Jump to content


  • Posts

  • Joined

  • Last visited

  • Days Won


Everything posted by Sebi

  1. And now I got for you: Version 1.2.2 🤩 With @adrian's help I managed to find out, that the `date()` function in PHP 8 seems to return the current date, if NULL is passed in as the second parameter. In PHP 7 this was 01.01.1970 which was handled correctly. Long story short: Now I will write NULL to the database without any date-formatting. This should make AppApi fully compatible to PHP 8.
  2. I just released version 1.2.1. When testing with PHP version 8, some strange changes in the naming of header values occurred in my test environment, which meant that the values in the AUTHORIZATION header could no longer be read correctly. I have therefore made the handling of the header values a little more general in the new version, and implemented that certain prefixes are ignored. As a result, everything now runs normally again under PHP 8. How does it look for you? Have all the errors been solved? I can't rule out that things behave differently in other environments and with other server configurations. But I would like to take all possible deviations into account, so feel free to contact me if you notice any problems!
  3. @Pixrael What I do on ProcessPageView::pageNotFound is calling this function: public function ___handleApiRequest(HookEvent $event) { if ($this->checkIfApiRequest()) { // Check if the current REQUEST_URI starts with /api $this->apiCall = true; Auth::getInstance()->initApikey(); // Init authentication $router = new Router(); // Init Router $router->go($this->registeredRoutes); // Start resolving the route. This function will echo() and // exit() $event->replace = true; // Only needed in hook-function-call } } In theory (not tested yet), it should work to copy the three relevant lines (Init Auth, Init Router, Resolve Route) to your home-template file. I would be really interested to know if it really works out that way. Don't have time to test it out right now. This is my plan for a future module-update: - Extend the routes definition that it is not only applied to the api endpoint from the module configuration but to the whole pagetree - Check also on existing pages, not only in the 404 hook, if a route matches. If a valid api key is present, output the AppApi response instead. - Otherwise everything remains the same
  4. Hi @Pixrael! At the moment, this is not possible. In the AppApi module, a route must be specified that is not yet occupied by a classic ProcessWire route. AppApi uses a hook on 404 (Page not found) error and then replaces the return with the AppApi content. I am facing a similar problem right now. I would like to use ProcessWire exclusively as a headless CMS for an app. If you have access to the domain and subdomain settings, it might work to run ProcessWire under a subdomain and link the main domain to /api. However, I've been thinking for a while about how to add api responses to existing ProcessWire pages (e.g. the root page under "/").
  5. There was still a small problem that prevented the module from being automatically updated from within ProcessWire. I had renamed the root branch in Github from master to main, but then the download path in the ProcessWire module directory didn't fit anymore. Long Story Short: Now everything works again 🙂
  6. Sebi


    Long time no see! I just released version 2.2.0 of Twack. With this, Twack now uses the new feature from the AppApi module (if installed) and registers its own route 'tpage' for page calls. This means that the JSON outputs of Twack components can now be requested easily through this Api endpoint: Route Description /api/tpage/ Calls the root page of the page-tree /api/tpage/42 Will call the page with id=42 /api/tpage/my/test/page Calls your page with path my/test/page
  7. Hey @Red_nipon! Nice to have you here! Can you please explain this in more detail? What exactly do you want your client to be able to do? As I understand it, the customer gets a login from you for the ProcessWire admin interface and can then publish one or more SPAs there themselves with their own configuration. Then it would make sense to create a ProcessWire template for it with the configurable parts (fontcolor, dates, ...) as fields. If you or the customer then create a new page with this template in the pagetree, it can be called in the frontend. Of course you can also put a javascript file from a SPA into the corresponding template PHP file and just let PHP write the few configuration parameters into a <script> area, which the SPA then reads when loading. That would be the simplest way I can think of. This concept isn't strictly "headless" then, but it doesn't have to be, does it? Headless to me would be an approach where the ProcessWire resides somewhere else and completely independent of the frontend. I'm actually working on an SPA with Angular/Ionic right now as well. The javascript application is at a hoster under its own domain, the ProcessWire backend is somewhere else entirely. I really like ProcessWire and have already done a lot with it, so it was my first choice as headless CMS for my project. If there are better headless alternatives I can't tell you, only that it works well with ProcessWire. The SPA then constantly requests data (e.g. a configuration, the contents of lists, blog articles, users, ...). The AppApi module is very good to create a JSON api for this [Disclaimer: I am the author of this module :D]. But if you don't need such a constant data exchange, this concept is probably much too cumbersome...
