Maybe it’ll help if I include some code …
Here’s how I get my Authorization Token:
domain = 'http://localhost:8080'
user = 'normalusr'
password = 'gobbledygook'
# These will be the same for all requests/responses.
headers = {
'Content-Type': 'application/json',
'Accept': 'application/json',
'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36'
}
# Create an http session.
client = requests.Session()
client.headers['User-Agent'] = self._headers['User-Agent']
# Login
login_data = {'AuthInfo': {'login': user, 'password': password, 'type': 'credentials'}}
r = client.post('http://localhost:8080/a/frontend/session', json=login_data, headers=headers)
# a valid JWT token should be found in the returned JSON object ...
jwt_token = r.json()['JWT']
jwt_expire = r.json()['ExpireTime'] # in seconds
# Add this to headers
headers['Authorization'] = 'Bearer {}'.format(jwt_token)
From this point on (until the jwt_token expires) I’m able to make API calls.
For example,
result = client.get('http://localhost:8080/a/user/normalusr', headers=headers)
if result.status_code == 200:
print("normalusr's profile: ", result.json())
I can do POST requests to the /a/tree/stats endpoint to walk the tree, too. So far, I haven’t found an API endpoint that won’t work using this method.
After a fair bit of tracing with the developer tools panel in chrome, I was able to make file downloads work. I had a file named spock-logic.jpg in my personal workspace. I’ll spare the gory details and just say that the only difference between using an API endpoint and downloading a file involved figuring out what the URL should look like, and using application/octet-stream instead of application/json for the Content-Type. As I described in my earlier comment, the URL pattern looks like this:
download_url = "http://localhost:8080/io/ws-personal-workspace/cute-kitten.jpg"
Note the io prefix (instead of a, as used in the API endpoints), and that Personal Workspace has been sluggified and prepended with ws-.
That sums up what I’ve been able to do. What I cannot do, so far, is upload.
Again, dragging and dropping my logic-spock.jpg file into my Personal Workspace while tracing with developer panel, I see this is just using an http PUT request that looks much like the download. (Note, it seems that it first does a /a/tree/stats API call for the given path, which I presume is to check to see if there is already a file there by that name. When the result comes back with an empty JSON object, it then proceeds to do the PUT request. Here’s a screenshot of the network trace:
You can see the tree/stats request, which sends the personal-workspace/logic-spock.jpg in the request’s JSON payload: {"NodePaths":["personal-files/logic-spock.jpg"]}, and gets an empty JSON object in the response body.
Next, it sends a PUT to this URL:
http://10.33.9.46:8080/io/personal-files/logic-spock.jpg?AWSAccessKeyId=gateway&Content-Type=application%2Foctet-stream&Expires=1579564291&Signature=nqIzr%2Fm6VXKPsPxbTTlXomZY1EE%3D
Maybe it’s my bad eyesight, but, I don’t see S3 anywhere in that URL.
Here are the request headers and query string:
