('me', tpl, function(err) {
         if ( ! err ) {
           done(new Error("Unexpected success with missing placeholder default"));
@@ -136,11 +147,11 @@ suite('template_maps', function() {
   });
 
   test('does not accept template with missing placeholder type', function(done) {
-    var tmap = new TemplateMaps(redis_pool, signed_maps);
+    var tmap = new TemplateMaps(redis_pool);
     assert.ok(tmap);
     var tpl = { version:'0.0.1',
       name: "valid", placeholders: { v: { default:1 } },
-      auth: {}, layergroup: {} };
+      auth: {}, layergroup: {layers:[wadusLayer]} };
     tmap.addTemplate('me', tpl, function(err) {
         if ( ! err ) {
           done(new Error("Unexpected success with missing placeholder type"));
@@ -158,11 +169,11 @@ suite('template_maps', function() {
   // See http://github.com/CartoDB/Windshaft-cartodb/issues/128
   test('does not accept template with invalid token auth (undefined tokens)',
   function(done) {
-    var tmap = new TemplateMaps(redis_pool, signed_maps);
+    var tmap = new TemplateMaps(redis_pool);
     assert.ok(tmap);
     var tpl = { version:'0.0.1',
       name: "invalid_auth1", placeholders: { },
-      auth: { method: 'token' }, layergroup: {} };
+      auth: { method: 'token' }, layergroup: {layers:[wadusLayer]} };
     tmap.addTemplate('me', tpl, function(err) {
         if ( ! err ) {
           done(new Error("Unexpected success with invalid token auth (undefined tokens)"));
@@ -178,12 +189,12 @@ suite('template_maps', function() {
   });
 
   test('add, get and delete a valid template', function(done) {
-    var tmap = new TemplateMaps(redis_pool, signed_maps);
+    var tmap = new TemplateMaps(redis_pool);
     assert.ok(tmap);
     var expected_failure = false;
     var tpl_id;
     var tpl = { version:'0.0.1',
-      name: 'first', auth: {}, layergroup: {} };
+      name: 'first', auth: {}, layergroup: {layers:[wadusLayer]} };
     Step(
       function() {
         tmap.addTemplate('me', tpl, this);
@@ -204,7 +215,7 @@ suite('template_maps', function() {
       },
       function delTemplate(err, got_tpl) {
         if ( err ) throw err;
-        assert.deepEqual(got_tpl, tpl);
+        assert.deepEqual(got_tpl, _.extend({}, tpl, {auth: {method: 'open'}, placeholders: {}}));
         tmap.delTemplate('me', tpl_id, this);
       },
       function finish(err) {
@@ -214,12 +225,12 @@ suite('template_maps', function() {
   });
 
   test('add multiple templates, list them', function(done) {
-    var tmap = new TemplateMaps(redis_pool, signed_maps);
+    var tmap = new TemplateMaps(redis_pool);
     assert.ok(tmap);
     var expected_failure = false;
-    var tpl1 = { version:'0.0.1', name: 'first', auth: {}, layergroup: {} };
+    var tpl1 = { version:'0.0.1', name: 'first', auth: {}, layergroup: {layers:[wadusLayer]} };
     var tpl1_id;
-    var tpl2 = { version:'0.0.1', name: 'second', auth: {}, layergroup: {} };
+    var tpl2 = { version:'0.0.1', name: 'second', auth: {}, layergroup: {layers:[wadusLayer]} };
     var tpl2_id;
     Step(
       function addTemplate1() {
@@ -273,14 +284,14 @@ suite('template_maps', function() {
   });
 
   test('update templates', function(done) {
-    var tmap = new TemplateMaps(redis_pool, signed_maps);
+    var tmap = new TemplateMaps(redis_pool);
     assert.ok(tmap);
     var expected_failure = false;
     var owner = 'me';
     var tpl = { version:'0.0.1',
       name: 'first',
       auth: { method: 'open' },
-      layergroup: {}
+      layergroup: {layers:[wadusLayer]}
     };
     var tpl_id;
     Step(
@@ -333,7 +344,7 @@ suite('template_maps', function() {
   });
 
   test('instanciate templates', function() {
-    var tmap = new TemplateMaps(redis_pool, signed_maps);
+    var tmap = new TemplateMaps(redis_pool);
     assert.ok(tmap);
 
     var tpl1 =  {
@@ -431,11 +442,11 @@ suite('template_maps', function() {
 
   // Can set a limit on the number of user templates
   test('can limit number of user templates', function(done) {
-    var tmap = new TemplateMaps(redis_pool, signed_maps, {
+    var tmap = new TemplateMaps(redis_pool, {
       max_user_templates: 2
     });
     assert.ok(tmap);
-    var tpl = { version:'0.0.1', auth: {}, layergroup: {} };
+    var tpl = { version:'0.0.1', auth: {}, layergroup: {layers:[wadusLayer]} };
     var expectErr = false;
     var idMe = [];
     var idYou = [];
@@ -511,88 +522,4 @@ suite('template_maps', function() {
     );
   });
 
