I'd like to be able to use the API keys to allow unauthenticated users/applications to create short urls i.e. so the shortening service isn't wide open. I've created a patch that will update the access callback to allow for an API key or an authenticated user with the correct permission.

Thoughts?

CommentFileSizeAuthor
#9 0001-added-api-authentication.patch1.63 KBthat0n3guy
#8 restful_api_key_authentication-982268-8.patch1.38 KBbeanjammin
#6 shurly_service.module.patch1.42 KBbendodd
#1 shurly_service.module.patch1 KBbendodd

Comments

bendodd’s picture

bendodd commented
StatusFileSize
new shurly_service.module.patch1 KB

Sorry, file didn't upload

jjeff’s picture

jjeff commented

I like this. We should have some sort of option to turn this on/off in the settings though. Think you could add that?

bendodd’s picture

bendodd commented

Should this be per user? If not, then I guess it's a permission as opposed to a setting?

jjeff’s picture

jjeff commented

Hmmm... Now I'm starting to get confused.

Remind me of your use case here. You want to allow anonymous users to create URLs through the web interface, but NOT through web services? Won't the throttling options help you out here?

bendodd’s picture

bendodd commented

I want to be able to allow users/applications that have got an API key to create short URLs without having to actually have a current authenticated Drupal session. This allows applications outside Drupal to use this module without having to go down the route of authenticating (via XML-RPC etc). Make sense?

bendodd’s picture

bendodd commented
StatusFileSize
new shurly_service.module.patch1.42 KB

Like this...

rjbrown99’s picture

rjbrown99 commented

+1, I like this and will be using this in prod.

beanjammin’s picture

beanjammin commented
Version: 6.x-1.0-rc2 » 6.x-1.x-dev
Status: Active » Needs review
StatusFileSize
new restful_api_key_authentication-982268-8.patch1.38 KB

I've re-rolled bendodd's patch from #6 to make it drush makefile compliant.

that0n3guy’s picture

that0n3guy commented
StatusFileSize
new 0001-added-api-authentication.patch1.63 KB

Attached is #8 rolled against 7.x beta2 (sorry its not against dev...didn't have time).

beanjammin’s picture

beanjammin commented

The patch from #8 applies cleanly to 6.x-1.0.

rjbrown99’s picture

rjbrown99 commented
Status: Needs review » Reviewed & tested by the community

I have been using #6 (same as #8) now for many months. I'm marking it RTBC, no issues in prod.

quicksketch’s picture

quicksketch
he/him
commented
Status: Reviewed & tested by the community » Postponed (maintainer needs more info)

Hi guys! Thanks for this patch. I made a similar change to fix authentication in shurly before I found this issue:

http://drupalcode.org/project/shurly.git/commitdiff/0df0d2d6276d0af53146...

With that change, it has the same effect as your patch, but doesn't add the additional permission. In my opinion, if the user uses the API key, it should *always* have that user's level of permission. After all what would be the point of giving people API keys if it treated them all as anonymous users? Let me know if you think this patch is still necessary (and the requirement of the new permission). If we *do* decide to add this patch, we'll also need an upgrade path.

jibus’s picture

jibus commented
Issue summary: View changes
Status: Postponed (maintainer needs more info) » Fixed

Marked as fixed, since it's a old issue. A valid api key is now required to order to generate short urls.

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.