85 Commits (74c81447a405c33319b8b4344b7f926991ef6331)

Author	SHA1	Message	Date
ulferts	c88b0b85c4	return proper WWW Authenticate header on missing credentials (#6150) ... An anonymous_fallback is introduced and registered to be the last strategy for warden. That strategy will always apply and it will always return the anonymous user. The better way would be to only apply the strategy if login is not required. That way we would still be able to return a 403 when credentials are missing but would no longer need to have 401 handlers outside of warden. That duplicity caused the missing header in the first place. It would however require us to handle the realm in the strategy and by that increase the coupling between the strategy and the application. [ci skip]	7 years ago
Oliver Günther	ac389b869d	Fix other request specs by adding json header	7 years ago
Oliver Günther	4d0bad7efc	Allow endpoints to override content types (attachments!)	7 years ago
Oliver Günther	8282c465cb	[26318] Enforce APIv3 content-type ... https://community.openproject.com/wp/26318	7 years ago
Oliver Günther	92060508a9	Remove unused test helper	7 years ago
ulferts	9c8f7f3ca1	read operations for time_entries via api v3 (#5776) ... * read operations for time_entries via api v3 Introduces the endpoints: * GET /api/v3/time_entries * GET /api/v3/time_entries/:id * GET /api/v3/time_entries/activities/:id The index action for time entries can be queried by the following filters: * project_id * user_id * work_package_id The implementation is exposing the database structure mostly one to one with the exception of some renaming and the hiding of the activities' complexity, where only the activity used systemwide is referenced regardless of whether a project specific override exists or not. * allow custom values for time entries [ci skip]	7 years ago
ulferts	36ab671d27	log stacktrace on api error (#5450) ... [ci skip]	8 years ago
Jens Ulferts	80c242dd53	embed query results in query representer ... This is only done when the representer is not embedded itself, e.g. when it is part of a collection.	8 years ago
Oliver Günther	7cf11bb689	Update copyright notice	8 years ago
Jens Ulferts	a52c8ee07d	allow for filtering the queries in the API v3 ... Only implements the `project` filter for now which can be used to differntiate between queries from specific projects and can also be used to specify that the client is only interested in global queries	8 years ago
Jens Ulferts	b3848c879b	grant access to API v3 GET queries also for manage_public_queries	8 years ago
Oliver Günther	29d69a3fc5	Introduce header and Rails caching for schemas ... This commit introduces cached project-scoped work packages schema. Their caches are expired on a key based on - the Project ID - the Type ID - the allowed custom fields for the given project This commit only caches schema, not form endpoints.	9 years ago
Jan Sandbrink	f9cb083481	in production handle internal API errors gracefully ... - still allow for useful errors during development - let all own exceptions inherit from StandardError, the thing you should use for own errors...	9 years ago
Jan Sandbrink	4c0a6f4ba1	pass block parameter through :authorize	9 years ago
Jan Sandbrink	bc36704611	allow to get queries via APIv3 ... - one of those missing endpoints - adapted resource spec to be closer to other resource specs - specified error behaviour (missing permissions) -> change: not being allowed to see a query results in 404	9 years ago
Jens Ulferts	6e01b27f18	rename service's method to be in accordance with proc	9 years ago
Jens Ulferts	c471080e08	set locale before API v3 request ... The mechanism was extracted from the rails stack where the locale is taken based on (in that order): * The user's preferences * The accept_language header * The system settings Only languages, that are enabled by the instance are valid. If one is selected (e.g user preference), that is not enabled by the instance, a fallback is taken.	9 years ago
Alex Coles	29d9814347	Prefer Project.allowed_to to .allowed_to_condition ... Use `ActiveRecord::Relation#merge` to merge scopes. Signed-off-by: Alex Coles <alex@alexbcoles.com>	9 years ago
Markus Kahl	3865ce4f1f	polish	9 years ago
Markus Kahl	bcd981df5c	consider X-Authentication-Scheme; opt scoped realm	9 years ago
Markus Kahl	d854df5175	suppress browser prompt on authenticate failure	9 years ago
Alex Coles	a6212fb304	Fix syntax (w/Rubocop) in lib code ... Signed-off-by: Alex Coles <alex@alexbcoles.com>	9 years ago
Jan Sandbrink	7d443154b3	parse attachment metadata using a representer ... - adding general error handling for parse errors - changing the default error message for parse errors, which was very form specific before	10 years ago
Jan Sandbrink	50f6ecdecd	accept new request format for add watcher ... also adapt the angular frontend to speak the new format	10 years ago
Markus Kahl	70fe41cb53	use separate error code when unauthenticated ... also distinct error messages for missing or wrong credentials	10 years ago
Markus Kahl	c1e597c186	fixed response headers (content type, realm)	10 years ago
Markus Kahl	d990d5f2f7	restored order	10 years ago
Markus Kahl	5b05bfec90	DRYing	10 years ago
Markus Kahl	28d3dfd827	set WWW-Authenticate header on authentication failure	10 years ago
Markus Kahl	32a26429b7	I don't even	10 years ago
Markus Kahl	5ba15f3b5c	removed unnecessary/wrong use of present?	10 years ago
Markus Kahl	7b3df308d0	removed obsolete code/comment	10 years ago
Markus Kahl	d368aa85b6	be more positive	10 years ago
Markus Kahl	6bbcc3b269	root.rb auth refactoring	10 years ago
Markus Kahl	6cb6953a07	basic auth for api v3 (WIP)	10 years ago
Alexander Bach	ea37a810cb	Removed dangerously redundant block argument	10 years ago
Jan Sandbrink	21f5b2c608	enforce JSON response-format for errors ... errors are always responded to with an appropriate HAL+JSON object, so it does not matter which format the answer usually is expected to have (e.g. text/plain for the render-API)	10 years ago
Jan Sandbrink	f0863f9d53	allow to patch existing API endpoints	10 years ago
Jan Sandbrink	b4c50b7c04	relax access to types resource	10 years ago
Alexander Bach	b3725f2658	Remove redundant call parameters	10 years ago
Alexander Bach	92e23145d4	Some easy style fixes	10 years ago
Alexander Bach	409073f7e3	Generalized 404 error message	10 years ago
Alexander Bach	d895b82db6	Some minor style fixes	10 years ago
Alexander Bach	bd1ffaee10	Fix authorize usage	10 years ago
Alexander Bach	65c39db9cf	Some minor style fixes	10 years ago
Alexander Bach	21c50fd41a	Accessing a project without permission now returns 404 instead of 403	10 years ago
Jens Ulferts	6f54490368	force User.current to be set on API	10 years ago
Jens Ulferts	7cd45d42bc	enforce authorization on versions of project api resource	10 years ago
Jens Ulferts	ad65c39a2f	authorization on version endpoint	10 years ago
Alex Coles	e0191e759c	Update year in copyright header to 2015 ... [ci skip]	10 years ago