  8. AppApiFile adds the /file endpoint to the AppApi routes definition. Makes it possible to query files via the api. This module relies on the base module AppApi, which must be installed before AppApiFile can do its work. Features You can access all files that are uploaded at any ProcessWire page. Call api/file/route/in/pagetree?file=test.jpg to access a page via its route in the page tree. Alternatively you can call api/file/4242?file=test.jpg (e.g.,) to access a page by its id. The module will make sure that the page is accessible by the active user. The GET-param "file" defines the basename of the file which you want to get. The following GET-params (optional) can be used to manipulate an image: width height maxwidth maxheight cropX cropY Use GET-Param format=base64 to receive the file in base64 format.
  9. Great news! Version 1.2.0 is here! The changes in the code are actually not huge, but all the bigger are the additional possibilities we have now: With the new version, modules can register their own endpoints. These endpoints are then merged with the traditional definition in Routes.php. You may ask: But @Sebi, why are you so excited about this? Well. This means that endpoints can now be easily installed and updated. And we can now easily share our great and useful endpoints with the ProcessWire community! I'll get started then: My first AppApi module is AppApiFile. This module provides the /file endpoint for retrieving files uploaded to ProcessWire pages. I have extended the wiki with a small tutorial and sample code for creating an AppApi module: https://github.com/Sebiworld/AppApi/wiki/4.0:-AppApi-Modules I can't wait to see what you people will do with it! 🥳
  10. Hey @androbey, I tried a few things and definitely found inconsistencies. It looks like spaces, but also other characters (e.g. "+") in the url path cause weird behavior. In any case, any GET parameters that might be appended then seem to be ignored. At /api/search/my%20test?test=1 I cannot find the GET parameter test in $_GET of PHP. I can't tell exactly where this behavior is coming from (FastRoute? PHP? Apache?), but it probably won't work to specify the search string as you intended. If you specify it as a GET parameter (/api/search?q=my%20test) instead, it works without problems. The corresponding route definition would look like this: 'search' => [ ['GET', '', Search::class, 'getSearchResults', ["auth" => true]], ],
  11. Hi everyone! First, my two cents to @androbey: my first guess would be that maybe the spaces are not escaping correctly? Spaces in GET parameters need to be converted to %20. So "This is a test" becomes "q=this%20is%20a%20test" in the URL. Depending on the framework you use for your api request, this conversion may not happen automatically. In Javascript, for example, there is the encodeURIComponent() function that can do this conversion for you. In PHP there is the function urlencode() which does the same. Can you get further with it? Now to @Marcel: The message "no endpoint defined" already shows that the module was installed correctly. This message comes from the default route definition: ['*', '', AppApiHelper::class, 'noEndPoint', ['auth' => false]] And I can also tell you already that you are sending a valid api key along. Otherwise you would get an error message "Apikey not valid". Next, you can call /api/auth once. This request will return the current user. Without auth token this should be the guest user: { "id": 40, "name": "guest", "loggedIn": false } After that you can start implementing your own endpoints. Here in the wiki you can find everything you need to know: https://github.com/Sebiworld/AppApi/wiki/3.0:-Creating-Endpoints EDIT @Marcel: Sorry, I did not see you last comment. Routes.php does only influence your endpoints. The admin-page should be created automatically during installation and should be accessible in the "setup" header menu. I appended a screenshot from a German-translated backend. "Verwaltung" means "setup". Maybe you have to delete and re-install AppApi if the page was not created automatically...
