http://hg.code.sf.net:8000/p/roundup/code/atom-log/tip/doc/rest.txt Mercurial Repository: p/roundup/code: doc/rest.txt history 2026-04-09T00:19:06-04:00 [default] doc: issue2551415 correct doc for change input->input_payload http://hg.code.sf.net:8000/p/roundup/code/#changeset-e4191aa7b402fd9aaf43be61c9a3eb7fd6514df8 John Rouillard rouilj@ieee.org 2026-04-09T00:19:06-04:00 2026-04-09T00:19:06-04:00
changeset e4191aa7b402
branch default
bookmark
tag tip
user John Rouillard <rouilj@ieee.org>
description doc: issue2551415 correct doc for change input->input_payload

in 2.5 the rest interface changed a variable name from input to
input_payload. An earlier commit changed the rest docs. This commit
adds an item for it to the upgrading 2.4.0->2.5.0 section. Also cross
reference added to the rest docs with the updated examples.
files
doc: rename input in examples to input_payload http://hg.code.sf.net:8000/p/roundup/code/#changeset-909cf30c01c1932df979192b0cb6102ba532a7cf John Rouillard rouilj@ieee.org 2026-04-08T22:20:06-04:00 2026-04-08T22:20:06-04:00
changeset 909cf30c01c1
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description doc: rename input in examples to input_payload

the variable input shadows the built-in function input().
files
refactor: rework mime type comparison and clean code http://hg.code.sf.net:8000/p/roundup/code/#changeset-1ffa1f42e1da553ec00de19d45536262bdf3577d John Rouillard rouilj@ieee.org 2026-03-24T21:30:47-04:00 2026-03-24T21:30:47-04:00
changeset 1ffa1f42e1da
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description refactor: rework mime type comparison and clean code

rest.py:

accept application/* as match for application/json in non
/binary_context rest path.

allow defining default mime type to return when file/message is
missing mime type. Make it a class variable to it can be changed from
text/plain to text/markdown or whatever.

extract code from determine_output_format() to create
create_valid_content_types() method which returns a list of matching
mime types for a given type/subtype.

Eliminate mostly duplicate return statements by introducing a variable
to specify valid mime types in error message.

rest_common.py:

Fix error messages that now return application/* as valid mime type.

CHANGES.txt upgrading.txt rest.txt:

top level notes and corrections.

Also correct rst syntax on earlier change.
files
doc: remove potentially, it is incorrect. http://hg.code.sf.net:8000/p/roundup/code/#changeset-e7dc47f4d501af13ba83782e1536e2bb894b8060 John Rouillard rouilj@ieee.org 2025-07-12T20:57:56-04:00 2025-07-12T20:57:56-04:00
changeset e7dc47f4d501
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description doc: remove potentially, it is incorrect.
files
docs: change some last 3.6 references to 3.7 with dropping of 3.6. http://hg.code.sf.net:8000/p/roundup/code/#changeset-5145ad81970a429f70a75cab80f3f901ee5dd7ed John Rouillard rouilj@ieee.org 2025-06-11T16:00:44-04:00 2025-06-11T16:00:44-04:00
changeset 5145ad81970a
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description docs: change some last 3.6 references to 3.7 with dropping of 3.6.
files
doc: explicitly refer to POE lifetime in seconds. http://hg.code.sf.net:8000/p/roundup/code/#changeset-11ebd3a19c9a96ef178de500913888e0620afda2 John Rouillard rouilj@ieee.org 2024-12-19T17:51:48-05:00 2024-12-19T17:51:48-05:00
changeset 11ebd3a19c9a
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description doc: explicitly refer to POE lifetime in seconds.
files
fix(REST): issue2551383; improve errors for bad json, fix PUT docs http://hg.code.sf.net:8000/p/roundup/code/#changeset-32aaf5dc562be2b244cc3ee62e26ff2e53a1ae6e John Rouillard rouilj@ieee.org 2024-12-17T19:42:46-05:00 2024-12-17T19:42:46-05:00
changeset 32aaf5dc562b
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description fix(REST): issue2551383; improve errors for bad json, fix PUT docs

While adding fuzz testing for email addresses via REST
/rest/data/user/1/address, I had an error when setting the address to
the same value it currently had. Traced this to a bug in
userauditor.py. Fixed the bug. Documented in upgrading.txt.

