GET /user does not return the current user when using an api token #2644
Reference in New Issue
Block a user
No description provided.
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Description
curl -X GET -H "Authorization: Bearer tk_1183642d1f350dc258c601f253aba243f20670bb" "https://try.vikunja.io/api/v1/user"Expected result: User details and settings for the owner of the token
Actual result: HTTP Status 401
{"message":"missing, malformed, expired or otherwise invalid token provided"}The request is okay, as can be seen with
curl -X GET -H "Authorization: Bearer tk_1183642d1f350dc258c601f253aba243f20670bb" "https://try.vikunja.io/api/v1/tasks/all".Also, the endpoint is correct, as can be seen if you paste the token from your browser's local storage into the first statement.
Additionally: The swagger documentation of the GET user endpoint https://try.vikunja.io/api/v1/docs#tag/user might be outdated. The return type seems to be UserWihSettings.
Vikunja Version
v0.24.1-47-9ed33f5c08
Browser and version
chrome, curl
Can you reproduce the bug on the Vikunja demo site?
Yes
Screenshots
No response
Blocks https://gitlab.com/ce72/vja/-/issues/7
I've changed the api docs in 2dd21d96547d8c9b2386000766ab3697866e86a7.
I'm unsure about giving every token access to /user, but I can see the point. Maybe as a middle ground, we could add a permission to the endpoint? That would make that endpoint available for selection, when creating a token.
Added in
3e9c41cfc6. You can now add theuserscope to an api token. Tokens with that scope can then access the/userendpoint and retrieve the user who created the token.