github-starred/vikunja
2
0
Fork 0
mirror of https://github.com/go-vikunja/vikunja.git synced 2026-03-09 07:13:35 -05:00
Code Issues 219 Packages Projects Releases 2 Wiki Activity

API tokens requests returns 401 Unauthorized for user operations /api/v1/user/... #348

New Issue
Closed
opened 2025-11-01 20:54:40 -05:00 by GiteaMirror · 2 comments
GiteaMirror commented 2025-11-01 20:54:40 -05:00
Owner
Copy Link

Originally created by @alvarolm on GitHub (Jan 31, 2025).

Description

There is no issue with the jwt token generated on authenthication but the using an API token with all the permissions granted results on 401 responses no matter what for requests to the endpoint /api/v1/user/...

I have tried with the same token for https://try.vikunja.io/api/v1/docs#tag/labels/paths/~1labels/get and works as expected.

Image
Image

token permissions granted:

filters: create, delete, read one, update
labels: create, delete, read all, read one, update
migration: ticktick migrate, ticktick status, vikunja-file migrate, vikunja-file status
notifications: read all, update
other: notifications, routes, users
projects: background, background delete, backgrounds upload, create, delete, projectusers, read all, read one, update
projectsDuplicate: create
projectsShares: create, delete, read all, read one
projectsTeams: create, delete, read all, update
projectsUsers: create, delete, read all, update
projectsViews: create, delete, read all, read one, update
projectsViewsBuckets: create, delete, read all, update
projectsViewsBucketsTasks: update
projectsViewsTasks: read all
projectsWebhooks: create, delete, read all, update
reactions: create, read all
reactionsDelete: delete
tasks: create, delete, read all, read one, update, update bulk
tasksAssignees: create, create bulk, delete, read all
tasksAttachments: create, delete, read all, read one
tasksComments: create, delete, read all, read one, update
tasksLabels: create, create bulk, delete, read all
tasksPosition: update
tasksRelations: create, delete
teams: create, delete, read all, read one, update
teamsMembers: create, delete
teamsMembersAdmin: update
webhooks: events

Currently using:
v0.24.6

Vikunja Version

v0.24.6

Browser and version

No response

Can you reproduce the bug on the Vikunja demo site?

Yes

Screenshots

No response

Originally created by @alvarolm on GitHub (Jan 31, 2025). ### Description There is no issue with the jwt token generated on authenthication but the using an API token with all the permissions granted results on 401 responses no matter what for requests to the endpoint /api/v1/user/... I have tried with the same token for https://try.vikunja.io/api/v1/docs#tag/labels/paths/~1labels/get and works as expected. ![Image](https://github.com/user-attachments/assets/bffffee4-c6bd-4ce4-afe8-100b2893fae8) ![Image](https://github.com/user-attachments/assets/ae1f2b06-c3ab-4b41-94a6-5f76e2b6c4cd) token permissions granted: > filters: create, delete, read one, update > labels: create, delete, read all, read one, update > migration: ticktick migrate, ticktick status, vikunja-file migrate, vikunja-file status > notifications: read all, update > other: notifications, routes, users > projects: background, background delete, backgrounds upload, create, delete, projectusers, read all, read one, update > projectsDuplicate: create > projectsShares: create, delete, read all, read one > projectsTeams: create, delete, read all, update > projectsUsers: create, delete, read all, update > projectsViews: create, delete, read all, read one, update > projectsViewsBuckets: create, delete, read all, update > projectsViewsBucketsTasks: update > projectsViewsTasks: read all > projectsWebhooks: create, delete, read all, update > reactions: create, read all > reactionsDelete: delete > tasks: create, delete, read all, read one, update, update bulk > tasksAssignees: create, create bulk, delete, read all > tasksAttachments: create, delete, read all, read one > tasksComments: create, delete, read all, read one, update > tasksLabels: create, create bulk, delete, read all > tasksPosition: update > tasksRelations: create, delete > teams: create, delete, read all, read one, update > teamsMembers: create, delete > teamsMembersAdmin: update > webhooks: events Currently using: [v0.24.6](https://github.com/go-vikunja/vikunja/releases/tag/v0.24.6) ### Vikunja Version v0.24.6 ### Browser and version _No response_ ### Can you reproduce the bug on the Vikunja demo site? Yes ### Screenshots _No response_
GiteaMirror commented 2025-11-01 20:54:41 -05:00
Author
Owner
Copy Link

@alvarolm commented on GitHub (Jan 31, 2025):

it seems there is no implementation for handling these routes:

