This modules is pretty interesting for updating and designing Drupal site. I have an external webapp/page where I run waterwheel commands that uses jsonapi formats.

I have a valid Oauth declared at the top of the page script and I was able to successfully create a node or content using GET, PATCH and POST method using waterwheel.

I have VotingAPi installed in the site to implement voting in nodes and entities.

Now, when trying to use GET of votes and pull data from site, I am getting an "Access Denied" from the Drupal logs and 403 Response in the browser console.

This is the command I issued to access the votes where I got the error:

waterwheel.jsonapi.get('vote/like/[VOTE_UUID]', {})
  .then(res => {
    console.table(res)
    console.log('Success!')
    })
 .catch(err => {
    console.log(err)
});
CommentFileSizeAuthor
#13 voting_api_getting_an-2872435-13.patch4.69 KBsylus
#12 voting_api_getting_an-2872435-12.patch5.25 KBsylus
#7 voting_api_getting_an-2872435-7.patch8.09 KBsylus
Support from Acquia helps fund testing for Drupal Acquia logo

Comments

johnreytanquinco created an issue. See original summary.

dawehner’s picture

dawehner
Primary language German
CreditAttribution: dawehner at Chapter Three commented

I believe the main problem is that voting API doesn't expose any access control handler for this entity: http://cgit.drupalcode.org/votingapi/tree/src/Entity/Vote.php?h=8.x-3.x#n23 so access is never granted.

clemens.tolboom’s picture

clemens.tolboom
Primary language Dutch
Location Groningen, 🇳🇱/🇪🇺
CreditAttribution: clemens.tolboom as a volunteer commented
Title: Getting an access denied or 403 response using GET method » Voting API: Getting an access denied or 403 response using GET method

I guess this can be moved to Voting API project right? Please do so.

dawehner’s picture

dawehner
Primary language German
CreditAttribution: dawehner at Chapter Three commented

@clemens.tolboom
I totally believe so.

Wim Leers’s picture

Wim Leers
Location Ghent 🇧🇪🇪🇺
CreditAttribution: Wim Leers at Acquia commented
Project: JSON:API » Voting API
Version: 8.x-1.0-rc1 » 8.x-3.x-dev
Issue tags: +API-First Initiative
GrandmaGlassesRopeMan’s picture

GrandmaGlassesRopeMan
he/him
Primary language English
Location 🌎
CreditAttribution: GrandmaGlassesRopeMan at Acquia commented
Issue tags: +Waterwheel.js
sylus’s picture

sylus CreditAttribution: sylus commented
FileSize
voting_api_getting_an-2872435-7.patch8.09 KB

I needed the baseline functionality for this to work in my integration with external_entities + custom storage clients (CKAN + Solr). External entities works great with external_comments so just needed to get voting to work. I am leveraging the votingapi_widgets module + the following patch to votingapi:

https://www.drupal.org/files/issues/2846341-anonymous-votes-5.patch

For now I just returned Access:Allowed for both Vote + VoteResult. However there were still issues with Vote Result which does not have a UUID column which causes issues with jsonapi. I added this column and now the following queries do work along with relationships to nodes:

All Votes / Votes by UUID

http://{{src}}/jsonapi/vote/vote
http://{{src}}/jsonapi/vote/vote/uuid

All Vote Results / Vote Results by UUID

http://{{src}}/jsonapi/vote_result/vote_result
http://{{src}}/jsonapi/vote_result/vote_result/uuid

Get all votes from a specific node

http://{{src}}/jsonapi/vote/vote?_format=api_json&filter[nid-filter][condition][path]=entity_id.uuid&filter[nid-filter][condition][value]=bbcd93a0-24b6-4011-b4a0-644628676fdf

Get the vote calculated average from a specific node

http://{{src}}/jsonapi/vote_result/vote_result?_format=api_json&filter[node][condition][path]=entity_id.uuid&filter[node][condition][value]=bbcd93a0-24b6-4011-b4a0-644628676fdf&filter[function][condition][path]=function&filter[function][condition][value]=vote_average
clemens.tolboom’s picture

clemens.tolboom
Primary language Dutch
Location Groningen, 🇳🇱/🇪🇺
CreditAttribution: clemens.tolboom as a volunteer commented
Related issues: +#2846341: Different anonymous users cannot vote separately