While trying to track down issue, I realized invalid json was being
accepted without error. So I fixed the code that parses the json and
have it return an error. Also modified some tests that broke (used
invalid json, or passed body (e.g. DELETE) but shouldn't have. Add
tests for bad json to verify new code.

Fixed test that wasn't initializing the body_file in each loop, so the
test wasn't actually supplying a body.

Also realised PUT documentation was not correct. Output format isn't
quite like GET.

Fuss tests for email address also added.
files
doc: fix typo. http://hg.code.sf.net:8000/p/roundup/code/#changeset-79b9343794f5da2925436d36ee3e96ddebd71518 John Rouillard rouilj@ieee.org 2024-12-15T01:35:51-05:00 2024-12-15T01:35:51-05:00
changeset 79b9343794f5
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description doc: fix typo.
files
feat: issue2551068 - Provide way to retrieve file/msg data via rest endpoint. http://hg.code.sf.net:8000/p/roundup/code/#changeset-d02ce1d14acd90b980c4e5c2bf5d2bba4c950e9e John Rouillard rouilj@ieee.org 2024-12-08T17:22:33-05:00 2024-12-08T17:22:33-05:00
changeset d02ce1d14acd
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description feat: issue2551068 - Provide way to retrieve file/msg data via rest endpoint.

Use Allow header to change format of /binary_content endpoint. If
Allow header for endpoint is not application/json, it will be matched
against the mime type for the file. */*, text/* are supported and will
return the native mime type if present.

Changes:

move */* mime type from static dict of supported types. It was
hardcoded to return json only. Now it can return a matching
non-json mime type for the /binary_content endpoint.

Edited some errors to explicitly add */* mime type.

Cleanups to use ', ' separation in lists of valid mime types rather
than just space separated.

Remove ETag header when sending raw content. See issue 2551375 for
background.

Doc added to rest.txt.

Small format fix up (add dash) in CHANGES.txt.

Make passing an unset/None/False accept_mime_type to
format_dispatch_output a 500 error. This used to be the fallback
to produce a 406 error after all processing had happened. It
should no longer be possible to take that code path as all 406
errors (with valid accept_mime_types) are generated before
processing takes place.

Make format_dispatch_output handle output other than json/xml so it
can send back binary_content data.

Removed a spurious client.response_code = 400 that seems to not be
used.

Tests added for all code paths.

Database setup for tests msg and file entry. This required a file
upload test to change so it doesn't look for file1 as the link
returned by the upload. Download the link and verify the data
rather than verifying the link.

Multiple formatting changes to error messages to make all lists of
valid mime types ', ' an not just space separated.
files
Documentation and fix for REST headers http://hg.code.sf.net:8000/p/roundup/code/#changeset-bd628e64725fa53de526d1cea90635bfc139672c Ralf Schlatterbeck rsc@runtux.com 2024-12-04T10:45:26+01:00 2024-12-04T10:45:26+01:00
changeset bd628e64725f
branch
bookmark
tag
user Ralf Schlatterbeck <rsc@runtux.com>
description Documentation and fix for REST headers

issue2551372 - Better document necessary headers for REST and fix
logging to log missing Origin header.
files
issue2551315 - Allow admin settable max number of rows to be returned by rest interface. http://hg.code.sf.net:8000/p/roundup/code/#changeset-2244205dd7c45a898457d00e4e602c54a8eb3293 John Rouillard rouilj@ieee.org 2024-07-17T22:57:25-04:00 2024-07-17T22:57:25-04:00
changeset 2244205dd7c4
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description issue2551315 - Allow admin settable max number of rows to be returned by rest interface.

Documented default value.
files
issue2551315 - Allow admin settable max number of rows to be returned by rest interface. http://hg.code.sf.net:8000/p/roundup/code/#changeset-e97caa8e4daeedf58cbd46fe6be28d8a8a0d7f14 John Rouillard rouilj@ieee.org 2024-07-17T22:54:28-04:00 2024-07-17T22:54:28-04:00
changeset e97caa8e4dae
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description issue2551315 - Allow admin settable max number of rows to be returned by rest interface.