  12. Hey @Clément Lambelet ! Thank you for using AppApi and for mentioning the questions! I do not know a way to prevent ProcessWire to log the accesses starting with /404/. From a technical point of view, this is absolutely correct: to accept requests, the AppApi module hooks into ProcessWire's 404 handling. For example, you call the url /api/test, which does not exist in the ProcessWire page tree. So ProcessWire handles this as a 404 error, but the module intervenes and sends its own output, namely what is defined in your routes. However, when logging, the URL is still recognized as a 404. In the newer ProcessWire versions there is the possibility to handle requests programmatically without the detour via 404 pages, but because of the backward compatibility I haven't dared to do it yet. If someone already knows better about it: I would be very happy about pull requests or comments 🙂 No, that is absolutely legitimate and not paranoid! My goal is to make the module as secure as possible, which means that login via api must not open a way to undermine any security mechanisms. Speaking of Session LoginThrottle: I tested it out - LoginThrottle seems to be called correctly on the AppApi login calls as well. For example, if I enter an incorrect password three times in quick succession, I get the following feedback, which comes from LoginThrottle: { "error": "Login not attempted due to overflow. Bitte warten Sie vor dem n\u00e4chsten Login-Versuch mindestens 5 Sekunden." } Do you have anything special set that is not being taken into account?
  13. Hi everyone! @csaggo.com Sorry for the delay. I had some sick and stressful weeks, but I hope that it will become better now. I just released a new version 1.1.7 that fixes @csaggo.com's problem that he mentioned above. The module's /auth-endpoint does now accept the login-credentials in different formats. You can now send username and password in a JSON-formatted (or FORM-URL-Encoded or Multipart) POST-body. It is even possible to send the credentials as GET-params - although I would not recommend it. A short note to what went wrong in the previous versions: I myself forgot to use my own (extremely useful) parameter functionality, which extracts parameters from a wide variety of formats: public function ___doLogin($data) { // ... // The right way to get params: $username = $this->wire('sanitizer')->pageName($data->username); $pass = '' . $data->password; // Old code: // $username = wire('input')->post->pageName('username'); // $pass = wire('input')->post->string('password'); // ... Please use the $data-object that your api-functions will receive automatically - this process is more tolerant than Processwire's wire('input')->post when it comes to different body formattings.
  14. Hey @csaggo.com, thank you very much for your input! This should not be a big problem, I will have a look at it in the next few days. I'll get back to you soon :-)
  15. Version 1.1.6 is out! 🥳 Changelog: Adds Router->registerErrorHandlers() Hook, that should allow you to overwrite the general error- and warning handlers of the module. That should fix the problem that @David Lumm mentioned above without breaking things for other users. Allows Apikey & Auth-token to be set as GET-params. That can be useful when it comes to loading images via api. Fixes a bug that made it possible to authenticate with the PHP session (cookie) even though token-auth was enabled. Adds Router->setCorsHeaders() Hook Updated Composer & Firebase dependencies
  16. Hey@abmcr, I think that it is not a good idea to release all pages for cross-origin requests. But I have an alternative for you. You could also request the file via the api interface. Then the module would automatically set the CORS headers and the request would be a bit more secured by the apikey. You can take the following class: https://github.com/Sebiworld/musical-fabrik.de/blob/f172a9ef4674e09cabce1fdcf4e55ddeea150d1b/site/api/FileAccess.class.php It is in productive use in one of my projects. Copy the class into the directory where your Routes.php file is located (default is site/api/). Now you can add the following endpoints to your Routes-definition: <?php namespace ProcessWire; require_once wire('config')->paths->AppApi . 'vendor/autoload.php'; require_once wire('config')->paths->AppApi . 'classes/AppApiHelper.php'; require_once __DIR__ . '/FileAccess.class.php'; $routes = [ 'file' => [ ['OPTIONS', '{id:\d+}', ['GET']], ['OPTIONS', '{path:.