CanDoAPIRoute path /api/v1/user/export/request
CanDoAPIRoute routeGroupName-before user_export_request
CanDoAPIRoute routeGroupName user_export_request
CanDoAPIRoute routeParts [user export request]
CanDoAPIRoute token.Permissions:
{
  "other": ["notifications", "routes", "users"],
  "projects_shares": ["create", "delete", "read_all", "read_one"],
  "projects_webhooks": ["create", "delete", "read_all", "update"],
  "tasks_attachments": ["create", "delete", "read_all", "read_one"],
  "tasks": ["create", "delete", "read_all", "read_one", "update", "update_bulk"],
  "teams_members_admin": ["update"],
  "reactions_delete": ["delete"],
  "projects_duplicate": ["create"],
  "projects_views_buckets": ["create", "delete", "read_all", "update"],
  "tasks_assignees": ["create", "create_bulk", "delete", "read_all"],
  "tasks_comments": ["create", "delete", "read_all", "read_one", "update"],
  "webhooks": ["events"],
  "filters": ["create", "delete", "read_one", "update"],
  "migration": ["ticktick_migrate", "ticktick_status", "vikunja-file_migrate", "vikunja-file_status"],
  "projects": ["background", "background_delete", "backgrounds_upload", "create", "delete", "projectusers", "read_all", "read_one", "update"],
  "projects_teams": ["create", "delete", "read_all", "update"],
  "projects_views_tasks": ["read_all"],
  "tasks_labels": ["create", "create_bulk", "delete", "read_all"],
  "tasks_relations": ["create", "delete"],
  "teams_members": ["create", "delete"],
  "reactions": ["create", "read_all"],
  "notifications": ["read_all", "update"],
  "projects_users": ["create", "delete", "read_all", "update"],
  "tasks_position": ["update"],
  "teams": ["create", "delete", "read_all", "read_one", "update"],
  "labels": ["create", "delete", "read_all", "read_one", "update"],
  "projects_views": ["create", "delete", "read_all", "read_one", "update"],
  "projects_views_buckets_tasks": ["update"]
}
missing group for token.Permissions
missing group (routeParts[0]) for token.Permissions

logs.txt
api_routes.go.diff.txt

@alvarolm commented on GitHub (Jan 31, 2025): it seems there is no implementation for handling these routes: ``` CanDoAPIRoute path /api/v1/user/export/request CanDoAPIRoute routeGroupName-before user_export_request CanDoAPIRoute routeGroupName user_export_request CanDoAPIRoute routeParts [user export request] CanDoAPIRoute token.Permissions: { "other": ["notifications", "routes", "users"], "projects_shares": ["create", "delete", "read_all", "read_one"], "projects_webhooks": ["create", "delete", "read_all", "update"], "tasks_attachments": ["create", "delete", "read_all", "read_one"], "tasks": ["create", "delete", "read_all", "read_one", "update", "update_bulk"], "teams_members_admin": ["update"], "reactions_delete": ["delete"], "projects_duplicate": ["create"], "projects_views_buckets": ["create", "delete", "read_all", "update"], "tasks_assignees": ["create", "create_bulk", "delete", "read_all"], "tasks_comments": ["create", "delete", "read_all", "read_one", "update"], "webhooks": ["events"], "filters": ["create", "delete", "read_one", "update"], "migration": ["ticktick_migrate", "ticktick_status", "vikunja-file_migrate", "vikunja-file_status"], "projects": ["background", "background_delete", "backgrounds_upload", "create", "delete", "projectusers", "read_all", "read_one", "update"], "projects_teams": ["create", "delete", "read_all", "update"], "projects_views_tasks": ["read_all"], "tasks_labels": ["create", "create_bulk", "delete", "read_all"], "tasks_relations": ["create", "delete"], "teams_members": ["create", "delete"], "reactions": ["create", "read_all"], "notifications": ["read_all", "update"], "projects_users": ["create", "delete", "read_all", "update"], "tasks_position": ["update"], "teams": ["create", "delete", "read_all", "read_one", "update"], "labels": ["create", "delete", "read_all", "read_one", "update"], "projects_views": ["create", "delete", "read_all", "read_one", "update"], "projects_views_buckets_tasks": ["update"] } missing group for token.Permissions missing group (routeParts[0]) for token.Permissions ``` [logs.txt](https://github.com/user-attachments/files/18620397/logs.txt) [api_routes.go.diff.txt](https://github.com/user-attachments/files/18620484/api_routes.go.diff.txt)
GiteaMirror commented 2025-11-01 20:54:41 -05:00
Author
Owner
Copy Link

@kolaente commented on GitHub (Feb 3, 2025):

it seems there is no implementation for handling these routes

That's correct and by design. User routes have to use a user login token and won't work with an api token.

@kolaente commented on GitHub (Feb 3, 2025): > it seems there is no implementation for handling these routes That's correct and by design. User routes have to use a user login token and won't work with an api token.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
area/api
area/caldav
area/filters
area/frontend
area/gantt
area/internal-code
area/typesense
bug
changes requested
confirmed
dependencies
enhancement
good first issue
help wanted
kind/bug
kind/feature
needs reproduction
pull-request
Mirrored from GitHub Pull Request
 question
security
support
upstream issue
waiting for reply
wontfix
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
GiteaMirror ninjasurge
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: github-starred/vikunja#348
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?