Repository navigation
Bug 2061445 - Re-land the native Mojo Bugzilla (system info) REST resource - #2828
Conversation
…ource Reverts ef9e9b0: the native login accepts ?api_key= since bug 2073282, so /rest/jobqueue_status?api_key=<key> works again (now tested). rest_legacy_credentials.t moves to /rest/component-watching, still legacy.
| sub extensions { | ||
| my ($self) = @_; | ||
| Bugzilla->usage_mode(USAGE_MODE_MOJO_REST); | ||
| my $user = $self->bugzilla->login(LOGIN_REQUIRED); |
There was a problem hiding this comment.
the legacy server let anonymous callers hit /rest/extensions and /rest/time (only requirelogin forced auth), so LOGIN_REQUIRED here and in time now returns 401 for them, so either keep them anonymous like before or document the new auth requirement in docs/en/md/api/core/v1/bugzilla.md (and integration.md, which points integrators at /rest/time)
Personally I am leaning to requiring login for the /extensions and /time endpoint because 1) knowing the extensions installed in a Bugzilla system could give sensitive info if the repo is private and 2) /time needs to know the users timezone for some of the values. So let's just update the docs to reflect the new requirement.
There was a problem hiding this comment.
Agreed, keeping login required.
Doc updated in 6781396: "This method requires an authenticated user" under both requests in bugzilla.md (same wording as Job Queue Status), and the /rest/time polling step in integration.md now says so too.
As the tests already check the 401 for anonymous callers of both endpoints (qa/t/rest_bugzilla.t:50,61), only the docs change.
…n authenticated user
Summary
Re-lands the native
Bugzilla::API::V1::Bugzillacontroller (/rest/version,/extensions,/timezone,/time,/jobqueue_status), reverted in ef9e9b0 because a monitoring service calls/rest/jobqueue_statuswith?api_key=<key>.That call works on native routes since 2073282 (deprecated
?api_key=/?Bugzilla_api_key=fallback in the native login), so the original change comes back unchanged. Last core resource of 2057358: only extension endpoints remain on the legacy REST server.Changes
Bugzilla/API/V1/Bugzilla.pm(GET+OPTIONSon the 5 paths, same responses as before)Bugzilla/WebService/Bugzilla.pm,Resources/Bugzilla.pmand theBugzilladispatch entryWS_DISPATCHnow only holds the extensions registered through thewebservicehook;Bugzilla/WebService.pmPOD updated accordingly.qa/t/rest_legacy_credentials.tchecksBugzilla_login/Bugzilla_passwordonGET /rest/component-watching, still served by the legacy server, instead of/rest/version.qa/t/rest_bugzilla.t:GET /rest/jobqueue_status?api_key=<key>returns 200.general.md: the resources still on the legacy auth path are now only some extension endpoints.Test plan
GET /rest/version,/rest/timezoneanonymously: 200, same JSON as beforeGET /rest/extensions,/rest/time,/rest/jobqueue_statusanonymously: 401login_required; withX-Bugzilla-API-Key: 200GET /rest/jobqueue_status?api_key=<key>: 200GET /rest/component-watchingwithBugzilla_login/Bugzilla_password: 200, and an error with bad credentialsReferences