Unable to mark notifications as read via API calls #2977

Closed
opened 2025-01-06 14:29:46 +00:00 by tcassaert · 11 comments

Description

I'm currently trying to write a small program to send notifications to Gotify. While getting the notifications seems to work just fine, marking them as read is giving me some troubles.

I've tried it with both curl and a Golang program.

It doesn't really matter what permissions the API token has, even with all permissions, it doesn't seem to work.

Example to mark a specific notification as read:

curl -L -XPOST -H "Authorization: Bearer $API_TOKEN"  https://try.vikunja.io/api/v1/notifications/1
{"id":1,"notification":{"project":{"background_blur_hash":"","background_information":null,"created":"2025-01-06T15:19:12+01:00","description":"","hex_color":"","id":143,"identifier":"","is_archived":false,"is_favorite":false,"max_right":0,"owner":null,"parent_project_id":0,"position":9371648,"title":"Inbox","updated":"2025-01-06T15:22:48+01:00","views":null},"task":{"assignees":null,"attachments":null,"bucket_id":0,"cover_image_attachment_id":0,"created":"2025-01-06T15:20:03+01:00","created_by":null,"description":"","done":false,"done_at":"0001-01-01T00:00:00Z","due_date":"0001-01-01T00:00:00Z","end_date":"0001-01-01T00:00:00Z","hex_color":"","id":1189,"identifier":"","index":1,"is_favorite":false,"labels":null,"percent_done":0,"position":0,"priority":0,"project_id":143,"reactions":null,"related_tasks":null,"reminders":null,"repeat_after":0,"repeat_mode":0,"start_date":"0001-01-01T00:00:00Z","title":"Test","updated":"2025-01-06T15:22:48+01:00"}},"name":"task.reminder","read_at":"0001-01-01T00:00:00Z","created":"2025-01-06T15:23:00+01:00","read":false}

So this just acts as a GET it seems.

When trying to mark all notifications as read:

curl -L -XPOST -H "Authorization: Bearer $API_TOKEN"  https://try.vikunja.io/api/v1/notifications
{"message":"missing, malformed, expired or otherwise invalid token provided"}

Vikunja Version

0.24.6

Browser and version

No response

Can you reproduce the bug on the Vikunja demo site?

Yes

Screenshots

No response

### Description I'm currently trying to write a small program to send notifications to Gotify. While getting the notifications seems to work just fine, marking them as read is giving me some troubles. I've tried it with both curl and a Golang program. It doesn't really matter what permissions the API token has, even with all permissions, it doesn't seem to work. Example to mark a specific notification as read: ``` curl -L -XPOST -H "Authorization: Bearer $API_TOKEN" https://try.vikunja.io/api/v1/notifications/1 {"id":1,"notification":{"project":{"background_blur_hash":"","background_information":null,"created":"2025-01-06T15:19:12+01:00","description":"","hex_color":"","id":143,"identifier":"","is_archived":false,"is_favorite":false,"max_right":0,"owner":null,"parent_project_id":0,"position":9371648,"title":"Inbox","updated":"2025-01-06T15:22:48+01:00","views":null},"task":{"assignees":null,"attachments":null,"bucket_id":0,"cover_image_attachment_id":0,"created":"2025-01-06T15:20:03+01:00","created_by":null,"description":"","done":false,"done_at":"0001-01-01T00:00:00Z","due_date":"0001-01-01T00:00:00Z","end_date":"0001-01-01T00:00:00Z","hex_color":"","id":1189,"identifier":"","index":1,"is_favorite":false,"labels":null,"percent_done":0,"position":0,"priority":0,"project_id":143,"reactions":null,"related_tasks":null,"reminders":null,"repeat_after":0,"repeat_mode":0,"start_date":"0001-01-01T00:00:00Z","title":"Test","updated":"2025-01-06T15:22:48+01:00"}},"name":"task.reminder","read_at":"0001-01-01T00:00:00Z","created":"2025-01-06T15:23:00+01:00","read":false} ``` So this just acts as a `GET` it seems. When trying to mark all notifications as read: ``` curl -L -XPOST -H "Authorization: Bearer $API_TOKEN" https://try.vikunja.io/api/v1/notifications {"message":"missing, malformed, expired or otherwise invalid token provided"} ``` ### Vikunja Version 0.24.6 ### Browser and version _No response_ ### Can you reproduce the bug on the Vikunja demo site? Yes ### Screenshots _No response_
tcassaert added the
kind/bug
label 2025-01-06 14:29:46 +00:00
Owner

This sounds like a bug. I'll take a look.

This sounds like a bug. I'll take a look.
Owner

Does this happen only with a fixed api token? (As opposed to a login token)

Does this happen only with a fixed api token? (As opposed to a login token)
Author

I'm not sure what you mean with a login token.

