**Quick Question for V14 hacking**
# package-developmentw
Warren Buckley
02/19/2024, 6:54 PMQuick Question for V14 hacking
Is there anything specific need to do for API controllers for new backoffice ?
Inherit from some base controller or decorate with some attributes?
Looking at @Bjarke Berg @Nikolaj Lauridsen @Sven Geusens from core team or even@Kevin Jump (who's probably figured it out already)
r
rickbutterfield
02/19/2024, 7:10 PMBased on Kevin's articles, he suggested creating a base controller that's decorated, then inheriting from that. I did the same when trying to upgrade the sustainability package (base class: https://github.com/rickbutterfield/Umbraco.Community.Sustainability/blob/feature/umbraco-14/src/Umbraco.Community.Sustainability/Controllers/SustainabilityWorkspaceControllerBase.cs, controller: https://github.com/rickbutterfield/Umbraco.Community.Sustainability/blob/feature/umbraco-14/src/Umbraco.Community.Sustainability/Controllers/SustainabilityWorkspaceController.cs)
w
Warren Buckley
02/19/2024, 7:20 PMAh thanks must have missed that article from Kevin !
k
Kevin Jump
02/19/2024, 7:22 PMyeah - its in its own series 🙂 https://dev.to/kevinjump/series/26248
Kevin Jump
02/19/2024, 7:22 PMspecifically the first one. https://dev.to/kevinjump/early-adopters-guide-to-umbraco-v14-packages-communicating-with-the-server-part-1-38lb
Kevin Jump
02/19/2024, 7:22 PMIf you do it right then all the code gen stuff does the client work for you.
Kevin Jump
02/19/2024, 7:23 PMAt some point i think i am going to tidy up / rename the repo - so its more like a 'snippets' / dostuff type thing but it too has the code in it. https://github.com/KevinJump/TimeDashboard/tree/master/TimeDashboard.Client/Controllers
w
Warren Buckley
02/19/2024, 7:25 PMOk thanks both
Warren Buckley
02/19/2024, 7:29 PMI assume this policy name will change once V14 is out and drop the New prefix ?
One for the HQ gang I suppose
[Authorize(Policy = "New" + AuthorizationPolicies.BackOfficeAccess)]k
Kevin Jump
02/19/2024, 8:04 PMYeah I guess it will, or at least be built into the constants
s
Sven Geusens
02/19/2024, 8:05 PMyup, should be removed before the beta
Sven Geusens
02/19/2024, 8:05 PMWe currently have somebody killing of the old backofice controllers to be able to do just that
w
Warren Buckley
02/26/2024, 5:31 PMOne for @Kevin Jump & @rickbutterfield
Did you have to do anything magic to authenticate correctly when testing/trying out your API with the Swagger UI ?
Currently getting 401 auth errors (even though I clicked the auth button at the top of Swagger)
Warren Buckley
02/26/2024, 5:31 PMWondering if I missed some plumbing stuff
k
Kevin Jump
02/26/2024, 5:32 PMI haven't ever actually authed in UI. I presume you need to grab the bearer token from a login request ?
w
Warren Buckley
02/26/2024, 5:32 PMHow have you been testing your API before connecting to your WebComponent stuff ?!
k
Kevin Jump
02/26/2024, 5:33 PMI've been connecting it and testing it from the code 🙂
w
Warren Buckley
02/26/2024, 5:33 PM💪
Warren Buckley
02/26/2024, 5:34 PMAs I click this button to
Authorizek
Kevin Jump
02/26/2024, 5:35 PMYeah I think with something like postman you could login to the Auth end point and then you would have the bearer token for other requests
w
Warren Buckley
02/26/2024, 5:35 PMHmm yeh I may give that a go in a bit to try it out
k
Kevin Jump
02/26/2024, 5:36 PMIf you load the swagger into postman it will probably do it for you
w
Warren Buckley
02/26/2024, 5:36 PMAh yeh good shout
Warren Buckley
02/26/2024, 5:36 PMWill play a bit later on tonight (if time) & shout how I get on
Warren Buckley
02/26/2024, 8:46 PMOK Postman doesn't do anything with auth magically for me.... 🤔
Warren Buckley
02/26/2024, 8:46 PM@Sven Geusens maybe you might be able to shine a little light on this for me please
s
Sven Geusens
02/26/2024, 8:53 PMYeah, you need to configure it and update the inheritence on the endpoints 🙈
I will share details tomorrow (if i don't forget) and I have a cyclehack plan (in like 2 maybe 3...) to automate it since the postman api is available
Sven Geusens
02/26/2024, 8:54 PMNormally if you do the authorize on swagger, and login, it should capture the token and allow you to continue in swagger.
I know it was broken at some point when there were changes with the new login screen, but used it last week and today without any issues.
w
Warren Buckley
02/26/2024, 8:58 PMProbably a 'me' issue then and not wired something up correctly
Warren Buckley
02/26/2024, 9:04 PMCurrently using
Preview--006Preview-005007k
Kevin Jump
02/26/2024, 9:07 PMNah I think 006 is fine (the template is using it), I think I went to 007 locally it is/was bust I have rolled back but not updated that repo.... I thought 008 was imminent last week .. but it seems to have stalled
w
Warren Buckley
02/26/2024, 9:11 PMSo if 006 auth's fine and works for you, then I reckon it's a me issue then
Warren Buckley
02/26/2024, 9:11 PMCan you login and excute the APIs directly from the Swagger UI with 006 out of interest ?