+}', ['GET']], ['OPTIONS', '', ['GET']], ['GET', '{id:\d+}', FileAccess::class, 'pageIDFileRequest'], ['GET', '{path:.+}', FileAccess::class, 'pagePathFileRequest'], ['GET', '', FileAccess::class, 'dashboardFileRequest'] ] ]; Full Routes.php for reference: https://github.com/Sebiworld/musical-fabrik.de/blob/f172a9ef4674e09cabce1fdcf4e55ddeea150d1b/site/api/Routes.php After these routes are integrated, you can call the new /api/file/ endpoint: const instance = axios.create({ baseURL: 'https://some-domain.com/api/', headers: { 'X-API-KEY': 'ThisIsYourCustomApiKey', 'Authorization': 'Bearer ...' // optional if authentication needed } }); instance.get('/file/1017', { file: 'gpx.gpx' }).then(function (response) { console.log(response); // This should be your file }).catch(function (error) { console.log(error.toJSON()); }); (Code not tested, only taken from Axios docs and changed to the correct parameters) I hope that I could help you with this! [And please don't worry about your English. Everything is understandable, and there are many non-native speakers here. You don't have to apologize for anything :-)]
  17. Hey @Bacos, unfortunately I really don't have much experience with api requests from PHP. In my beautiful, carefree javascript world, the browser handles the session cookies, so I can log in normally via the ProcessWire backend, and then get the logged in user back in the frontend via a simple call to the /api/auth/ interface: fetch( '/api/auth/', { headers: { 'X-API-KEY': 'SHBaob3siaud8A' } }) .then(response => response.json()) .then(response => console.log("RESPONSE", response)); Postman also handles session cookies for you automatically, so you don't have to worry about it manually. I did a bit of research. If you want to make your API request in PHP, it seems you have to take care of the session cookies yourself. The answer under this stackoverflow post seems to be a usable example, but with a CURL request instead of stream_context_create, which is what you're using:https://stackoverflow.com/a/10307956/5477836 In short, you have to log in via a PHP request, and the session cookies are written to the specified file path. The next time you make a request, you can then reuse those cookies to authenticate yourself. (If anyone here knows better about this, please correct me). If I were in your place, I would probably try the Auth-Type Single JWT instead of the Auth-Type PHP-Session. The advantage here would be that you get back a login token (string) on the /api/auth/ request, which you could then send along as a header on the next requests. This seems easier to me than having to mess with a cookie file. But that's up to you to decide... I hope you get somewhere with this? Also feel free to let me know if you have something executable. Maybe this would be a good example for documentation!
  18. Hi @Bacos, I have just tested it once through. At least it doesn't seem to be a general problem with AppApi's auth. In my Processwire test installation (running local with MAMP) I can protect a route with ['auth' => true]. It is then only accessible if I have logged in beforehand. In fact, there still seems to be a discrepancy, as I was also able to authenticate via the session with an apikey of type "Double JWT". But I will fix that soon. Unfortunately, I'm not really familiar with stream_context_create. My API requests are mostly made from a Javascript context. Is it possible that the session is not passed on correctly? Does the session or the cookies perhaps have to be specified as a parameter in stream_context_create?
  19. Hey @David Lumm, thank you for your pull request! I'm still testing out a few things at the moment, but I wanted to report back briefly at least. I catch all exceptions and errors at the top of Router.php to handle them myself: set_error_handler("ProcessWire\Router::handleError"); set_exception_handler('ProcessWire\Router::handleException'); register_shutdown_function('ProcessWire\Router::handleFatalError'); My main goal was to prevent a plaintext or HTML error message from being displayed when an API function was requested. Instead, the message should be output as JSON. @David LummDo I understand your commit correctly, that you disable this behaviour for warnings and only log the warning additionally? My goal is actually only that no PHP echo is made with the warning. A PHP echo before a JSON response would render the whole response useless. Do any of you know how I can prevent this echo, but the warning is still treatable in the non-module code?