I'm loging in via OIDC (Authelia) so I'm not sure if I can create such token?

I'm not sure what you mean with a `login token`. I'm loging in via OIDC (Authelia) so I'm not sure if I can create such token?
Owner

When you're using the Frontend, Vikunja will request a login token after you signed in. That's regardless of the Auth method used.

When you're using the Frontend, Vikunja will request a login token after you signed in. That's regardless of the Auth method used.
Author

I see!

I found the token and retried to mark a notification as read via the API, which succeeded this time. So this bug only applies to the API token.

I see! I found the token and retried to mark a notification as read via the API, which succeeded this time. So this bug only applies to the API token.
Owner

Does it work when you add the Notifications permission from the Other category to a created api token?

Does it work when you add the `Notifications` permission from the `Other` category to a created api token?
Author

Unfortunately it does not.
I have a token with all checkboxes ticked that does not work:

filters: create, delete, read one, update
labels: create, delete, read all, read one, update
migration: ticktick migrate, ticktick status, vikunja-file migrate, vikunja-file status
notifications: read all, update
other: notifications, routes, users
projects: background, background delete, backgrounds upload, create, delete, projectusers, read all, read one, update
projectsDuplicate: create
projectsShares: create, delete, read all, read one
projectsTeams: create, delete, read all, update
projectsUsers: create, delete, read all, update
projectsViews: create, delete, read all, read one, update
projectsViewsBuckets: create, delete, read all, update
projectsViewsBucketsTasks: update
projectsViewsTasks: read all
projectsWebhooks: create, delete, read all, update
reactions: create, read all
reactionsDelete: delete
tasks: create, delete, read all, read one, update, update bulk
tasksAssignees: create, create bulk, delete, read all
tasksAttachments: create, delete, read all, read one
tasksComments: create, delete, read all, read one, update
tasksLabels: create, create bulk, delete, read all
tasksPosition: update
tasksRelations: create, delete
teams: create, delete, read all, read one, update
teamsMembers: create, delete
teamsMembersAdmin: update
webhooks: events 
Unfortunately it does not. I have a token with all checkboxes ticked that does not work: ``` filters: create, delete, read one, update labels: create, delete, read all, read one, update migration: ticktick migrate, ticktick status, vikunja-file migrate, vikunja-file status notifications: read all, update other: notifications, routes, users projects: background, background delete, backgrounds upload, create, delete, projectusers, read all, read one, update projectsDuplicate: create projectsShares: create, delete, read all, read one projectsTeams: create, delete, read all, update projectsUsers: create, delete, read all, update projectsViews: create, delete, read all, read one, update projectsViewsBuckets: create, delete, read all, update projectsViewsBucketsTasks: update projectsViewsTasks: read all projectsWebhooks: create, delete, read all, update reactions: create, read all reactionsDelete: delete tasks: create, delete, read all, read one, update, update bulk tasksAssignees: create, create bulk, delete, read all tasksAttachments: create, delete, read all, read one tasksComments: create, delete, read all, read one, update tasksLabels: create, create bulk, delete, read all tasksPosition: update tasksRelations: create, delete teams: create, delete, read all, read one, update teamsMembers: create, delete teamsMembersAdmin: update webhooks: events ```
Owner

Now fixed in 45ec1a4c47. Please check with the next unstable build or ony the demo (ready in ~45min).

Now fixed in https://kolaente.dev/vikunja/vikunja/commit/45ec1a4c4723fca36faa49ea68e7bc7c4168cc4f. Please check with the next unstable build or ony the demo (ready in ~45min).
Author

It seems that something is not working yet.

On the demo site, I now can't list the notifications anymore either:
This is a token with all permissions for the demo:demo user:

curl -L -XGET -H "Authorization: Bearer tk_ee2bfc58009bbbdf2477b67bfcb5438c57212d1a"  https://try.vikunja.io/api/v1/notifications

Using a login token still works.

It seems that something is not working yet. On the demo site, I now can't list the notifications anymore either: This is a token with all permissions for the `demo:demo` user: ``` curl -L -XGET -H "Authorization: Bearer tk_ee2bfc58009bbbdf2477b67bfcb5438c57212d1a" https://try.vikunja.io/api/v1/notifications ``` Using a login token still works.
Owner

I've now moved the "mark all as read" permission to the notifications group in abae6f05e0 - that should fix the problem. Please check again with the next unstable build or on try. You'll need to regnerate the token.

I've now moved the "mark all as read" permission to the notifications group in https://kolaente.dev/vikunja/vikunja/commit/abae6f05e0a9339de8ab5b309a49c36a12d329bc - that should fix the problem. Please check again with the next unstable build or on try. You'll need to regnerate the token.
Author

This works, thanks!

This works, thanks!
Sign in to join this conversation.
2 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: vikunja/vikunja#2977
No description provided.