mattdm
Janvier 11, 2021, 8:57
1
I would prefer to not give a global API key to the wordpress plugin. I don’t want a compromise in the wordpress site to result in user accounts deleted (or edited, or logged out). However, limiting the scopes by guesswork seems to give weird results (like it can’t load subcategories).
What scopes does this actually need to work?
4 « J'aime »
Falco
Janvier 11, 2021, 10:24
2
With the Wordpress pre-dating the Admin API scopes by several years I doubt it can work with it.
It’s an interesting feature request.
mattdm
Janvier 11, 2021, 10:37
3
I would really appreciate it. The global API key can do a lot of things, and we’re using our Discourse instance for more than just the blog comments, so it’d be nice to keep it scoped to just what it needs.
mattdm
Janvier 11, 2021, 11:29
4
Is such a feature request better in this category, or in features?
angus
Janvier 12, 2021, 7:36
5
I’ve been thinking the same thing! (I currently maintain the plugin). This is the right category to raise it.
I’ll discuss it with @simon and get back to you.
3 « J'aime »
mattdm
Décembre 11, 2021, 5:47
6
@angus Est-ce que cela a abouti à quelque chose ? Nous aimerions utiliser cela sur l’un de nos sites WordPress où nous avons un ensemble d’utilisateurs avec un accès administrateur moins que strictement contrôlé, et je ne veux pas que cela devienne une escalade vers un accès administrateur complet sur notre site Discourse.
angus
Décembre 14, 2021, 5:55
7
Salut Matt, merci pour la relance. Je te donnerai une réponse complète d’ici la fin de la semaine.
1 « J'aime »
angus
Décembre 20, 2021, 2:15
8
@mattdm Une mise à jour à ce sujet. Je prépare des modifications qui vous permettront de générer une clé API avec des scopes spécifiques à l’ensemble des fonctionnalités du plugin WP Discourse que vous utilisez.
Cela nécessitera des modifications dans le cœur de Discourse, donc c’est sujet à approbation. Je vous tiendrai au courant cette semaine lorsque j’aurai soumis une PR.
2 « J'aime »
angus
Décembre 20, 2021, 9:50
9
@mattdm Mise à jour : il y a deux PRs à l’état de brouillon qui cherchent à résoudre ce problème. Comme mentionné, l’approche devra d’abord être approuvée. Notes plus explicatives sur le PR discourse/discourse.
main ← angusmcleod:fix_wordpress_scopes
opened 09:46AM - 20 Dec 21 UTC
I'm looking to add granular API key usage for the WP Discourse plugin. This invo… lves:
- Updating the "wordpress" default mappings to reflect the actions being used by the plugin, grouped by the feature-set they relate to (note that the existing "wordpress" action in the "topic" resource only relates to comment retrieval in the plugin, and is somewhat confusing in its current state).
- Adding a ``session/scopes`` endpoint, which returns the scopes associated with the api key in the request.
This is the companion PR on the plugin, which will provide further context to this: https://github.com/discourse/wp-discourse/pull/431. See in particular [``validate_scopes``](https://github.com/discourse/wp-discourse/pull/431/files#diff-5fd9ce264afeb5f617119db36e34a2e5a33f605527ac6fa9ee761b8123f1a17eR185).
If this approach is acceptable, I'll do some more testing before moving this out of draft. Below are some Q/A explaining my thinking behind this.
### Why does the wordpress plugin need granular scopes?
Currently the plugin requires the use of a global key, but only uses a subset of the actions, creating more risk than necessary. [See for example](https://meta.discourse.org/t/what-scopes-exactly-does-the-wordpress-api-key-need/175812).
### Why group the scopes by feature set?
This is how people use the plugin. Some use only SSO, some only publishing, some without comments etc. If a user is not using SSO they should be able to use a key that doesn't include the ``admin/user`` actions SSO requires.
Currently the "publishing" feature set cannot be totally disabled in the plugin (hence the "(required)" in the action description), however the ability to disable it (and just use SSO) may be added.
### Why add a ``session/scopes`` endpoint?
The WP Discourse plugin currently sends a request to ``/users/:username`` to test its connection to Discourse. This may be successful even if the allowed scopes are insufficient for how the plugin is configured.
A scopes endpoint tells the API consumer both whether the connection is successful and what scopes their key has. There's similar implementations in other APIs, e.g [Sendgrid](https://docs.sendgrid.com/api-reference/api-key-permissions/retrieve-a-list-of-scopes-for-which-this-user-has-access).
