Unable to edit topic via API despite topic write access

Bug
1

Hey all,

I noticed that, despite having Topic Write access, I am not allowed to edit topic’s title.
This seem to only work when API key has a global scope.

With API key that has the following permission scopes:

Screenshot 2022-03-02 at 12.29.46
Screenshot 2022-03-02 at 12.29.461528×1084 94.7 KB

I am getting:

curl 'https://__NAME__.discourse.team/t/-/19.json' \
  -H "Api-Key: 3990a1..." \
  -H "Api-Username: system" \
  -H "Content-Type: application/json" \
  -X PUT \
  -d "{ \"title\": \"Title - test curl v5\" }"

{"errors":["You are not permitted to view the requested resource. The API username or key is invalid."],"error_type":"invalid_access"}

And I get the same response when I select all granular scopes.

Only when creating an API key with Scope: Global, I manage to edit topic’s title:

curl 'https://__NAME__.discourse.team/t/-/19.json' \
  -H "Api-Key: 0adc49d..." \
  -H "Api-Username: system" \
  -H "Content-Type: application/json" \
  -X PUT \
  -d "{ \"title\": \"Title - test curl v5\" }"

{"basic_topic":{"id":19,"title":"Title - test curl v5","fancy_title":"Title - test curl v5","slug":"title-test-curl-v5","posts_count":2}}

I would expect from topic write access to support edit operation. It seems to me like enforcing global scope for that is not desired.

2 Likes
2

Are you trying to write a new topic or modify an existing one?

3

@pfaffman I am trying to edit topic’s title via update topic endpoint Discourse API Docs

2 Likes
5

I’ll look into the api scoping for this. My guess is it is only looking at the POST request and not the PUT request for updating.

1 Like
6

There is now an update topic scope that you can use for this.

image
image1471×405 16.7 KB 

curl -i -sS -X PUT "http://localhost:4200/t/-/101.json"  \
-H "Content-Type: multipart/form-data"  \
-H "Api-Key: 54096675ed84dcf0016a3b05199cccde67e5175057e53f8e005e2625940a15e6"  \
-H "Api-Username: blake.erickson"  \
-F "title=8bd599 cae3dfdbf 7210753"

HTTP/1.1 200 OK
5 Likes