AngularJS and Restws

Hi, just saw this, but thought I'd help out if someone else is looking for some basic code usage.

(function () {
  'use strict';

  angular.module('myApp', [
    'ngResource',
  ])
    .constant('basePath', Drupal.settings.basePath)
    .config(function($httpProvider) {

      // Add Drupal RestWS module specific configuration.
      $httpProvider.defaults.headers.common['X-CSRF-Token'] = Drupal.settings.myApp.restws_csrf_token;
      $httpProvider.defaults.headers.common['Content-Type'] = 'application/json';
    })
}());

(function () {
  'use strict';

  angular.module('myApp')
    .factory('EntityService', function ($resource, basePath) {
      return $resource(
        basePath + ':entity_type/:id',
        {},
        {
          update: {
            method: 'PUT',
            isArray: true
          },
          delete: {
            method: 'DELETE',
            isArray: true
          },
          save: {
            method: 'POST',
            responseType: 'json'
          }
        }
      );
    });
}());

angular.module('myApp')
  .controller('NodesCtrl', function($scope, EntityService) {

    $scope.init = function () {
      var query = {
        entity_type: 'node',
        full: 1
      };
      
      EntityService.get(query).$promise.then(function (data) {
        $scope.nodes = data.list;
      });

    };
  });

Glad to hear it. This is what I'm using:

EntityService.delete({entity_type:'node', id:nid}).$promise.then(function (data) {
// success
      }, function(error) {
// error
      });

No special login, just the regular Drupal login. I'm just using the restws_csrf_token, since all of my users must be logged in to view/use the app. It's included in the code I posted earlier.

yep... same domain. I haven't had to deal with this since all my apps are drupal modules. You might take a look at the auth module included with restws.

@media-crumb: Pretty sure you'd need to pass the XSRF-TOKEN header for http requests between domains. Fwiw, my Angular integration mod does have some XSRF-TOKEN cookie and header stuff if you want to borrow some code: https://www.drupal.org/project/ngapp

Hey kenianbei/natemow,

how did you get hold of the CSRF token in the first place?
I get how to use it in my angular app, but when i post to restws/session/token with header set as
'Content-type': 'text/plain',
'Authorization': base64Login

... I get a preflight 403

btw, I used ngapp for a younger project and was well pleased with its simplicity but now trying to build headless & needed more complexity.

Full issue posted here: https://www.drupal.org/node/2698121

I'm replying tl;dr style, so maybe I'm not understanding your full issue, sorry in advance. The CSRF token sent from angular is pulled from Drupal JS settings:

$element['app'] = array(
  '#attached' => array(
    'js' => array(
      array(
        'data' => array(
          'myApp' => array(
            'restws_csrf_token' => drupal_get_token('restws'),
          ),
        ),
        'type' => 'setting',
      ),
    ),
  ),
);

Ahh, I see now you are fully headless... you are querying for the token. I have not done it this way before as we are still using Drupal for HTML rendering.

Thanks for the swift reply Kenianbel

Yeh. As soon as PHP/Drupal is involved, i start to break down ! :)
So I decided my best course of action was to remove myself entirely from the scenario and code what I wanted pure JS.

I've tried ngApp and really enjoyed it but got confused at the crossover between php/js

If I can get drupal to output, then I can always sort it out on the client end !

Did some futher digging and it appears my issue my be as follows, or at least the first stage of it :

(https://www.drupal.org/node/1084144)

The GET /restws/session/token doesn't work for modern browsers. In a cross domain request an OPTIONS request will be fired first. (see https://developer.mozilla.org/en-US/docs/Web/HTTP/Access_control_CORS#Ov...).

As the restws module returns a 403 on the url, the actual GET request is never fired.

It appears my first wall was the OPTIONS request getting sent,

marcus_w circumvented that with his patch - hooraa,

As a result im now executing a POST request as detailed in my issue to session/token but still getting a 403 returned.