On Nov 05, 2012, at 09:18 PM, Florian Fuchs wrote:
Of course it would be nice if a public API wouldn't require Django. But we already have authorization functionality for all kinds of roles in Postorius. And to add a JSON API shouldn't be so hard.
I think it's great for Postorius to provide an authenticated API. The beauty of our approach is that if someone wants to start a separate project for a Django-less authenticated API, there's nothing stopping them.
In fact, I played around with this a little over the weekend. I didn't want to change too much of the existing authorization system, only slightly enhance it to provide a simple way for non-browser clients to log into Postorius with existing user credentials. What I came up with is a simple view decorator that checks for an HTTP Basic Auth header if the current user isn't logged in and uses these credentials to start a new Django session. Clients that can handle session cookies can use that in all concurrent requests (which makes it a little faster). Clients that don't support cookies can just send the auth header again with the next call.
Does Django support OAuth? If so, I think that will be better in the long run than Basic AUTH, though I think both must be used over HTTPS for security reasons.
I had some very interesting discussions with one of the original OAuth authors at UDS-R, and while v1 has its issues, v2 seems to be even worse. Yet, it seems like the best option out there if users want to use applications without having to provide their login credentials directly.
Fortunately, there are several Python libraries that support at least OAuth v1, although the library I'm currently liking is liboauth, which supports both v1 (client) and the draft for v2. As I understand it, only Facebook's API requires v2; most services support v1 and it's not that hard to support on both the client and server.
Theres also an API resource that returns a json string with all mailing lists (very similar, but not identical to the one the core API returns).
If anyone's interested: I added a small proof of concept for a command line client to a private branch on launchpad. It's far from mature, just to see if the idea works... https://code.launchpad.net/~flo-fuchs/+junk/mmremote. (Please make sure to use the latest revision of Postorius).
Another thought: We will add some convenience AJAX functionality to the Postorius UI. For this alone it's worth having a number of JSON resources available. In other words: Postorius would be the first client to use its own API :-)
I *love* eating my own dogfood. :)
-Barry