-    var redisCmdFunc = TemplateMaps.prototype._redisCmd;
-
-    function runWithRedisStubbed(stubbedCommands, func) {
-        TemplateMaps.prototype._redisCmd = function(redisFunc, redisArgs, callback) {
-            redisFunc = redisFunc.toLowerCase();
-            if (stubbedCommands.hasOwnProperty(redisFunc)) {
-                callback(null, stubbedCommands[redisFunc]);
-            } else {
-                throw 'Unknown command';
-            }
-        };
-
-        func();
-
-        TemplateMaps.prototype._redisCmd = redisCmdFunc;
-    }
-
-    test('_obtainTemplateLock with no previous value, happy case', function(done) {
-        runWithRedisStubbed({hget: null, hset: 1}, function() {
-            var templateMaps = new TemplateMaps(redis_pool, signed_maps);
-
-            templateMaps._obtainTemplateLock(owner, validTemplate.name, function(err, gotLock) {
-                assert.ok(!err);
-                assert.ok(gotLock);
-                done();
-            });
-        });
-    });
-
-    test('_obtainTemplateLock no lock for non expired ttl, simulates obtaining two locks at same time', function(done) {
-        runWithRedisStubbed({hget: Date.now()}, function() {
-            var templateMaps = new TemplateMaps(redis_pool, signed_maps);
-
-            templateMaps._obtainTemplateLock(owner, validTemplate.name, function(err, gotLock) {
-                assert.ok(!!err);
-                assert.equal(gotLock, false);
-                done();
-            });
-        });
-    });
-
-
-    test('_obtainTemplateLock no lock for non expired ttl, last millisecond of valid ttl', function(done) {
-        var nowValue = Date.now(),
-            nowFunc = Date.now;
-        Date.now = function() {
-            return nowValue;
-        };
-        var lockTtl = 1000;
-        runWithRedisStubbed({hget: Date.now() - lockTtl, hset: true}, function() {
-            var templateMaps = new TemplateMaps(redis_pool, signed_maps, {lock_ttl: lockTtl});
-
-            templateMaps._obtainTemplateLock(owner, validTemplate.name, function(err, gotLock) {
-                assert.ok(!!err);
-                assert.equal(gotLock, false);
-
-                Date.now = nowFunc;
-
-                done();
-            });
-        });
-    });
-
-    test('_obtainTemplateLock gets lock for expired ttl, first millisecond of invalid ttl', function(done) {
-        var nowValue = Date.now(),
-            nowFunc = Date.now;
-        Date.now = function() {
-            return nowValue;
-        };
-        var lockTtl = 1000;
-        runWithRedisStubbed({hget: Date.now() - lockTtl - 1, hset: true}, function() {
-            var templateMaps = new TemplateMaps(redis_pool, signed_maps, {lock_ttl: lockTtl});
-
-            templateMaps._obtainTemplateLock(owner, validTemplate.name, function(err, gotLock) {
-                assert.ok(!err);
-                assert.ok(gotLock);
-
-                Date.now = nowFunc;
-
-                done();
-            });
-        });
-    });
-
 });