PUT /io/personal-files/logic-spock.jpg?AWSAccessKeyId=gateway&Content-Type=application%2Foctet-stream&Expires=1579564291&Signature=nqIzr%2Fm6VXKPsPxbTTlXomZY1EE%3D HTTP/1.1
Host: 10.33.9.46:8080
Connection: keep-alive
Content-Length: 54164
DNT: 1
X-Pydio-Bearer: eyJhbGciOiJSUzI1NiIsImtpZCI6IjVjOGRjNTY0ZGMwZjVlMDcyZmE4ZTIzMTM2YzI0NDUxM2MwZmYyZTYifQ.eyJpc3MiOiJodHRwOi8vMTAuMzMuOS40Njo4MDgwL2F1dGgvZGV4Iiwic3ViIjoiQ2lRMFl6VmhOV0UyTkMweFpUY3lMVFJqWWpJdE9UQXpOQzAzTURGalltRTJaVFV6TWpBU0JYQjVaR2x2IiwiYXVkIjoiY2VsbHMtZnJvbnQiLCJleHAiOjE1Nzk1NjM4ODYsImlhdCI6MTU3OTU2MzI4Niwibm9uY2UiOiI1ODhiNzQwYi1jZmQ2LTRkMDYtOGU0Ny1kNmYyYTk5M2NhMjgiLCJhdF9oYXNoIjoiSXgxNGJXQk1mRWJuWTRxQkdmTzJVQSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJuYW1lIjoibmlja3MifQ.TpFeFUEzgGHJP2g6FOcQ3UpNFA5TzM-nLg_1qBaOq87FGjAqI3ecXFzO1l9gVK_FyPI7q0xy38SZTXzx2XZqnmFnVuZFJ-qWPLYd8fMVvnWIwK54h4Cx7MCmxzA7OZUzFUh-0aVasEN2lLoMz-f-0RhaUod96Mc1xKcGowBTPn2yFiOWFbXUKAPnbL52xj1g6tz2GL2KgwXkRfQYtMEDv-vL8GQjRv6o1FpZAzDx9uXXlvY-JTcNdslnOLk6RqnoJaIqFaqK91SVME7FqIyovtLPRAAGhNI56BY-O9D8oOcpX6UUhRpDdCTLYzgJEEJv7H1A6XbGmw6oYAB0Jfw26Q
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36
Content-Type: application/octet-stream
Accept: */*
Origin: http://10.33.9.46:8080
Referer: http://10.33.9.46:8080/ws-personal-files/
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en-US;q=0.9,en;q=0.8
and the query string:
AWSAccessKeyId=gateway&Content-Type=application%2Foctet-stream&Expires=1579564291&Signature=nqIzr%2Fm6VXKPsPxbTTlXomZY1EE%3D
Again, no mention of S3 at all. There are some other differences, too. Instead of an Authorization header, we have X-Pydio-Bearer, which looks very much like it’s a JWT token. It doesn’t have the Bearer prefix that the Authorization header has, but it is otherwise identical to that value. Yet, when I try to replicate this PUT programmatically, using that token (using just the token part, with out the Bearer prefix found in the Authorization header) I see this in the server log:
2020-01-20T23:48:48.147Z ERROR pydio.rest.frontend error retrieving token {"token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjVjOGRjNTY0ZGMwZjVlMDcyZmE4ZTIzMTM2YzI0NDUxM2MwZmYyZTYifQ.eyJpc3MiOiJodHRwOi8vMTAuMzMuOS40Njo4MDgwL2F1dGgvZGV4Iiwic3ViIjoiQ2lRMFl6VmhOV0UyTkMweFpUY3lMVFJqWWpJdE9UQXpOQzAzTURGalltRTJaVFV6TWpBU0JYQjVaR2x2IiwiYXVkIjoiY2VsbHMtZnJvbnQiLCJleHAiOjE1Nzk1NjM4ODYsImlhdCI6MTU3OTU2MzI4Niwibm9uY2UiOiI1ODhiNzQwYi1jZmQ2LTRkMDYtOGU0Ny1kNmYyYTk5M2NhMjgiLCJhdF9oYXNoIjoiSXgxNGJXQk1mRWJuWTRxQkdmTzJVQSIsImVtYWlsX3ZlcmlmaWVkIjp0cnVlLCJuYW1lIjoibmlja3MifQ.TpFeFUEzgGHJP2g6FOcQ3UpNFA5TzM-nLg_1qBaOq87FGjAqI3ecXFzO1l9gVK_FyPI7q0xy38SZTXzx2XZqnmFnVuZFJ-qWPLYd8fMVvnWIwK54h4Cx7MCmxzA7OZUzFUh-0aVasEN2lLoMz-f-0RhaUod96Mc1xKcGowBTPn2yFiOWFbXUKAPnbL52xj1g6tz2GL2KgwXkRfQYtMEDv-vL8GQjRv6o1FpZAzDx9uXXlvY-JTcNdslnOLk6RqnoJaIqFaqK91SVME7FqIyovtLPRAAGhNI56BY-O9D8oOcpX6UUhRpDdCTLYzgJEEJv7H1A6XbGmw6oYAB0Jfw26Q", "error": "empty idToken"}
At this point, I’m rather stuck. I’ll try a couple of the other things suggested in the page Zayn updated, but, it’s not clear to me that these are relevant if I’m not using postman, or the authentication method described.
