How to get users' own data from a collection?
After a successful login, /auth/login does not return user-related info except the Bearer token.
So how do I request only the logged-in users' data from a collection?
While using GraphQL I can filter my result by this way if I knew my user ID. But I don't think it's the best way.
(filter:{user_created:{id:{_eq: "59d5bc57-6a67-4200-b435-553403c5b503"} }})
It's in the docs. :)
https://docs.directus.io/reference/api/system/users/?#retrieve-the-current-user
The endpoint "${api_url}/users/me" will return the information for the currently authenticated user. You should be able to map this to GQL as you need.
Related
We're using OAuth2 to allow users of our system to connect to Xero. Once the authorization succeeds, Xero provides an access token with information about the user who made the connection, including a xero_userid.
However, using this ID to find the user via the Users API fails with a 404. The Users API shows a different ID for the same user.
Is there a reason these are different? And how can we use the xero_userid returned in the Oauth2 flow to find to the Xero user via the Users API?
In XERO, the xero_user_id you extracted from access_token is the internal userID that XERO uses to recognize the contact. So If you use the same the GET API will return 404 as it is not accepting the internal user ID, instead of that If you pass the CONTACT ID of the User it will return 200 with details.
At the same time, If you want to get the login user details(contact information), better call the /User API directly with the token, it will return the details and the response contain the contactID of the user in UserID field (I know a bit complicated)
Please refer to the screenshot for more details.
I use JWT token in my project and i have an Api route that i want to remove token that send from user.
I searched a lot and many people say to put my route in $except array in VerifyCsrfToken class , but it does not work.
I want this solution because if user send request with token, the result that returned is differ from result that returned without token.
///edited
I have one route without middleware and guard, in Product model i wrote a global scope that affect on is_active column.
public function apply(Builder $builder, Model $model)
{
if (Auth::guard('manager')->check()) {
return $builder;
}
if (Auth::guard('customer')->check()) {
return $builder->where('is_active', '=',true);
}
return $builder->where('is_active', '=',true);
}
if manager use this route for products, all products returned.
i want the user's role have no effect on output.
in other word i want to remove token from some api routes
I am not sure I fully understand your question.
But isn't it possible to just adequately add one layer of middleware and do your filtering there?
So you could check if the user has a token or not and react accordingly (like forwarding the user on a specific route).
In case that may help, you can find a few middleware related videos here explaining how it works.
VerifyCsrToken is for CSRF and it's different with JWT token.
In this situation you have 2 different solution:
When your user is sending JWT token, It means your user was authenticated, and you can get user's object and send proper response.
You could make 2 different controller, and two routes, one of them for without token and another one with token, And according to user request, make your proper response.
I'm in the process of implementing auth0 login in my project, and to be as fast as possible I'm using a hosted login page. Following the auth0 vue docs I've got up and running quickly and I can login and logout users.
Now, I'm trying to create a user profile page with a route of user/:id. For the :id part I want to use the user_id of the user profile, but I'm having issues understanding the optimal way to get it. I realize I can use the auth0 api users endpoint but I'm not sure that's the correct way. Do I actually need to make an API call to the users endpoint each time an user clicks their profile? Is there no better way to get the user_id, maybe from the id_token which is set in localStorage upon login?
Even better, is there a way to get actual user ids? I know that if I would setup my own login with my own db, I'd have an auto incrementing id which I'd use for user id. This does not seem possible with Auth0, or am I wrong about that?
Disclosure: I work for Auth0.
The idToken returned at the end of the authentication / authorization is a JSON Web Token. This token contains the Auth0 user_id as the sub (subject) claim (property).
If you are using Auth0.js or our AuthService tutorial, Auth0.js will decode this token and give it to you as idTokenPayload object in the authResult. This can be used to identify the user as idTokenPayload.sub.
You can store this object as a whole in localStorage or simply decode the token that you accquired from localStorage. However, please note that you should validate the token after accquiring it from localStorage aswell.
To avoid all the above, you can simply use the checkSession method each time your application bootstraps to get a new copy of the accessToken / idToken and rely on that directly :)
I know the rally api and using it i can get rally user object id but it requires username and password. i don't know the password for other users. So is there any way to get the rally user object id for other user when the password is not known.
Sure. The user endpoint you linked to is a little special in that it always just gives you back yourself. If you instead hit the users (plural) endpoint this will behave as you are expecting and return all the users. You can query and sort these results the same way you would with any WSAPI endpoint.
https://rally1.rallydev.com/slm/webservice/v2.0/users
In my application I retrieve OAuth token as per standard procedure. I know that the proper way to 'resolve' token to user information (including ID) is via:
https://graph.facebook.com/me?access_token=<token>
However this method appears to return 'false' for the so-called gray/advertising Facebook accounts. It so happens that I also need to deal with such accounts.
How can I retrieve user ID or any other useful user information for such accounts if the only information I have is OAuth access token? Should I resort to parsing the token to extract user ID a la http://benbiddington.wordpress.com/2010/04/23/facebook-graph-api-getting-access-tokens/ ?
Well, I still have no idea how to do it via Graph API.
Via 'legacy REST API' you can at least invoke this: users.getLoggedInUser
This will give you user ID (uid).