test/unit/cartodb/template_maps_auth.test.js

@@ -0,0 +1,105 @@
+var assert = require('assert');
+var RedisPool = require('redis-mpool');
+var TemplateMaps = require('../../../lib/cartodb/template_maps');
+var test_helper = require('../../support/test_helper');
+var Step = require('step');
+var tests = module.exports = {};
+
+suite('template_maps_auth', function() {
+
+    // configure redis pool instance to use in tests
+    var redisPool = new RedisPool(global.environment.redis),
+        templateMaps = new TemplateMaps(redisPool, {max_user_templates: 1000});
+
+    function makeTemplate(method, validTokens) {
+        var template = {
+            name: 'wadus_template',
+            auth: {
+                method: method
+            }
+        };
+
+        if (method === 'token') {
+            template.auth.valid_tokens = validTokens || [];
+        }
+
+        return template;
+    }
+
+    var methodToken = 'token',
+        methodOpen = 'open';
+
+    var tokenFoo = 'foo',
+        tokenBar = 'bar';
+
+    var authorizationTestScenarios = [
+        {
+            desc: 'open method is always authorized',
+            template: makeTemplate(methodOpen),
+            token: undefined,
+            expected: true
+        },
+        {
+            desc: 'token method is authorized for valid token',
+            template: makeTemplate(methodToken, [tokenFoo]),
+            token: tokenFoo,
+            expected: true
+        },
+        {
+            desc: 'token method not authorized for invalid token',
+            template: makeTemplate(methodToken, [tokenFoo]),
+            token: tokenBar,
+            expected: false
+        },
+        {
+            desc: 'token method is authorized for valid token array',
+            template: makeTemplate(methodToken, [tokenFoo]),
+            token: [tokenFoo],
+            expected: true
+        },
+        {
+            desc: 'token method not authorized for invalid token array',
+            template: makeTemplate(methodToken, [tokenFoo]),
+            token: [tokenBar],
+            expected: false
+        },
+        {
+            desc: 'wadus method not authorized',
+            template: makeTemplate('wadus', [tokenFoo]),
+            token: tokenFoo,
+            expected: false
+        },
+        {
+            desc: 'undefined template result in not authorized',
+            template: undefined,
+            token: tokenFoo,
+            expected: false
+        },
+        {
+            desc: 'undefined template auth result in not authorized',
+            template: {},
+            token: tokenFoo,
+            expected: false
+        }
+    ];
+
+    authorizationTestScenarios.forEach(function(testScenario) {
+        test(testScenario.desc, function(done) {
+            var debugMessage = testScenario.expected ? 'should be authorized' : 'unexpectedly authorized';
+            var result = templateMaps.isAuthorized(testScenario.template, testScenario.token);
+            assert.equal(result, testScenario.expected, debugMessage);
+            done();
+        })
+    });
+
+    test("auth as 'open' string is authorized", function(done) {
+        var template = {
+            name: 'wadus_template',
+            auth: 'open'
+        };
+
+        assert.ok(templateMaps.isAuthorized(template));
+        done();
+    });
+
+});

test/unit/cartodb/template_maps_defaults.test.js

@@ -0,0 +1,106 @@
+var assert = require('assert');
+var RedisPool = require('redis-mpool');
+var TemplateMaps = require('../../../lib/cartodb/template_maps.js');
+var test_helper = require('../../support/test_helper');
+var _ = require('underscore');
+
+suite('template_maps', function() {
+
+    var redisPool = new RedisPool(global.environment.redis),
+        templateMaps = new TemplateMaps(redisPool);
+
+    var owner = 'me';
+    var templateName = 'wadus';
+
+
+    var defaultTemplate = {
+        version:'0.0.1',
+        name: templateName,
+        layergroup: {
+            layers: [
+                {
+                    options: {
+                        sql: 'select 1 cartodb_id, null::geometry the_geom_webmercator',
+                        cartocss: '#layer { marker-fill:blue; }',
+                        cartocss_version: '2.3.0'
+                    }
+                }
+            ]
+        }
+    };
+
+    function makeTemplate(auth, placeholders) {
+        return _.extend({}, defaultTemplate, {
+            auth: auth,
+            placeholders: placeholders
+        });
+    }
+
+    var defaultAuth = {
+        method: 'open'
+    };
+
+    var authTokenSample = {
+        method: 'token',
+        valid_tokens: ['wadus_token']
+    };
+
+    var placeholdersSample = {
+        wadus: {
+            type: 'number',
+            default: 1
+        }
+    };
+
+    var testScenarios = [
+        {
+            desc: 'default auth and placeholders values',
+            template: defaultTemplate,
+            expected: {
+                auth: defaultAuth,
+                placeholders: {}
+            }
+        },
+        {
+            desc: 'default placeholders but specified auth',
+            template: makeTemplate(authTokenSample),
+            expected: {
+                auth: authTokenSample,
+                placeholders: {}
+            }
+        },
+        {
+            desc: 'default auth but specified placeholders',
+            template: makeTemplate(undefined, placeholdersSample),
+            expected: {
+                auth: defaultAuth,
+                placeholders: placeholdersSample
+            }
+        },
+        {
+            desc: 'specified auth and placeholders',
+            template: makeTemplate(authTokenSample, placeholdersSample),
+            expected: {
+                auth: authTokenSample,
+                placeholders: placeholdersSample
+            }
+        }
+    ];
+
+    testScenarios.forEach(function(testScenario) {
+        test('adding template returns a new instance with ' + testScenario.desc, function(done) {
+
+            templateMaps.addTemplate(owner, testScenario.template, function(err, templateId, template) {
+                assert.ok(!err, 'Unexpected error adding template: ' + (err && err.message));
+                assert.ok(testScenario.template !== template, 'template instances should be different');
+                assert.equal(template.name, templateName);
+                assert.deepEqual(template.auth, testScenario.expected.auth);
+                assert.deepEqual(template.placeholders, testScenario.expected.placeholders);
+
+                templateMaps.delTemplate(owner, templateName, done);
+            });
+
+        });
+    });
+
+});

