API bug : final "." in username causes error

Development

AI-generated summary

API bug : final “.” in username causes error

The discussion revolves around an issue with the Discourse API where a username ending with a period (.) causes an error. Daniel_McQuillen reported this issue while integrating Discourse into their site using the pydiscourse library.

pfaffman clarified that a username cannot end with a period, making the error response expected behavior. However, Daniel_McQuillen inquired about using the user’s email as an alternative in the API endpoint. pfaffman confirmed that using the email address is possible and provided the endpoint /groups/{group_id}/members.json with the payload 'email': (user email).

Additionally, pfaffman explained that this endpoint is suitable for users with admin rights and that the API is necessary for managing groups outside of the login process, which is handled by Discourse Connect.

1

We’re using the API to integrate Discourse into our site (via pydiscourse).

When it’s time to add a user to a Discourse group via the API, pydiscourse uses the PUT method to the Discourse API url:

/admin/groups/{group_id}/members.json

…and passes in the username via the ‘usernames’ variable.

If the username contains a “.” in it, there’s no problem, unless that “.” appears as the last character, in which case the API will return an error with the message:

You supplied invalid parameters to the request: usernames
2

A username cannot end in a period, so this is the expected response. I was going to check the source, but you can try to create an account here with a trailing dot and it’s illegal.

3

Thanks for the quick response, Jay. Do you know offhand whether the user’s email can be sent for ‘username’ in that API endpoint, such that Discourse will know to lookup user by email? (We use SSO to connect our Django app to Discourse, so Discourse should have both identifiers for each user)

4

Oh! Yes, I do know. I did notice the other day that you can use the email address for the endpoint that adds a user to a group. It might have been the non-admin route, though. Just include email as the field name with the address.

If you’re using Discourse connect, though, then you can have the groups managed at login,which is likely what you want to do rather than fussing with the API.

5

Thanks for the follow up.

We do use Discourse Connect, but also use the API.

BTW, you mentioned It might have been the non-admin route, though

So that PUT request would be :

/groups/{group_id}/members.json

…with 'email': (user email) as payload…and Discourse just knows my user has admin rights to be able to add that user to that group?

(…sorry, I’m fuzzy on why there are two routes for this same operation…)

6

I think so. I used How to reverse engineer the Discourse APIv to figure out the path. And then, I guess, looked at the source to see that the user ID and email address also work.

Yes, sso only updates groups on login, so api is your solution.