mozilla/socorro — pull request #1902 by peterbe (2014-02-20 22:45:54+00:00)
Title: Bug 967555 add authentication for public api

@rhelmer r? (cc @lauraxt)

I'll try to explain what parts are worth actually reviewing (apart from the usual trivial stuff).

What this introduces is the ability to do something like
```
curl -v -H "Auth-Token: 1a5672a09a4943aa9b1fb680e7838c03 " "http://socorro/api/ReportList/?end_date=2014-02-14&signature=nsContentUtils%3A%3AIsCallerChrome()&start_date=2014-02-01&result_number=3"
```
or
```
curl -v -H "Auth-Token: 1a5672a09a4943aa9b1fb680e7838c03 " "http://socorro/api/CrashesByExploitability/?batch=10&page=1"
```

Firstly, the token acts a bit like a session cookie. EXCEPT the session cookie is used to find a user instance to insert onto the `request`, in this patch the `request.user.has_perm` is overwritten so that the `has_perm` question isn't based on the user but based on the token you generated and used.
I.e. you can generate a token that only has the "View PII data" permission and if you use this token's key to try to reach `.../api/CrashesByExploitability/...` you get a 403 Forbidden.
In other words, you (as rhelmer@muzilla.com) might be part of a group (e.g. Hackers) that has certain permissions but depending on how you use your tokens, your permissions on the site don't matter. Does that make sense?

Secondly, the API is now dependent on the `request.user` and `request.user` and does not care how that got set. This means that if you use the API with curl and a token as a header, it's still `request.user.has_perm(...)`. And if you sign in to the site and use the API documentation to do some AJAX sample queries it uses the user you are signed in as. What this means is that if you have the "View PII data" permission on the site, you'll be able to use the API endpoints in AJAX and get all the PII included! This means we can use the API as the source of AJAX in various reports instead of having to do things like `someview_json_data`.

Thirdly, the model "CrashesByExploitability" used to be blacklisted in the API and not included in the documentation if you view `/api/`. That's no longer the case. I added a new class attribute called `API_REQUIRED_PERMISSION` which I hope is self-explanatory.