To avoid breaking config requests.
This will mean that we always require a separate access token for config
requests, even though the more powerful 'api' scope token would be
enough to request the config (but we can't refresh without passing 2fa).
Details
Details
- Reviewers
- None
- Group Reviewers
Roundcube Kolab Plugins Developers - Commits
- rRPK5b8c505aade3: Use a token with the 'config' scope for the user config request
Diff Detail
Diff Detail
- Repository
- rRPK roundcubemail-plugins-kolab
- Lint
Lint Not Applicable - Unit
Tests Not Applicable
Event Timeline
| plugins/kolab/Kolab/Client.php | ||
|---|---|---|
| 159 | The error handling is currently not great. When we fail to retrieve a token:
| |
Comment Actions
Having a single secret token that identifies Roundcube client and allows for user impersonation on config/webmail request only would probably be better. It would allow to skip /api/auth/login and directly call /api/v4/config/webmail, e.g. with Bearer <email>:<secret>. It would also eliminate any token refresh issues, as it would not have to be refreshed.
The error handling issue... not great, I think we could "abort" from Configuration::authenticateHook() and for syncroton throw a proper error/code from ::readyHook().