Documented use of RestfulInstance.max_response_row_size to limit data
returned from rest request.
files
docs: fix some missing/broken links. http://hg.code.sf.net:8000/p/roundup/code/#changeset-57ef20b6c003673d05a572265bb80d8b9bf3e509 John Rouillard rouilj@ieee.org 2024-07-12T22:23:32-04:00 2024-07-12T22:23:32-04:00
changeset 57ef20b6c003
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description docs: fix some missing/broken links.
files
doc: update JWT example to use utcnow from anypy_datetime_ http://hg.code.sf.net:8000/p/roundup/code/#changeset-f023b66c297d6c372312f50b5f7f08e0303a762f John Rouillard rouilj@ieee.org 2024-06-04T11:33:51-04:00 2024-06-04T11:33:51-04:00
changeset f023b66c297d
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description doc: update JWT example to use utcnow from anypy_datetime_

datetime.datetime.utcnow() is deprecated. Use replacement utcnow()
from roundup.anypy.datetime_.
files
docs: fix formatting. http://hg.code.sf.net:8000/p/roundup/code/#changeset-372517700dad1b58e7abaafabfd1475bb12f189b John Rouillard rouilj@ieee.org 2024-05-21T23:48:08-04:00 2024-05-21T23:48:08-04:00
changeset 372517700dad
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description docs: fix formatting.
files
doc: add /rest/data/user/roles ignores query options http://hg.code.sf.net:8000/p/roundup/code/#changeset-ab3506b9e315966e1bf813909e9b91611ec4e0a1 John Rouillard rouilj@ieee.org 2024-05-21T17:07:16-04:00 2024-05-21T17:07:16-04:00
changeset ab3506b9e315
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description doc: add /rest/data/user/roles ignores query options

So you can add ?@verbose=2 etc. for compatibility with a real
collection endpoint, but it ignores them.
files
feat: document the /rest/data/user/roles endpoint http://hg.code.sf.net:8000/p/roundup/code/#changeset-425dd9854e349e23cce0cab0ebb68cb5dd0b0424 John Rouillard rouilj@ieee.org 2024-05-21T16:38:42-04:00 2024-05-21T16:38:42-04:00
changeset 425dd9854e34
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description feat: document the /rest/data/user/roles endpoint
files
doc: ad use of openssl rand to generate jwt secret. http://hg.code.sf.net:8000/p/roundup/code/#changeset-d4aef2b004a14f4af4c5190a7451caef8558b912 John Rouillard rouilj@ieee.org 2024-04-18T15:21:15-04:00 2024-04-18T15:21:15-04:00
changeset d4aef2b004a1
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description doc: ad use of openssl rand to generate jwt secret.

Recommend use of 'openssl rand -base64 32' for creating minimal jwt_secret.
files
Add @group for grouping in rest interface. http://hg.code.sf.net:8000/p/roundup/code/#changeset-171ff2e487df6dc44ca77055be8a33cf718a7208 John Rouillard rouilj@ieee.org 2024-04-01T14:42:36-04:00 2024-04-01T14:42:36-04:00
changeset 171ff2e487df
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description Add @group for grouping in rest interface.

Helpful for using optgroup in select boxes.
files
issue2551328/issue2551264 unneeded next link and total_count incorrect http://hg.code.sf.net:8000/p/roundup/code/#changeset-03c1b7ae3a6827724ecf71b9674ebb50541f0648 John Rouillard rouilj@ieee.org 2024-04-01T09:57:16-04:00 2024-04-01T09:57:16-04:00
changeset 03c1b7ae3a68
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description issue2551328/issue2551264 unneeded next link and total_count incorrect

Fix: issue2551328 - REST results show next link if number of
results is a multiple of page size. (Found by members of
team 3 in the UMass-Boston CS682 Spring 2024 class.)

issue2551264 - REST X-Total-Count header and @total_size
count incorrect when paginated

These issues arose because we retrieved the exact number of rows
from the database as requested by the user using the @page_size
parameter. With this changeset, we retrieve up to 10 million + 1
rows from the database. If the total number of rows exceeds 10
million, we set the total_count indicators to -1 as an invalid
size. (The max number of requested rows (default 10 million +1)
can be modified by the admin through interfaces.py.)

By retrieving more data than necessary, we can calculate the
total count by adding @page_index*@page_size to the number of
rows returned by the query.

Furthermore, since we return more than @page_size rows, we can
determine the existence of a row at @page_size+1 and use that
information to determine if a next link should be
provided. Previously, a next link was returned if @page_size rows
were retrieved.

This change does not guarantee that the user will get @page_size
rows returned. Access policy filtering occurs after the rows are
returned, and discards rows inaccessible by the user.

Using the current @page_index/@page_size it would be difficult to
have the roundup code refetch data and make sure that a full
@page_size set of rows is returned. E.G. @page_size=100 and 5 of
them are dropped due to access restrictions. We then fetch 10
items and add items 1-4 and 6 (5 is inaccessible). There is no
way to calculate the new database offset at:
@page_index*@page_size + 6 from the URL. We would need to add an
@page_offset=6 or something.