  20. Hi @fliwire! Auth::getBearerToken() is a protected function. I do not exactly know how PHP handles that, but maybe that results into an empty string? You could copy the logic from Auth::getBearerToken() and Auth::getAuthorizationHeader() to try out if that is the issue. Additionally, hooking into Router::params could be a better place to add the logic since it is called later - after all auth-checks and just before Router::handle calls the targetted function.
  21. @thomasaullThank you! You are right - AppApiModule->checkIfApiRequest() compares with the full path of $_SERVER['REQUEST_URI']. Because of that, we must give the full path to the module-config, even if the ProcessWire root is in a subfolder. @Bacos: If you have only api instead of testeapi/api in your configuration, that would result in an 404 error!
  22. Hi @Bacos, You're right: If the AppApi module had received the Api request correctly, even an incorrect request would be answered with an exception and a JSON response. You get a HTML-response, so the request is not received by the module. Let's see... You send your request to https://localhost/testeapi/api/test - so your processwire root is https://localhost/testeapi/, am I right? Can you please double-check if your module's config looks like this: Another reason for a 404 error could be that you have already created a page in the ProcessWire page tree that is accessible under the /api route. Since the module uses a hook on ProcessPageView::pageNotFound to intercept requests, there must not be a page serving the api route. I think that's all the approaches I can think of for now. Was there perhaps already something suitable 🙃?
  23. Absolutely! But I'm glad, that I could fix the old handler, so it will work regardless which ProcessWire version is used. I think it would make sense to additionally add the new hook functionality. It should grab the request before it triggers 404. But that is something that must be tested very carefully.
  24. I do not use the pagination function, but I had similar issues with my AppApi module, that resulted in a 404 error in ProcessWire versions >= 1.0.173. So maybe it is related to it? The short version is: wire('input')->url no longer returns the requested url in the hook function I use, but only "/http404/" in the new ProcessWire versions. So in my module I now use $_SERVER['REQUEST_URI'], which works. I couldn't find anything yet with a quick look in the MarkupPagerNav class, but maybe it will help you or @ryan to find a solution...
  25. It is done. I have found the error. Version 1.1.5, which I just released, fixes the bug and makes AppApi fully compatible with ProcessWire versions >= 1.0.173 again. For those interested in the details: It was just a tiny little thing that caused the module to no longer be able to find out if an api url was requested. This is what the code for it looked like: protected function checkIfApiRequest() { $url = $this->sanitizer->url($this->input->url); // support / in endpoint url: $endpoint = str_replace('/', "\/", $this->endpoint); $regex = '/^\/' . $endpoint . '\/?.*/m'; preg_match($regex, $url, $matches); return !!$matches; } However, in ProcessWire versions >= 1.0.173, $this->input->url (or wire('input')->url) now no longer contains the requested URL (e.g. "/api/page/"), but already the URL of the 404 error page "/http404/". Thus, the module could no longer determine whether it should handle the request or not. But the solution to the problem was easier than I thought. $_SERVER['REQUEST_URI'] still contains the correct value. So we use that now for this check. And because this would have worked before, we don't need to worry about AppApi not working with older ProcessWire versions now. The fixed version simply looks like this: protected function checkIfApiRequest() { $url = $this->sanitizer->url($_SERVER['REQUEST_URI']); // support / in endpoint url: $endpoint = str_replace('/', "\/", $this->endpoint); $regex = '/^\/' . $endpoint . '\/?.*/m'; preg_match($regex, $url, $matches); return !!$matches; } Finally, thank you again for your reports. And I hope that you can now run your apis with the latest ProcessWire versions again. Thank you for using AppApi! 🤩
  • Create New...