Public API

[sebgie]

refs #4180
closes #4181

• added client and user authentication
• added authenticatePublic/authenticatePrivate as workaround for
  missing permissions
• added domain validation
• added CORS header for valid clients
• merged authenticate.js and client-auth.js into auth.js
• removed middleware/api-error-handlers.js
• removed authentication middleware
• added and updated tests

[letsjustfixit]

Wow thats awesome!

[ErisDS]

@sebgie Am super excited about this! 💃 🎈 🍩 🎉

Whenever you have a sec, it would be great if you could update the description to have a section explaining what this PR gives users who are interested in our API and how to test it, with the TLDR; being read-only access to a set of public-data endpoints.

Much excite 🎊 🎆

[sebgie]

I have tested this PR with some basic requests. I simply added a script to a blog post and published it. This code will retrieve all tags from your blog and output them as a list.

All Tags:

<ul id="result"></ul>

<script>
window.onload = function(){
    var url = 'https://ssl.tryghost.org/ghost/api/v0.1/tags/?client_id=ghost-frontend&client_secret=<your secret>';

    var addListItem = function(elem) {
        var ul = document.getElementById("result"),
            li = document.createElement("li");

        li.appendChild(document.createTextNode(elem));
        ul.appendChild(li)
    }
    $.get(url, function( data ) {
        $.each(data.tags, function( index, value ) {
            addListItem( index + ": " + value.name );
        });
    });
};

</script>

The value for client_secret must be retrieved from the database for now.

[ErisDS]

First person to show us a screenshot of their ajax-fetched tag list gets a 🍪

[ErisDS]

I've taken this for a spin, and found a little bit of an issue 😐

This is probably in some spec somewhere & kinda makes sense, but jQuery's $.ajax or $.get methods only set the origin header when the domains don't match, so when I tried this out first making a request to http://localhost:2368 from http://localhost:2368 I get an unauthorized error.

There is a host header and a referrer header, but no origin.

[sebgie]

I've updated this PR. It is no possible to:

• send request from config.url and config.urlSSL
• send requests without origin header (access header will be set to config.url)
• send requests from trusted domains (access header will be the same as origin)

[ErisDS]

Looks like I win the 🍪 😉

[ErisDS]

Just for future ref, my version of the code to fetch this

<script type="text/javascript">
        var apiUrl = 'http://localhost:2368/blog/ghost/api/v0.1/',
            clientId = 'ghost-frontend',
            clientSecret = 'abcdef123456',
            url = apiUrl + 'tags/?limit=all&client_id=' + clientId + '&client_secret=' + clientSecret;

        function onSuccess(data) {
            var $result = $('#result');
            $.each(data.tags, function (i, tag) {
                $result.append('<li><a href="/tag/' + tag.slug + '/">' + tag.name + '</a>&nbsp;</li>');
            });
        }
       $(document).ready(function () {
           $.ajax({url: url, type: 'get'}).done(onSuccess);
       });
    </script>

Trying to make the tags linkable made me realise it'd be desirable to expose our url-building code somehow.