Warren Buckley
02/26/2024, 9:17 PMFurther source code diving whilst im trying to figure out what I have done wrong...
There is code/constants specific to Swagger & Postman
Constants.OAuthClientIds.PostmanConstants.OAuthClientIds.SwaggerWarren Buckley
02/26/2024, 9:44 PMFor anyone following along with my ramblings...
It seems this PR was what I needed and the auth magic works with Swagger UI 🎉
PR for reference
https://github.com/umbraco/Umbraco-CMS/pull/15699
TL:DR version
* ConfigureSwaggerGen options -> OperationFilter
* Create new class that inherits from base class
BackOfficeSecurityRequirementsOperationFilterBaseWarren Buckley
02/26/2024, 9:45 PMEnough hacking for one night - nighty night 💤
Warren Buckley
02/27/2024, 11:48 AMFriendly bump @Sven Geusens
Curious to know how/what I would need to do differently for Postman?!
s
Sven Geusens
02/27/2024, 11:49 AMIncomming!
Sven Geusens
02/27/2024, 11:53 AMNeed to find a place to put this in the docs somewhere
w
Warren Buckley
02/27/2024, 11:53 AMSuper star ⭐
Warren Buckley
02/27/2024, 11:54 AMWill try it on my lunch break
s
Sven Geusens
02/27/2024, 11:54 AMLuckily I already wrote this up, let me know if it's outdated 😄
w
Warren Buckley
02/27/2024, 11:54 AMYep will follow along and see how it goes 😄
Warren Buckley
02/27/2024, 11:55 AMAnd I assume I was right with the PR from Kenn above as part of my missing puzzle to get it to magically work with Swagger
Warren Buckley
02/27/2024, 12:10 PMie this Sven
* ConfigureSwaggerGen options -> OperationFilter
* Create new class that inherits from base class
BackOfficeSecurityRequirementsOperationFilterBases
Sven Geusens
02/27/2024, 12:10 PMBut that is only for custom controllers right?
w
Warren Buckley
02/27/2024, 12:10 PMYeh which is what I am writing for a package
s
Sven Geusens
02/27/2024, 12:10 PM🤦♂️ I misunderstood 😄
Sven Geusens
02/27/2024, 12:11 PMGlad you found that pr 👍
w
Warren Buckley
02/27/2024, 12:12 PMYeh was just frantic code diving and crawling issues/PRs for stuff
Warren Buckley
02/27/2024, 12:13 PMI just wanted to double check/sanity check it was the right thing to be doing, but it seems it is 🙂
s
Sven Geusens
02/27/2024, 12:16 PMHave put it on the docs team radar.
w
Warren Buckley
02/27/2024, 5:42 PM@Sven Geusens I get a 404 when trying to get Postman to do the oAuth handshake
https://localhost:44310/umbraco/management/api/v1/security/backoffice/authorize?response_type=code&client_id=umbraco-postman&redirect_uri=https%3A%2F%2Foauth.pstmn.io%2Fv1%2Fcallback&code_challenge=ijDGklhnt4F9Esmmfs4a1MQVinCBqzogsxNhz22-wNQ&code_challenge_method=S256
s
Sven Geusens
02/27/2024, 5:42 PMhop in voice?
w
Warren Buckley
02/27/2024, 5:44 PMI can't right now juggling kid routine, so its one ear out and one eye on laptop 😛
Warren Buckley
02/27/2024, 5:44 PMWonder if the URL/route has changed to do the authorize?!
Warren Buckley
02/27/2024, 5:44 PMAppreciate the offer to chat/call though
s
Sven Geusens
02/27/2024, 5:45 PMI got this configured
{{baseUrl}}/umbraco/management/api/v1/security/back-office/authorize
w
Warren Buckley
02/27/2024, 5:47 PMits changed then from backoffice to
back-officeWarren Buckley
02/27/2024, 5:47 PMWill try again
s
Sven Geusens
02/27/2024, 5:48 PMah god damn, good catch I read over that 3 times...
Sven Geusens
02/27/2024, 5:49 PMAm I seeing this wrong or does the doc say
back-officew
Warren Buckley
02/27/2024, 5:49 PMand same for the token request url as well
{{baseUrl}}/umbraco/management/api/v1/security/back-office/tokenWarren Buckley
02/27/2024, 5:50 PMIt does say it in the PDF - its just copied bloody horribly over 🙈
s
Sven Geusens
02/27/2024, 5:50 PM😄
w
Warren Buckley
02/27/2024, 5:51 PMand HUZZAH it works. I can test my API in Postman and not just Swagger !
Warren Buckley
02/27/2024, 5:52 PMCheers Sven
s
Sven Geusens
02/27/2024, 5:52 PMHuzzah! Happy hacking!
w
Warren Buckley
02/27/2024, 5:52 PMThanks thats later on tonight when I get some time back on the laptop
b
biapar
09/11/2024, 3:01 PMHow to for the members?
s
Sven Geusens
09/13/2024, 3:50 PMmembers do not have acces to protected management api endpoints.
If you want to authorize against protected content in the delivery api.
Then send the Api-Key header along with your request that's configured in the appsettings.
For more info:
https://docs.umbraco.com/umbraco-cms/reference/content-delivery-api#additional-configuration (and check the header section for the endpoints documentation lower in the article)
15 Views