לא ניתן לערוך נושא באמצעות API למרות שיש גישת כתיבה לנושא

Contribute Bug

סיכום מבוסס בינה מלאכותית

mkows reported a bug where users with Topic Write access via API cannot edit a topic’s title unless the API key has Global scope, despite expecting granular permissions to suffice. The error returned is “You are not permitted to view the requested resource. The API username or key is invalid.” pfaffman clarified the intent was to modify an existing topic, not create one. blake acknowledged the issue, suspecting the system only checked POST permissions and not PUT for updates. A fix was implemented introducing a new update topic scope, allowing topic title edits with properly scoped keys as shown with a successful PUT request using the new scope. This resolves the inconsistency between expected granular permissions and actual behavior.

1

Hey all,

I noticed that, despite having Topic Write access, I am not allowed to edit topic’s title.
This seem to only work when API key has a global scope.

With API key that has the following permission scopes:

Screenshot 2022-03-02 at 12.29.46
Screenshot 2022-03-02 at 12.29.461528×1084 94.7 KB

I am getting:

curl 'https://__NAME__.discourse.team/t/-/19.json' \
  -H "Api-Key: 3990a1..." \
  -H "Api-Username: system" \
  -H "Content-Type: application/json" \
  -X PUT \
  -d "{ \"title\": \"Title - test curl v5\" }"

{"errors":["You are not permitted to view the requested resource. The API username or key is invalid."],"error_type":"invalid_access"}

And I get the same response when I select all granular scopes.

Only when creating an API key with Scope: Global, I manage to edit topic’s title:

curl 'https://__NAME__.discourse.team/t/-/19.json' \
  -H "Api-Key: 0adc49d..." \
  -H "Api-Username: system" \
  -H "Content-Type: application/json" \
  -X PUT \
  -d "{ \"title\": \"Title - test curl v5\" }"

{"basic_topic":{"id":19,"title":"Title - test curl v5","fancy_title":"Title - test curl v5","slug":"title-test-curl-v5","posts_count":2}}

I would expect from topic write access to support edit operation. It seems to me like enforcing global scope for that is not desired.

2 לייקים
2

Are you trying to write a new topic or modify an existing one?

3

@pfaffman I am trying to edit topic’s title via update topic endpoint Discourse API Docs

2 לייקים
5

I’ll look into the api scoping for this. My guess is it is only looking at the POST request and not the PUT request for updating.

לייק 1
6

There is now an update topic scope that you can use for this.

image
image1471×405 16.7 KB

curl -i -sS -X PUT "http://localhost:4200/t/-/101.json"  \
-H "Content-Type: multipart/form-data"  \
-H "Api-Key: 54096675ed84dcf0016a3b05199cccde67e5175057e53f8e005e2625940a15e6"  \
-H "Api-Username: blake.erickson"  \
-F "title=8bd599 cae3dfdbf 7210753"

HTTP/1.1 200 OK
5 לייקים