SPE Remote Automation (Legacy asmx) : Gaps & Optimization Analysis

[michaellwest]

SPE Remote Automation (Legacy asmx) : Gaps & Optimization Opportunities

Analysis of RemoteAutomation.asmx.cs (server-side SOAP service) vs the SPE PowerShell module (/Modules/SPE/) and the newer RemoteScriptCall.ashx.cs HTTP handler to identify capability gaps, inconsistencies, and optimization opportunities.

---

1. RemoteAutomation.asmx.cs is Legacy / Redundant

The ASMX web service duplicates functionality already available through RemoteScriptCall.ashx.cs, and the PowerShell module has already migrated to use the HTTP handler (/-/script/... endpoints) instead of the SOAP service.

Capability	RemoteAutomation.asmx	RemoteScriptCall.ashx
Script execution	Yes (sync only)	Yes (sync)
File upload/download	Yes (Media Library only)	Yes (Media + filesystem)
Session management	Partial (create/dispose)	Yes (via SessionId marker)
Auth methods	Username/password only	Basic, Bearer/JWT, query params
Compression	None	GZIP supported

Gap: RemoteAutomation.asmx only supports username/password auth - no JWT/Bearer token support. The module's New-ScriptSession supports SharedSecret/JWT but can only use it with the ashx handler, not the asmx service.

Recommendation: Consider deprecating RemoteAutomation.asmx.cs. The ashx handler is strictly superior.

---

2. Missing Error Streaming in Remoting

RemoteAutomation.asmx.cs methods like ExecuteScriptBlockinSite2 capture LastErrors and append them to output objects, but there's no structured separation of error streams vs output streams. Errors are mixed into the CliXml result blob.

Meanwhile, RemoteScriptCall.ashx.cs uses a <#messages#> delimiter to separate output from verbose/warning/debug/error messages, and the PowerShell module parses these in Invoke-RemoteScript.ps1 to redirect to proper PowerShell streams.

Gap in asmx: No stream separation - errors, warnings, verbose messages are all lost or flattened.

---

3. No Progress Reporting for Remote Scripts

ScriptingHostUserInterface.WriteProgress() sends progress via MessageQueue for interactive sessions (ISE/Console), but there is no mechanism to stream progress information back through either remoting endpoint.

Gap: Long-running remote scripts provide no progress feedback. Wait-RemoteScriptSession polls with a delay but only checks completion status, not progress percentage or status messages.

---

4. File Operations: Filesystem Access Gap in ASMX

• RemoteAutomation.asmx.cs UploadFile/DownloadFile methods only work with Sitecore Media Library items.
• RemoteScriptCall.ashx.cs supports both filesystem and media operations via separate endpoints.
• The PowerShell module's Send-RemoteItem and Receive-RemoteItem support both via the ashx handler.

Gap: If anyone still uses the SOAP service directly, they cannot access filesystem paths.

---

5. No Streaming / Chunked Transfer for Large Files

Both UploadFile and DownloadFile in RemoteAutomation.asmx serialize the entire file as byte[] in a single SOAP message. Send-RemoteItem.ps1 reads files into [System.IO.File]::ReadAllBytes() and sends as a single HTTP request body.

Gap: No chunked upload/download support. Large files (100MB+) risk timeouts, memory pressure, and IIS request size limits.

---

6. Session Enumeration Not Exposed Remotely

ScriptSessionManager provides GetAll(), SessionExistsForAnyUserSession(), etc. but none are exposed through any web service endpoint.

Gap: Remote administrators cannot list active sessions, check session health, or audit running scripts without logging into Sitecore directly.

---

7. No Remote Debugging API

ScriptSession has full debugging support used by ISE/Console via PowerShellWebService.asmx.cs. None of this is exposed for remote sessions.

Gap: Remote debugging is impossible. Users must use the Sitecore ISE UI.

---

8. Output Buffer Not Leveraged for Incremental Results

OutputBuffer supports incremental reads via GetHtmlUpdate() and HasUpdates(). This is used for ISE/Console polling but not available for remoting.

Gap: Remote script execution is fire-and-forget - results only when the script completes. No way to stream partial output for long-running scripts.

---

9. PowerShell Module Opportunities

• No connection health check with retry: Invoke-RemoteScript has no automatic retry on transient failures.
• No pipeline streaming: Results collected and returned at once due to HTTP request/response model.
• JWT token lifetime is hardcoded: New-Jwt.ps1 uses a 30-second expiry. For batch operations, each call regenerates the JWT. Could be cached until near-expiry.