[$100] Token generation / usage

[jmgasper]

As discussed here, we need a better way of accessing the API from the MFE.

#652 (comment)

[jmgasper]

Challenge https://www.topcoder.com/challenges/0bff6b08-f527-41ea-beb8-f4a38c98207a has been created for this ticket.

This is an automated message for ghostar via Topcoder X

[jmgasper]

Challenge https://www.topcoder.com/challenges/0bff6b08-f527-41ea-beb8-f4a38c98207a has been assigned to obog.

This is an automated message for ghostar via Topcoder X

[atelomycterus]

@jmgasper If we want to use one Vanilla access token for all REST API calls from MFE =>
We need to create the access token with sign in permission and not allow to view/modify some data, etc.
We can configure it the following way:

1. Log in as Admin
   a. create a new role ('MFE') :
   
   b. Check Sign in and Tokens. After generating a personal token from MFE User account, we'll remove the Tokens permission:

2. Create a new Topcoder user, later we'll change his roles in Vanilla. This account should be used for MFE, not personally.
   Log in Vanilla to create a Vanilla account from Topcoder account.

3. Now log in as Admin, find this user (https://vanilla.topcoder-dev.com/dashboard/user) and check MFE Role.

4. Log in as MFE User and go to https://vanilla.topcoder-dev.com/profile/tokens
   a. create a personal access token
   b. copy it and use it in MFE in https://github.com/topcoder-platform/micro-frontends-self-service-app/blob/18a9de870d178751c72491dc35b6015d2d1dc2dc/config/dev.js#L17
   c. log out

5. Log in as Admin
   a. remove the 'Tokens' permission from MFE role.
   b. find the MFE user (https://vanilla.topcoder-dev.com/dashboard/user), uncheck all existing roles except MFE Role.

Testing

MFE user should able to call

http://localhost/api/v2/groups/7/member/TonyJ?access_token=`token`
http://localhost/api/v2/groups/69cb5726-8bcc-4b56-b45a-a9b85e91e4ed/member/TonyJ?access_token=`token`

{
    "userID": 9,
    "watch": true,
    "unreadNotifications": 0
}

http://localhost/api/v2/groups?access_token=`token`

    {
        "groupID": 7,
        "type": "challenge",
        "privacy": "secret",
        "archived": 0,
        "name": "Justin Forum Test 11",
        "challengeID": "9d20c28a-2c06-432d-9b0c-ebdee23a9ded",
        "challengeUrl": "https://topcoder-dev.com/challenges/9d20c28a-2c06-432d-9b0c-ebdee23a9ded"
    },

http://localhost/api/v2/groups/7/members?access_token=va.QCP2mAy4jm5tUobJVlFQXEdpfjNQH9vm.scW2dA.9cKVyOm

[
    {
        "userID": 9,
        "name": "TonyJ"
    }
]

http://localhost/api/v2/groups/7

{
    "groupID": 7,
    "name": "Justin Forum Test 11",
    "description": "Welcome to Topcoder Development challenge!\nPlease post your questions in this chat group, thanks!",
    "privacy": "secret",
    "deletable": 1,
    "closed": 0,
    "dateInserted": "2020-10-02 01:13:01",
    "icon": null,
    "banner": null,
    "ownerID": 9,
    "challengeID": "9d20c28a-2c06-432d-9b0c-ebdee23a9ded",
    "challengeUrl": "https://topcoder-dev.com/challenges/9d20c28a-2c06-432d-9b0c-ebdee23a9ded",
    "type": "challenge",
    "archived": 0
}

No permissions to add, edit, archive a group/user, etc. no view discussions/comments

curl -X PUT "http://localhost/api/v2/groups/100/unarchive?access_token=`token`" -H "accept: /"
{
"message": "You need the Groups.Group.Archive permission to do that.",
"status": 403,
"permissions": [
"Groups.Group.Archive"
],
"description": null

curl -X POST "http://localhost/api/v2/groups/7/members?access_token=`token`" -H "accept: /" -H "Content-Type: application/json" -d "{"userID":1,"watch":true}"
{
"message": "Don't have permissions to add a member to this group.",
"status": 400,
"description": null
}

http://localhost/api/v2/categories?access_token=`token`
[]

http://localhost/api/v2/discussions/1635?access_token=`token`

{
    "message": "You need the Vanilla.Discussions.View permission to do that.",
    "status": 403,
    "permissions": [
        "Vanilla.Discussions.View"
    ],
    "description": null
}

Also we can fix Vanilla to call REST API with jwt tokens as we use in Vanilla Forums

Let me know if you have any questions.

[jmgasper]

@atelomycterus - This works, thanks.

[jmgasper]

Payment task has been updated: https://www.topcoder.com/challenges/0bff6b08-f527-41ea-beb8-f4a38c98207a
Payments Complete
Winner: obog
Copilot: ghostar
Challenge 0bff6b08-f527-41ea-beb8-f4a38c98207a has been paid and closed.

This is an automated message for ghostar via Topcoder X