99 Commits (37ace54ab3ce0732fa03c72a9a9248e47e8b5489)

Author	SHA1	Message	Date
Henriette Dinger	bd7f4e4814	Update copyright notice	5 years ago
ulferts	0a9a7f02d1	fix content type in error handling	5 years ago
ulferts	17bd411b53	adapt the api authorization to the bcf api	5 years ago
ulferts	3a89fceb0d	error handling in bcf v2.1	5 years ago
ulferts	c6b17e8a7a	extract root api into separate superclass	5 years ago
Oliver Günther	8a8193fa15	Add info on thread and connection pool for timeouts errors ... - Added to Rails controller request handling - Added to API root to catch all api requests as well Tested on sentry with both as https://sentry.openproject.com/sentry/localhost/issues/909/?query=is:unresolved	5 years ago
Oliver Günther	7ac2805779	Save integer relative positions by computing spaces between	5 years ago
Oliver Günther	1b5fc32366	Avoid before blocks and raw params access for IDs ... Grape's validation runs after a `before` block so we should avoid using raw params there and instead using `declared(params)` which returns only the validated whitelisted params, much like a permitted params hash.	6 years ago
Oliver Günther	f487fcacca	[30092] Use delegated logger (sentry) for logged API errors	6 years ago
Jens Ulferts	02cdabed65	prevent access to user api for locked admins	6 years ago
Oliver Günther	c5e14322ae	Fix #new on internal api error ... https://sentry.openproject.com/sentry/saas-openproject-prod/issues/21/?query=is:unresolved	6 years ago
Oliver Günther	8408f86fef	Improve usage of I18n in model specs ... This will avoid loading I18n translations in single-use cases where it would not be loaded anyway	6 years ago
Oliver Günther	6ef4211e77	Bump copyright to 2018 (#6171) ... [ci skip]	7 years ago
Jens Ulferts	77370d58ad	document custom actions	7 years ago
ulferts	c88b0b85c4	return proper WWW Authenticate header on missing credentials (#6150) ... An anonymous_fallback is introduced and registered to be the last strategy for warden. That strategy will always apply and it will always return the anonymous user. The better way would be to only apply the strategy if login is not required. That way we would still be able to return a 403 when credentials are missing but would no longer need to have 401 handlers outside of warden. That duplicity caused the missing header in the first place. It would however require us to handle the realm in the strategy and by that increase the coupling between the strategy and the application. [ci skip]	7 years ago
Oliver Günther	ac389b869d	Fix other request specs by adding json header	7 years ago
Oliver Günther	4d0bad7efc	Allow endpoints to override content types (attachments!)	7 years ago
Oliver Günther	8282c465cb	[26318] Enforce APIv3 content-type ... https://community.openproject.com/wp/26318	7 years ago
Oliver Günther	92060508a9	Remove unused test helper	7 years ago
ulferts	9c8f7f3ca1	read operations for time_entries via api v3 (#5776) ... * read operations for time_entries via api v3 Introduces the endpoints: * GET /api/v3/time_entries * GET /api/v3/time_entries/:id * GET /api/v3/time_entries/activities/:id The index action for time entries can be queried by the following filters: * project_id * user_id * work_package_id The implementation is exposing the database structure mostly one to one with the exception of some renaming and the hiding of the activities' complexity, where only the activity used systemwide is referenced regardless of whether a project specific override exists or not. * allow custom values for time entries [ci skip]	7 years ago
ulferts	36ab671d27	log stacktrace on api error (#5450) ... [ci skip]	8 years ago
Jens Ulferts	80c242dd53	embed query results in query representer ... This is only done when the representer is not embedded itself, e.g. when it is part of a collection.	8 years ago
Oliver Günther	7cf11bb689	Update copyright notice	8 years ago
Jens Ulferts	a52c8ee07d	allow for filtering the queries in the API v3 ... Only implements the `project` filter for now which can be used to differntiate between queries from specific projects and can also be used to specify that the client is only interested in global queries	8 years ago
Jens Ulferts	b3848c879b	grant access to API v3 GET queries also for manage_public_queries	8 years ago
Oliver Günther	29d69a3fc5	Introduce header and Rails caching for schemas ... This commit introduces cached project-scoped work packages schema. Their caches are expired on a key based on - the Project ID - the Type ID - the allowed custom fields for the given project This commit only caches schema, not form endpoints.	9 years ago
Jan Sandbrink	f9cb083481	in production handle internal API errors gracefully ... - still allow for useful errors during development - let all own exceptions inherit from StandardError, the thing you should use for own errors...	9 years ago
Jan Sandbrink	4c0a6f4ba1	pass block parameter through :authorize	9 years ago
Jan Sandbrink	bc36704611	allow to get queries via APIv3 ... - one of those missing endpoints - adapted resource spec to be closer to other resource specs - specified error behaviour (missing permissions) -> change: not being allowed to see a query results in 404	9 years ago
Jens Ulferts	6e01b27f18	rename service's method to be in accordance with proc	9 years ago
Jens Ulferts	c471080e08	set locale before API v3 request ... The mechanism was extracted from the rails stack where the locale is taken based on (in that order): * The user's preferences * The accept_language header * The system settings Only languages, that are enabled by the instance are valid. If one is selected (e.g user preference), that is not enabled by the instance, a fallback is taken.	9 years ago
Alex Coles	29d9814347	Prefer Project.allowed_to to .allowed_to_condition ... Use `ActiveRecord::Relation#merge` to merge scopes. Signed-off-by: Alex Coles <alex@alexbcoles.com>	9 years ago
Markus Kahl	3865ce4f1f	polish	10 years ago
Markus Kahl	bcd981df5c	consider X-Authentication-Scheme; opt scoped realm	10 years ago
Markus Kahl	d854df5175	suppress browser prompt on authenticate failure	10 years ago
Alex Coles	a6212fb304	Fix syntax (w/Rubocop) in lib code ... Signed-off-by: Alex Coles <alex@alexbcoles.com>	10 years ago
Jan Sandbrink	7d443154b3	parse attachment metadata using a representer ... - adding general error handling for parse errors - changing the default error message for parse errors, which was very form specific before	10 years ago
Jan Sandbrink	50f6ecdecd	accept new request format for add watcher ... also adapt the angular frontend to speak the new format	10 years ago
Markus Kahl	70fe41cb53	use separate error code when unauthenticated ... also distinct error messages for missing or wrong credentials	10 years ago
Markus Kahl	c1e597c186	fixed response headers (content type, realm)	10 years ago
Markus Kahl	d990d5f2f7	restored order	10 years ago
Markus Kahl	5b05bfec90	DRYing	10 years ago
Markus Kahl	28d3dfd827	set WWW-Authenticate header on authentication failure	10 years ago
Markus Kahl	32a26429b7	I don't even	10 years ago
Markus Kahl	5ba15f3b5c	removed unnecessary/wrong use of present?	10 years ago
Markus Kahl	7b3df308d0	removed obsolete code/comment	10 years ago
Markus Kahl	d368aa85b6	be more positive	10 years ago
Markus Kahl	6bbcc3b269	root.rb auth refactoring	10 years ago
Markus Kahl	6cb6953a07	basic auth for api v3 (WIP)	10 years ago
Alexander Bach	ea37a810cb	Removed dangerously redundant block argument	10 years ago