This could work since the client isn't adding 1 to @page_index to
get the next page. Thanks to HATEOAS, the client just uses the
'next' url. But I am not going to cross that bridge without a
concrete use case.

This can also be handled client side by merging a short response
with the next response and re-paginating client side.

Also added extra index markers to the docs to highlight use of
interfaces.py.
files
doc: remove unneeded word. http://hg.code.sf.net:8000/p/roundup/code/#changeset-ee0062411160efb0321517652d6e909d508f670c John Rouillard rouilj@ieee.org 2024-03-24T13:16:05-04:00 2024-03-24T13:16:05-04:00
changeset ee0062411160
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description doc: remove unneeded word.
files
feat: add support for rotating jwt keys http://hg.code.sf.net:8000/p/roundup/code/#changeset-be6cb2e0d47124399ccfc3326690c7c2049713c6 John Rouillard rouilj@ieee.org 2024-03-14T19:04:19-04:00 2024-03-14T19:04:19-04:00
changeset be6cb2e0d471
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description feat: add support for rotating jwt keys

This allows jwt_secret to have multiple ',' separated secrets. The
first/leftmost should be used to sign new JWTs. All of them are used
(starting from left/newest) to try to verify a JWT.

If the first secret is < 32 chars in length JWTs are disabled. If any
of the other secrets are < 32 chars, the configuration code causes the
software to exit. This prevents insecure (too short) secrets from
being used.

Updated doc examples and tests.
files
doc: run sphinx-lint over docs. http://hg.code.sf.net:8000/p/roundup/code/#changeset-af898d1d66dc52129bad577f3c0c0422653466c3 John Rouillard rouilj@ieee.org 2024-03-13T00:51:09-04:00 2024-03-13T00:51:09-04:00
changeset af898d1d66dc
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description doc: run sphinx-lint over docs.

Pointed out mutiple use of `x` where it should be ``x``. Also trailing
whitespace and lines that are too long. Replaced all tabs by
spaces. Also fixed spelling error while I was there. Fixed broken
internal link.
files
doc: fix other tables to align cells at top of row. http://hg.code.sf.net:8000/p/roundup/code/#changeset-835b248bf9fdcb1fe1ba437ea08ca31ed3e92e1d John Rouillard rouilj@ieee.org 2024-02-05T16:57:09-05:00 2024-02-05T16:57:09-05:00
changeset 835b248bf9fd
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description doc: fix other tables to align cells at top of row.
files
doc: fix link; make cells in table align at top http://hg.code.sf.net:8000/p/roundup/code/#changeset-4c85e3e16dfe50c6902074914af37a01846e7d3a John Rouillard rouilj@ieee.org 2024-02-05T16:49:21-05:00 2024-02-05T16:49:21-05:00
changeset 4c85e3e16dfe
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description doc: fix link; make cells in table align at top

"Query Parameters Examples" table aligned the labels in column 1 in
the middle of the text in column 2. Change that to align cells
at the top of the row.

Also fix a bad link.
files
doc: clarify use of .xml or .json extensions in REST interface http://hg.code.sf.net:8000/p/roundup/code/#changeset-0e3d31a6b7fd90bc9699ca8d13dbf2c011af57f7 John Rouillard rouilj@ieee.org 2023-10-26T11:28:54-04:00 2023-10-26T11:28:54-04:00
changeset 0e3d31a6b7fd
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description doc: clarify use of .xml or .json extensions in REST interface

Document that /rest and /rest/data do not support extensions.
files
fix: add support for dicttoxml2.py http://hg.code.sf.net:8000/p/roundup/code/#changeset-3eca3462ba0ce932aeebd1705f7e135bbed723e3 John Rouillard rouilj@ieee.org 2023-10-26T11:24:04-04:00 2023-10-26T11:24:04-04:00
changeset 3eca3462ba0c
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description fix: add support for dicttoxml2.py

The older dicttoxml.py uses a type alias collections.Iterator that is
removed post Python 3.10. Add support for dictoxml.py updated
replacement.