test/unit/cartodb/valid_template_maps.test.js

@@ -0,0 +1,112 @@
+var assert = require('assert');
+var RedisPool = require('redis-mpool');
+var TemplateMaps = require('../../../lib/cartodb/template_maps.js');
+var test_helper = require('../../support/test_helper');
+var _ = require('underscore');
+
+suite('template_maps', function() {
+
+    var redisPool = new RedisPool(global.environment.redis),
+        templateMaps = new TemplateMaps(redisPool);
+
+    var owner = 'me';
+    var templateName = 'wadus';
+
+
+    var defaultTemplate = {
+        version:'0.0.1',
+        name: templateName
+    };
+
+    function makeTemplate(layers) {
+        var layergroup = {
+            layers: layers
+        };
+        return _.extend({}, defaultTemplate, {
+            layergroup: layergroup
+        });
+    }
+
+    var layerWithMissingOptions = {},
+        minimumValidLayer = {
+            options: {
+                sql: 'select 1 cartodb_id, null::geometry the_geom_webmercator',
+                cartocss: '#layer { marker-fill:blue; }',
+                cartocss_version: '2.3.0'
+            }
+        };
+
+    var testScenarios = [
+        {
+            desc: 'Missing layers array does not validate',
+            template: makeTemplate(),
+            expected: {
+                isValid: false,
+                message: 'Missing or empty layers array from layergroup config'
+            }
+        },
+        {
+            desc: 'Empty layers array does not validate',
+            template: makeTemplate([]),
+            expected: {
+                isValid: false,
+                message: 'Missing or empty layers array from layergroup config'
+            }
+        },
+        {
+            desc: 'Layer with missing options does not validate',
+            template: makeTemplate([
+                layerWithMissingOptions
+            ]),
+            expected: {
+                isValid: false,
+                message: 'Missing `options` in layergroup config for layers: 0'
+            }
+        },
+        {
+            desc: 'Multiple layers report invalid layer',
+            template: makeTemplate([
+                minimumValidLayer,
+                layerWithMissingOptions
+            ]),
+            expected: {
+                isValid: false,
+                message: 'Missing `options` in layergroup config for layers: 1'
+            }
+        },
+        {
+            desc: 'default auth but specified placeholders',
+            template: makeTemplate([
+                minimumValidLayer
+            ]),
+            expected: {
+                isValid: true,
+                message: ''
+            }
+        }
+    ];
+
+    testScenarios.forEach(function(testScenario) {
+        test(testScenario.desc, function(done) {
+
+            templateMaps.addTemplate(owner, testScenario.template, function(err) {
+
+                if (testScenario.expected.isValid) {
+
+                    assert.ok(!err);
+                    templateMaps.delTemplate(owner, templateName, done);
+
+                } else {
+
+                    assert.ok(err);
+                    assert.equal(err.message, testScenario.expected.message);
+                    done();
+
+                }
+
+            });
+
+        });
+    });
+
+});

tools/flush_cache

@@ -1,59 +0,0 @@
-#!/usr/bin/env node
-
-var path = require('path');
-var request    = require('request');
-
-function usage(me, exitcode) {
-  console.log("Usage: " + me + " [--env <environment>] <username> <tablename>");
-  process.exit(exitcode);
-}
-
-var node_path = process.argv.shift(); 
-var script_path = process.argv.shift(); 
-var basedir = path.dirname(script_path);
-var me = path.basename(script_path);
-
-var ENV = 'development.js';
-var username, table;
-var arg;
-while ( arg = process.argv.shift() ) {
-  if ( arg == '--env' ) {
-    ENV = process.argv.shift();
-  }
-  else if ( ! username ) {
-    username = arg;
-  }
-  else if ( ! table ) {
-    table = arg;
-  }
-  else {
-    console.warn("Unused parameter " + arg);
-  }
-}
-
-if ( ! table ) {
-  usage(me, 1);
-}
-
-global.environment = require('../config/environments/' + ENV);
-
-// _after_ setting global.environment
-var serverOptions = require('../lib/cartodb/server_options');
-
-var host = global.environment.host;
-var port = global.environment.port;
-var re = ''+serverOptions.re_userFromHost;
-var hostname = re.replace(/^\/\^/, '')
-                 .replace(/\/$$/, '')
-                 .replace(/\\/g,'')
-                 .replace(/\([^)]*\)/,username)
-              ;
-//console.log("re: " + re);
-//console.log("hostname: " + hostname);
-
-var url = 'http://' + host + ':' + port + '/tiles/' + table + '/flush_cache';
-request.del({ url: url, headers: { host: hostname } },
-function(err, res, body) {
-  if ( err ) throw err;
-  console.log(res.body);
-});