### Why add the ``scopes`` endpoint to the session controller?
The endpoint could go in a few different places. I figured it belonged there as essentially you're asking about the scopes in the session created when the api-authenticated request is made.
### Why not use a ``tokeninfo`` endpoint?
``tokeninfo`` endpoints are part of the OAuth 2.0 spec, which is not what we're dealing with here. Using it may be confusing.
main ← angusmcleod:granular_api_key_support
opened 09:16AM - 20 Dec 21 UTC
- Wordpress 6.0 support
- Granular API Key support (backwards compatible)
- Di… scourseConnect copy fix
- Add wpdc_publish_body filter
2 « J'aime »
mattdm
Avril 8, 2022, 6:35
10
Cela semble être bloqué. J’aimerais utiliser ce plugin pour Fedora Magazine, qui a une politique d’accès assez ouvert par conception — encore plus que le Fedora Community Blog avec lequel nous l’utilisons actuellement. Des nouvelles, par hasard ?
angus
Avril 9, 2022, 10:03
11
Merci pour la réponse rapide @mattdm , et le bon timing car je l’ai noté dans mon calendrier pour m’y remettre la semaine prochaine maintenant qu’il y a eu du mouvement sur le PR Discourse. Je vous donnerai des nouvelles la semaine prochaine.
1 « J'aime »
angus
Avril 18, 2022, 1:07
12
Juste une note que la partie Discourse de ceci a été soumise à l’examen (c’est-à-dire déplacée du brouillon).
main ← angusmcleod:fix_wordpress_scopes
opened 09:46AM - 20 Dec 21 UTC
I'm looking to add granular API key usage for the WP Discourse plugin. This invo… lves:
- Updating the "wordpress" default mappings to reflect the actions being used by the plugin, grouped by the feature-set they relate to (note that the existing "wordpress" action in the "topic" resource only relates to comment retrieval in the plugin, and is somewhat confusing in its current state).
- Adding a ``session/scopes`` endpoint, which returns the scopes associated with the api key in the request.
This is the companion PR on the plugin, which will provide further context to this: https://github.com/discourse/wp-discourse/pull/431. See in particular [``validate_scopes``](https://github.com/discourse/wp-discourse/pull/431/files#diff-5fd9ce264afeb5f617119db36e34a2e5a33f605527ac6fa9ee761b8123f1a17eR185).
If this approach is acceptable, I'll do some more testing before moving this out of draft. Below are some Q/A explaining my thinking behind this.
### Why does the wordpress plugin need granular scopes?
Currently the plugin requires the use of a global key, but only uses a subset of the actions, creating more risk than necessary. [See for example](https://meta.discourse.org/t/what-scopes-exactly-does-the-wordpress-api-key-need/175812).
### Why group the scopes by feature set?
This is how people use the plugin. Some use only SSO, some only publishing, some without comments etc. If a user is not using SSO they should be able to use a key that doesn't include the ``admin/user`` actions SSO requires.
Currently the "publishing" feature set cannot be totally disabled in the plugin (hence the "(required)" in the action description), however the ability to disable it (and just use SSO) may be added.
### Why add a ``session/scopes`` endpoint?
The WP Discourse plugin currently sends a request to ``/users/:username`` to test its connection to Discourse. This may be successful even if the allowed scopes are insufficient for how the plugin is configured.
A scopes endpoint tells the API consumer both whether the connection is successful and what scopes their key has. There's similar implementations in other APIs, e.g [Sendgrid](https://docs.sendgrid.com/api-reference/api-key-permissions/retrieve-a-list-of-scopes-for-which-this-user-has-access).
### Why add the ``scopes`` endpoint to the session controller?
The endpoint could go in a few different places. I figured it belonged there as essentially you're asking about the scopes in the session created when the api-authenticated request is made.
### Why not use a ``tokeninfo`` endpoint?
``tokeninfo`` endpoints are part of the OAuth 2.0 spec, which is not what we're dealing with here. Using it may be confusing.
Une fois que cela sera fusionné, la partie WP Discourse pourra être fusionnée et publiée.
2 « J'aime »
angus
Mai 24, 2022, 4:34
13
@mattdm Les scopes granulaires sont maintenant disponibles dans WP Discourse 2.4.3
edit Voici le guide !
6 « J'aime »
system
Juin 23, 2022, 4:35
14
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.
. Si vous utilisez la dernière version de Discourse et la dernière version du plugin, vous pourrez les utiliser. Je publierai un guide complet sur la façon de les utiliser plus tard dans la semaine.