Norbert SCHLEMMER found it when testing the arm docker under 3.12.
files
docs: clarify Api version method priority; payload @apiver http://hg.code.sf.net:8000/p/roundup/code/#changeset-c5307dc0e8c63c5fe6098a2d0dba583047d88e2e John Rouillard rouilj@ieee.org 2023-09-18T01:57:50-04:00 2023-09-18T01:57:50-04:00
changeset c5307dc0e8c6
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description docs: clarify Api version method priority; payload @apiver

Define how version is determined when multiple conflicting
methods are used. Add doc on use of @apiver in data payload for
PUT/POST (and maybe PATCH).

Now that this is defined, sent email to devel list to see if the
order should be changed. The url parameter is the lowest priorty
setting and will be ignored if any of the 3 higher priority
methods are used. However using the url setting is the easiest
for testing.
files
docs: rewrite segments using ahref paragraph rewriter. http://hg.code.sf.net:8000/p/roundup/code/#changeset-5a8a41a2e3c89afec3215b2ed6c36620c9225edf John Rouillard rouilj@ieee.org 2023-08-10T09:50:45-04:00 2023-08-10T09:50:45-04:00
changeset 5a8a41a2e3c8
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description docs: rewrite segments using ahref paragraph rewriter.
files
fix: issue2551193 - Fix roundup for removal of cgi and cgitb ... http://hg.code.sf.net:8000/p/roundup/code/#changeset-978285986b2c9d73f4a39d745ab6a3bbab58af3d John Rouillard rouilj@ieee.org 2023-07-24T17:49:58-04:00 2023-07-24T17:49:58-04:00
changeset 978285986b2c
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description fix: issue2551193 - Fix roundup for removal of cgi and cgitb ...

standard python modules (and FieldStorage/MiniFieldStorage).

Vendor cgi.py and modify imports.

Details:

roundup/anypy/cgi_.py
import that accesses a working cgi.py. All imports dealing with cgi
now use cgi_.

roundup/anypy/vendored/cgi.py
vendored version 2.6 of cgi.py from:
https://pypi.org/project/legacy-cgi/

CHANGES.txt
change note added

COPYING.txt
added license for cgi.py

doc/rest.txt
change example to use cgi_

doc/upgrading.txt
doc removal and how to rework local code using cgi.py.

frontends/roundup.cgi
remove unneeded cgi import

roundup/cgi/actions.py
roundup/cgi/apache.py
roundup/cgi/client.py
roundup/cgi/templating.py
roundup/cgi/TAL/TALGenerator.py
test/db_test_base.py
test/rest_common.py
test/test_cgi.py
remove import cgi and replace with from roundup.anypy.cgi_ import
cgi

test/test_actions.py
test/test_templating.py
modify import to get *FieldStorage

test/test_admin.py
test/test_hyperdbvals.py
test/test_xmlrpc.py
remove unneeded cgi import
files
fix(api): - issue2551063 - Rest/Xmlrpc interfaces needs failed login protection. http://hg.code.sf.net:8000/p/roundup/code/#changeset-273c8c2b504245a937efbd42604f77cb2d3d0d9d John Rouillard rouilj@ieee.org 2023-07-19T20:37:45-04:00 2023-07-19T20:37:45-04:00
changeset 273c8c2b5042
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description fix(api): - issue2551063 - Rest/Xmlrpc interfaces needs failed login protection.

Failed API login rate limiting with expiring lockout added.
files
Change customizing to customising in all variants. http://hg.code.sf.net:8000/p/roundup/code/#changeset-a072331c843b55ed5458029b147f4dd5e16d7507 John Rouillard rouilj@ieee.org 2023-06-18T11:35:16-04:00 2023-06-18T11:35:16-04:00
changeset a072331c843b
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description Change customizing to customising in all variants.

