feat(api): add fortify login route to retrieve api key #2455
Conversation
|
Documented at RetroAchievements/api-docs#46. |
| return response()->json(['webApiKey' => $user->api_token]); | ||
| } | ||
|
|
||
| return response()->json(['error' => 'Something went wrong'], 400); |
There was a problem hiding this comment.
I understand the necessity to not reveal too much, but would it be correct to return "Invalid user/password" here like we do for connect?
There was a problem hiding this comment.
I know @luchaos wants to move to a response structure more in line with the official JSON API docs: https://discord.com/channels/476211979464343552/757767535293890682/1132370669938671758.
I think a response formatted in that manner would look like:
{
"errors": [
{
"status": "401",
"code": "invalid_credentials",
"title": "Invalid username/password",
}
]
}
I would really like to get his feedback on anything we're going to call V2 of the API.
There was a problem hiding this comment.
Connect also has a secondary "access denied" error if the credentials are valid, but the account's email address hasn't yet been verified.
There was a problem hiding this comment.
An alternative to putting this in the V2 API namespace might be to return something like APIKey from r=login2. I would be happy to put this in the V1 Web API, but it's designed to only accept authenticated GET requests.
| @@ -34,4 +36,25 @@ public function users(Request $request): JsonResponse | |||
| 'data' => $request->input(), | |||
| ], 501); | |||
| } | |||
|
|
|||
| public function login(Request $request): JsonResponse | |||
There was a problem hiding this comment.
Is it possible to add unit tests for this? I would really like everything in the V2 API to have good test coverage.
There was a problem hiding this comment.
Yes - certainly. Pending if we decide to keep this in here, I'm happy to add code coverage.
The PR adds a new V2 web API route:
This route will conceivably allow emulation front-ends to exchange user credentials for a user's web API key, ideally to ween them off the Connect API (for which they're currently exchanging credentials for a connect token).
Security Considerations:
authenticateFromPassword().