# Triggering a backup via admin API causes the api\_key to become only valid for system user

**URL:** https://meta.discourse.org/t/triggering-a-backup-via-admin-api-causes-the-api-key-to-become-only-valid-for-system-user/77858
**Category:** Bug
**Created:** [January 12, 2018, 5:00pm UTC](https://meta.discourse.org/t/triggering-a-backup-via-admin-api-causes-the-api-key-to-become-only-valid-for-system-user/77858 "2018-01-12T17:00:56Z")
**Posts on this page:** 9
**Page:** 1

<div class="post-metadata">

### Author: ![supermathie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/supermathie/32/507518_2.png) [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [January 12, 2018, 5:00pm UTC](https://meta.discourse.org/t/triggering-a-backup-via-admin-api-causes-the-api-key-to-become-only-valid-for-system-user/77858/1 "2018-01-12T17:00:56Z")

</div>

Before:

 ![image](https://global.discourse-cdn.com/meta/original/3X/d/3/d31f2561d23ca8f52dcb02716beedf78e4382797.png)

Reproduction:

```plaintext
$ api_key=340496f95ab2f28cc45f575cbfcc28edd10db076beb1139da14b3fa80bb23dd2
$ curl -XPOST -H 'Content-Type: application/json' "http://discoursedev:3000/admin/backups.json?api_key=$api_key&api_username=michael" -d '{ "with_uploads": true }'
{"success":"OK"}
$ curl "http://discoursedev:3000/admin/backups.json?api_key=$api_key&api_username=michael"
(HTML error page as I'm in development mode)
$ curl "http://discoursedev:3000/admin/backups.json?api_key=$api_key&api_username=system"
[{"filename":"discourse-2018-01-12-112341-v20180111092141.sql.gz","size":3216556,"link":"//discourse/admin/backups/discourse-2018-01-12-112341-v20180111092141.sql.gz"}]

```

After:

 ![image](https://global.discourse-cdn.com/meta/original/3X/9/4/94d0c0fdd3a2df4440102710fa08ac19b1bbdaf9.png)

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [January 14, 2018, 9:48pm UTC](https://meta.discourse.org/t/triggering-a-backup-via-admin-api-causes-the-api-key-to-become-only-valid-for-system-user/77858/2 "2018-01-14T21:48:02Z")

</div>

Can you look at the underlying table, before and after?

```plaintext
bin/rails c
> ApiKey.all

```

---

<div class="post-metadata">

### Author: ![supermathie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/supermathie/32/507518_2.png) [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [January 15, 2018, 4:23pm UTC](https://meta.discourse.org/t/triggering-a-backup-via-admin-api-causes-the-api-key-to-become-only-valid-for-system-user/77858/3 "2018-01-15T16:23:57Z")

</div>

### Before

```plaintext
[4] pry(main)> ApiKey.all
  ApiKey Load (0.4ms) SELECT "api_keys".* FROM "api_keys"
=> [#<ApiKey:0x0000000d615e38
  id: 3,
  key: "scoobydoowhereareyou",
  user_id: nil,
  created_by_id: -1,
  created_at: Mon, 15 Jan 2018 16:20:10 UTC +00:00,
  updated_at: Mon, 15 Jan 2018 16:20:10 UTC +00:00,
  allowed_ips: nil,
  hidden: false>]

```

### Operation

```plaintext
○ → curl -XPOST -H 'Content-Type: application/json' \
  "http://discoursedev:3000/admin/backups.json?api_key=scoobydoowhereareyou&api_username=michael" \
  -d '{ "with_uploads": true }'
{"success":"OK"}

```

### After

```plaintext
[5] pry(main)> ApiKey.all
  ApiKey Load (0.3ms) SELECT "api_keys".* FROM "api_keys"
=> [#<ApiKey:0x000000064318d0
  id: 3,
  key: "scoobydoowhereareyou",
  user_id: -1,
  created_by_id: -1,
  created_at: Mon, 15 Jan 2018 16:20:10 UTC +00:00,
  updated_at: Mon, 15 Jan 2018 16:20:31 UTC +00:00,
  allowed_ips: nil,
  hidden: false>]

```

---

<div class="post-metadata">

### Author: ![codinghorror](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/codinghorror/32/110067_2.png) [@codinghorror](https://meta.discourse.org/u/codinghorror)
#### Post date: [July 9, 2018, 7:34am UTC](https://meta.discourse.org/t/triggering-a-backup-via-admin-api-causes-the-api-key-to-become-only-valid-for-system-user/77858/4 "2018-07-09T07:34:08Z")

</div>

How urgent is this to fix @supermathie? I’m unclear who this bug affects?

---

<div class="post-metadata">

### Author: ![supermathie](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/supermathie/32/507518_2.png) [@supermathie](https://meta.discourse.org/u/supermathie)
#### Post date: [July 9, 2018, 1:45pm UTC](https://meta.discourse.org/t/triggering-a-backup-via-admin-api-causes-the-api-key-to-become-only-valid-for-system-user/77858/5 "2018-07-09T13:45:51Z")

</div>

It’s likely not urgent to fix (I only came across it by accident), but it concern me that the codepath has an unintended side effect of modifying the API key used to access it.

---

<div class="post-metadata">

### Author: ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)
#### Post date: [July 10, 2018, 1:45am UTC](https://meta.discourse.org/t/triggering-a-backup-via-admin-api-causes-the-api-key-to-become-only-valid-for-system-user/77858/6 "2018-07-10T01:45:12Z")

</div>

Maybe @zogstrip can have a quick look here, my guess is that something about the restore process may be fussing with api keys post restore.

---

<div class="post-metadata">

### Author: ![zogstrip](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/zogstrip/32/512781_2.png) [@zogstrip](https://meta.discourse.org/u/zogstrip)
#### Post date: [July 10, 2018, 6:06am UTC](https://meta.discourse.org/t/triggering-a-backup-via-admin-api-causes-the-api-key-to-become-only-valid-for-system-user/77858/7 "2018-07-10T06:06:43Z")

</div>

I don’t think it’s related to the restore process since @supermathie is just doing a backup 😳

But yeah, I’ll have a look.

---

<div class="post-metadata">

### Author: ![gerhard](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/gerhard/32/119479_2.png) [@gerhard](https://meta.discourse.org/u/gerhard)
#### Post date: [September 4, 2018, 11:32pm UTC](https://meta.discourse.org/t/triggering-a-backup-via-admin-api-causes-the-api-key-to-become-only-valid-for-system-user/77858/9 "2018-09-04T23:32:30Z")

</div>

I gave it a quick try since I was working on backups. I can’t reproduce it. I’m closing it for now.

---

<div class="post-metadata">

### Author: ![gerhard](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/gerhard/32/119479_2.png) [@gerhard](https://meta.discourse.org/u/gerhard)
#### Post date: [September 4, 2018, 11:32pm UTC](https://meta.discourse.org/t/triggering-a-backup-via-admin-api-causes-the-api-key-to-become-only-valid-for-system-user/77858/10 "2018-09-04T23:32:37Z")

</div>