Make the spelling of customizing follow the British (also Australian
since Richard Jones is from there) spelling. Non-native English
speakers will see a consistent spelling of the word. The filename is
still customizing.txt/html (US spelling) though.
files
I think headings are consistant now. http://hg.code.sf.net:8000/p/roundup/code/#changeset-f8b5b0310f88f4280885bb9cea6d2cf2024cd1a0 John Rouillard rouilj@ieee.org 2023-06-08T09:27:17-04:00 2023-06-08T09:27:17-04:00
changeset f8b5b0310f88
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description I think headings are consistant now.
files
Fix grammar. http://hg.code.sf.net:8000/p/roundup/code/#changeset-f53de10ea8ea87b68cc0f10917aa3d305dc9ba59 John Rouillard rouilj@ieee.org 2023-06-05T22:15:02-04:00 2023-06-05T22:15:02-04:00
changeset f53de10ea8ea
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description Fix grammar.
files
rewrite JWT future to use refresh tokens. http://hg.code.sf.net:8000/p/roundup/code/#changeset-bc6bcffbed2a5a3039e79d450cd888f8dc7707dd John Rouillard rouilj@ieee.org 2023-05-16T11:58:56-04:00 2023-05-16T11:58:56-04:00
changeset bc6bcffbed2a
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description rewrite JWT future to use refresh tokens.
files
format fix. http://hg.code.sf.net:8000/p/roundup/code/#changeset-fc88c66eb73b76ab6d17be6d5f23d7a5f499b76a John Rouillard rouilj@ieee.org 2023-05-16T00:59:35-04:00 2023-05-16T00:59:35-04:00
changeset fc88c66eb73b
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description format fix.
files
update metadata for rest.txt html page. http://hg.code.sf.net:8000/p/roundup/code/#changeset-f86a4a712f1f3058fe09e71d0b9b2bd5e76cbb0c John Rouillard rouilj@ieee.org 2023-04-25T17:25:36-04:00 2023-04-25T17:25:36-04:00
changeset f86a4a712f1f
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description update metadata for rest.txt html page.
files
improve REST interface security http://hg.code.sf.net:8000/p/roundup/code/#changeset-89a59e46b3af7bb327ebf079c34e22bbbff8bbf2 John Rouillard rouilj@ieee.org 2023-02-23T12:01:33-05:00 2023-02-23T12:01:33-05:00
changeset 89a59e46b3af
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description improve REST interface security

When using REST, we reflect the client's origin. If the wildcard '*'
is used in allowed_api_origins all origins are allowed. When this is
done, it also added an 'Access-Control-Allow-Credentials: true'
header.

This Credentials header should not be added if the site is matched
only by '*'. This header should be provided only for explicit origins
(e.g. https://example.org) not for the wildcard.

This is now fixed for CORS preflight OPTIONS request as well as normal
GET, PUT, DELETE, POST, PATCH and OPTIONS requests.

A missing Access-Control-Allow-Credentials will prevent the tracker
from being accessed using credentials. This prevents an unauthorized
third party web site from using a user's credentials to access
information in the tracker that is not publicly available.

Added test for this specific case.

In addition, allowed_api_origins can include explicit origins in
addition to '*'. '*' must be first in the list.

Also adapted numerous tests to work with these changes.

Doc updates.
files
update links. http://hg.code.sf.net:8000/p/roundup/code/#changeset-42e68162279b7dcfeaa70ba3ed7b82e45218d363 John Rouillard rouilj@ieee.org 2023-02-15T11:57:43-05:00 2023-02-15T11:57:43-05:00
changeset 42e68162279b
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description update links.
files
landmarks, skiplink, remove bad attrs, autocomplete search http://hg.code.sf.net:8000/p/roundup/code/#changeset-e7b4ad2c57ac1b3e471bdb60ceba105ce96c8804 John Rouillard rouilj@ieee.org 2022-07-12T15:00:30-04:00 2022-07-12T15:00:30-04:00
changeset e7b4ad2c57ac
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description landmarks, skiplink, remove bad attrs, autocomplete search

layout.html:
Add main and nav landmarks to layout templte.
Add skiplink to get to main.
Remove Description meta tag from layout template in favor of
description metadata in individual files.
Remove obsolete border attribute from sourceforge logo.
Add autocomplete="on" attribute for search input box.

doc/*.txt
Remove language attribute from description meta tags.


These changes also occur for other files not in this commit. Thse
other files have changes to files for the 2.2.0 release not yet tobe
committed.
files
How to add dicttoxml at system or tracker level. http://hg.code.sf.net:8000/p/roundup/code/#changeset-b4bfbd768bc171255f8a12515b6fa56624ae845a John Rouillard rouilj@ieee.org 2022-07-10T21:22:58-04:00 2022-07-10T21:22:58-04:00
changeset b4bfbd768bc1
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description How to add dicttoxml at system or tracker level.
files
Typo fixes, formatting fixes, jwt -> JWT, add link to JWT issue http://hg.code.sf.net:8000/p/roundup/code/#changeset-32f52d14b4962784185f779caf7e25fc391ea715 John Rouillard rouilj@ieee.org 2022-07-10T20:53:14-04:00 2022-07-10T20:53:14-04:00
changeset 32f52d14b496
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description Typo fixes, formatting fixes, jwt -> JWT, add link to JWT issue
files
issue2551205: Add support for specifying valid origins for api: xmlrpc/rest http://hg.code.sf.net:8000/p/roundup/code/#changeset-ab2ed11c021eec91ca1a624ee4ee259e2282741d John Rouillard rouilj@ieee.org 2022-05-17T17:18:51-04:00 2022-05-17T17:18:51-04:00
changeset ab2ed11c021e
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description issue2551205: Add support for specifying valid origins for api: xmlrpc/rest

We now have an allow list to filter the hosts allowed to do api
requests. An element of this allow list must match the http ORIGIN
header exactly or the rest/xmlrpc CORS request will result in an
error.