Sound great! I've added #2846341: Different anonymous users cannot vote separately as related.

johnreytanquinco’s picture

johnreytanquinco CreditAttribution: johnreytanquinco commented

Yes, tried your patch and we are getting errors from the log related to UUID as you mentioned:

Drupal\Core\Database\DatabaseExceptionWrapper: SQLSTATE[42S22]: Column not found: 1054 Unknown column 'base.uuid' in 'field list': SELECT base.id AS id, base.uuid AS uuid, base.type AS type, base.entity_type AS entity_type, base.entity_id AS entity_id, base.value AS value, base.value_type AS value_type, base.function AS function, base.timestamp AS timestamp FROM {votingapi_result} base WHERE base.id IN (:db_condition_placeholder_0); Array ( [:db_condition_placeholder_0] => 8 ) in Drupal\Core\Entity\Sql\SqlContentEntityStorage->getFromStorage() (line 428 of /var/www/opensocial/html/core/lib/Drupal/Core/Entity/Sql/SqlContentEntityStorage.php).

p4tric’s picture

p4tric CreditAttribution: p4tric commented

I am also getting the same error.

magick93’s picture

magick93 CreditAttribution: magick93 commented

I am also facing the same issue. Any updates on this?

sylus’s picture

sylus CreditAttribution: sylus commented
FileSize
voting_api_getting_an-2872435-12.patch5.25 KB

Ah apologies, I broke out the UUID stuff and just added the access control as should introduce the UUID problems in another issue.

I forgot it requires a patch to core's EntityReferenceItem.php to determine when to use string (uuid) vs int for referencing an entity which will cause the BaseFieldDefinitions on install to relate to.

Updated patch with just the baseline need to not get this issue, but they are largely just access bypass so will need to add more appropriate checks.

sylus’s picture

sylus CreditAttribution: sylus commented
FileSize
voting_api_getting_an-2872435-13.patch4.69 KB

Forgot to remove the entity constraint override.

johnreytanquinco’s picture

johnreytanquinco CreditAttribution: johnreytanquinco commented

Hi @sylus, Thanks for updating the patch. I actually tried to run a simple test using GET and POST in postman. I was able to fetch details using get, but now when posting or updating a vote I am still getting a 403 response. I think I have correct configuration and permission of vote. I even allow anonymous use to vote in contents and its working fine with manual voting.

In postman I use `sitename/entity/vote` as path for `post` method where I am getting a 403 response. It actually logs in to the site but can't update or post vote on the content.

magick93’s picture

magick93 CreditAttribution: magick93 as a volunteer commented
magick93’s picture

magick93 CreditAttribution: magick93 as a volunteer commented

Hi Sylus, which Drupal core version did you test this fix on?

johnreytanquinco’s picture

johnreytanquinco CreditAttribution: johnreytanquinco commented

My mistake. I confirmed the patch works as expected. I was able to update the vote using post. Thanks! Appreciate it!

mqanneh’s picture

mqanneh
he/him
Primary language English
Location Amman
CreditAttribution: mqanneh as a volunteer and at Sprintive commented
Status: Active » Reviewed & tested by the community

Patch #13 fixed the issue.

  • pifagor committed 3523ad2 on 8.x-3.x 
    Issue #2872435 by sylus: Voting API: Getting an access denied or 403...
pifagor’s picture

pifagor
Location 🇺🇦 Rivne
CreditAttribution: pifagor as a volunteer and at Drupal Ukraine Community, GOLEMS GABB for Drupal Ukraine Community, GOLEMS GABB commented
Status: Reviewed & tested by the community » Fixed

Done

pifagor’s picture

pifagor
Location 🇺🇦 Rivne
CreditAttribution: pifagor as a volunteer and at Drupal Ukraine Community for Drupal Ukraine Community commented
Status: Fixed » Closed (fixed)