The tracker host is always allowed to do a request.
files
Fix cache time week -> day. http://hg.code.sf.net:8000/p/roundup/code/#changeset-7542269becfa28ae38989d48e23895702f5295d5 John Rouillard rouilj@ieee.org 2022-05-12T17:25:09-04:00 2022-05-12T17:25:09-04:00
changeset 7542269becfa
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description Fix cache time week -> day.
files
issue2551203 - CORS and CORS preflight documentation. http://hg.code.sf.net:8000/p/roundup/code/#changeset-ff8845ca305eab37346077708472fd46511423d1 John Rouillard rouilj@ieee.org 2022-05-12T17:15:15-04:00 2022-05-12T17:15:15-04:00
changeset ff8845ca305e
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description issue2551203 - CORS and CORS preflight documentation.

Add documentation on CORS preflight and CORS requests in REST.
files
Add missing url in example. http://hg.code.sf.net:8000/p/roundup/code/#changeset-0351caa802f73c9338432479e36df81012013b0a John Rouillard rouilj@ieee.org 2022-04-07T00:02:44-04:00 2022-04-07T00:02:44-04:00
changeset 0351caa802f7
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description Add missing url in example.
files
Add meta description to some doc pages. http://hg.code.sf.net:8000/p/roundup/code/#changeset-24e2eeb2ed9a6b88e43ed2b7e3bb203219e20d59 John Rouillard rouilj@ieee.org 2022-01-21T14:29:46-05:00 2022-01-21T14:29:46-05:00
changeset 24e2eeb2ed9a
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description Add meta description to some doc pages.

Try to improve SEO a bit. Get more users/contributors.
files
issue2551175 - Make ETag content-encoding aware. http://hg.code.sf.net:8000/p/roundup/code/#changeset-f8df7fed18f601e6fa67001a146bdd0fe4a61bb7 John Rouillard rouilj@ieee.org 2021-12-01T19:52:54-05:00 2021-12-01T19:52:54-05:00
changeset f8df7fed18f6
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description issue2551175 - Make ETag content-encoding aware.

HTTP ETag headers now include a suffix (-gzip, -br, -zstd) indicating
the content-encoding used to send the data per rfc7232. Validate any
form of ETag by stripping a suffix (if present).
files
jwt issue example: require input data, lowercase roles http://hg.code.sf.net:8000/p/roundup/code/#changeset-22cf6ee7ad884fde86fbdeb560c9ef0006bc7a11 John Rouillard rouilj@ieee.org 2021-10-30T23:18:01-04:00 2021-10-30T23:18:01-04:00
changeset 22cf6ee7ad88
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description jwt issue example: require input data, lowercase roles

If content-type is not supplied, input data will not be parsed. As a
result the JWT has the user's assigned roles. Prevent this.

Also lowercase all roles supplied in the input payload so "User", "user"
and "useR" all match the case insensitive "user" role.
files
Test options in rest interface against live server; rest doc update http://hg.code.sf.net:8000/p/roundup/code/#changeset-66a061e52435bec30b909b339d98433693cf5a0a John Rouillard rouilj@ieee.org 2021-04-21T00:48:28-04:00 2021-04-21T00:48:28-04:00
changeset 66a061e52435
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description Test options in rest interface against live server; rest doc update

Add OPTIONS verb routing for /rest and /rest/data

Document that there must not be a content-type header for OPTIONS or
GET.

Set TRACKER_WEB option in config.in to match where the server is
running. Add testing for OPTIONS verb against all rest endpoint types.
files
Fix thinko add role not permission to users. http://hg.code.sf.net:8000/p/roundup/code/#changeset-3dcbe44eb1cdbaddd269c42aae10cbeed438d0d0 John Rouillard rouilj@ieee.org 2021-04-04T22:39:52-04:00 2021-04-04T22:39:52-04:00
changeset 3dcbe44eb1cd
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description Fix thinko add role not permission to users.
files
Update doc for jwt example to omit b2s() if pyjwt version >= 2.0.0 http://hg.code.sf.net:8000/p/roundup/code/#changeset-84655a4223c632b706eea4e0fbbfee867b04d534 John Rouillard rouilj@ieee.org 2021-01-01T22:25:40-05:00 2021-01-01T22:25:40-05:00
changeset 84655a4223c6
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description Update doc for jwt example to omit b2s() if pyjwt version >= 2.0.0

[skip ci] jwt.encode() changed return type in 2.0.0 from byte to string.
files
Fix uncaught error when parsing rest headers, document http://hg.code.sf.net:8000/p/roundup/code/#changeset-be8d5a8e090a007da8b172862236341419dcb94a John Rouillard rouilj@ieee.org 2021-01-01T14:14:34-05:00 2021-01-01T14:14:34-05:00
changeset be8d5a8e090a
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description Fix uncaught error when parsing rest headers, document

Started this work as better docs for rest response format. But I found
406 error response was not being tested. Also there was no error for
bad Content-Type.

In rest.py fix uncaught exceptions due to invalid Accept or
Content-Type headers. If Content-type is valid but not
application/json return code 415.

Document use of accept header (was only shown in examples) and support
for q parameter. Describe using .xml and .json extensions to select
return format for testing from browser (where setting accept header is
a problem). Document 406 error code return. Document 415 error code
return and acceptable content types. Previously only doc was in
examples.

Set up tests for 406 and 415 error codes.
files
Add missing comma to rest.txt. http://hg.code.sf.net:8000/p/roundup/code/#changeset-9d132769ed376515b0f8439adf0b5e3f18b6efd8 John Rouillard rouilj@ieee.org 2020-11-17T21:30:21-05:00 2020-11-17T21:30:21-05:00
changeset 9d132769ed37
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description Add missing comma to rest.txt.
files
Grammar fix. Remove word missed in rewrite. http://hg.code.sf.net:8000/p/roundup/code/#changeset-424f70c076b9f902b0b2ad95c88d7f0cf88b7c02 John Rouillard rouilj@ieee.org 2020-09-07T21:00:43-04:00 2020-09-07T21:00:43-04:00
changeset 424f70c076b9
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description Grammar fix. Remove word missed in rewrite.
files
Doc updates. Mostly formatting. http://hg.code.sf.net:8000/p/roundup/code/#changeset-8a21f8ba3065a164148a8642710ea6b0455cf67f John Rouillard rouilj@ieee.org 2020-06-27T20:02:26-04:00 2020-06-27T20:02:26-04:00
changeset 8a21f8ba3065
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description Doc updates. Mostly formatting.
files
Expand sunset header explanation, fix formating missing `. http://hg.code.sf.net:8000/p/roundup/code/#changeset-b6f2cf872d2e1a830053230947887baa7e9b8c92 John Rouillard rouilj@ieee.org 2020-06-26T18:44:26-04:00 2020-06-26T18:44:26-04:00
changeset b6f2cf872d2e
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description Expand sunset header explanation, fix formating missing `.
files
Clarify need to set secret_key for rest. http://hg.code.sf.net:8000/p/roundup/code/#changeset-1b9f6b9befeb4f3d1d5b0cd2d246dce853ffbd30 John Rouillard rouilj@ieee.org 2020-06-26T18:33:21-04:00 2020-06-26T18:33:21-04:00
changeset 1b9f6b9befeb
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description Clarify need to set secret_key for rest.
files
Fix display formatting. http://hg.code.sf.net:8000/p/roundup/code/#changeset-e77f6d00cfb934b741313d98bab25179f97caa04 John Rouillard rouilj@ieee.org 2020-06-23T14:02:50-04:00 2020-06-23T14:02:50-04:00
changeset e77f6d00cfb9
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description Fix display formatting.
files
Fix example to have 15 minute lifetime to match text. http://hg.code.sf.net:8000/p/roundup/code/#changeset-0f0dedd2f95d2d138811962d7ca7322976ff7af5 John Rouillard rouilj@ieee.org 2020-06-10T19:46:41-04:00 2020-06-10T19:46:41-04:00
changeset 0f0dedd2f95d
branch
bookmark
tag
user John Rouillard <rouilj@ieee.org>
description Fix example to have 15 minute lifetime to match text.
files