Topic on Project:Support desk

Api access must be public

This code returns correct value in MW 1.30

{{#get_web_data: 
url=https://gunretort.xyz/api.php?format=json&action=parse&page=Portal:TagDescriptions&prop=sections
|format=JSON
|data=SecID=index
|filters=line=CivilRights
}}

{{#external_value:SecID}}

Now (on MW 1.31) returning: Error: no local variable "SecID" was set.

But exact same query works with a static json file containing same json as returned by API:

{{#get_web_data: 
url=https://gunretort.xyz/sections.json
|format=JSON
|data=SecID=index
|filters=line=CivilRights
}}

{{#external_value:SecID}}

The url alone returns correct json: https://gunretort.xyz/api.php?format=json&action=parse&page=Portal:TagDescriptions&prop=sections returns

{"parse":{"title":"Portal:TagDescriptions","pageid":433,"sections":[{"toclevel":1,"level":"2","line":"Terrorism","number":"1","index":"1","fromtitle":"Portal:TagDescriptions","byteoffset":0,"anchor":"Terrorism"},{"toclevel":1,"level":"2","line":"SecondAmendment","number":"2","index":"2","fromtitle":"Portal:TagDescriptions","byteoffset":747,"anchor":"SecondAmendment"},{"toclevel":1,"level":"2","line":"Timeliness","number":"3","index":"3","fromtitle":"Portal:TagDescriptions","byteoffset":1275,"anchor":"Timeliness"},{"toclevel":1,"level":"2","line":"Money","number":"4","index":"4","fromtitle":"Portal:TagDescriptions","byteoffset":2317,"anchor":"Money"},{"toclevel":1,"level":"2","line":"CivilRights","number":"5","index":"5","fromtitle":"Portal:TagDescriptions","byteoffset":3038,"anchor":"CivilRights"},{"toclevel":1,"level":"2","line":"CommonGround","number":"6","index":"6","fromtitle":"Portal:TagDescriptions","byteoffset":3800,"anchor":"CommonGround"}]}}

Something about the way the API returns data has changed.

Accessing that URL I get

{
  "error": {
    "code": "readapidenied",
    "info": "You need read permission to use this module."
  }
}

I doubt #get_web_data would log-in to the page. That's the content it probably gets, and the error is correct.

Further testing suggests the issue is related to

$wgGroupPermissions['*']['read'] = false;

and may be due to a new behavior of the API, which, according to Yaron Koren, is to require user to be logged-in for read-queries. This is happening for me when logged in as admin, so the API might be failing.

https://phabricator.wikimedia.org/T198577#4391293

However, I get json data from this API, in a browser, even if i'm not logged in:

https://gunretort.xyz/api.php?format=json&action=parse&page=Portal:TagDescriptions&prop=sections

Can you share the url that gave you that error?

After browser refresh, I get json data from both these urls, even if i'm not logged into the wiki:

https://gunretort.xyz/api.php?format=json&action=parse&page=Portal:TagDescriptions&prop=sections

https://gunretort.xyz/sections.json

You are logged in on the wiki, but the wiki is doing a HTTP request to the api without passing *your* cookies, so the request to the api is not with your user. If anonymous can't read the api, the wiki itself can't neither through this method.

ok, so i think my code needs to 'login' first, according to these steps, correct? https://www.mediawiki.org/wiki/API:Login

Yes, although I doubt get_web_data provide such functionality.

get_web_data doesn't provide any login functionality. I expect to do it in javascript.

unclear. You wrote 'api access should be anonymous', but you noted that i need to login. Confused-- if i need to login, then it's not anonymous.

Your api need to be publicly accessible without requiring login (which means anonymous access should work just fine)

but we need to block anonymous edits on our wiki.

And doc says bots must use authentication on wiki's which disable anonymous edits.

"On private wikis, logging in is required to use any API functionality."
API:Login#Whether to log in

you need to restrict the "edit" right to users not logged-in. But apparently you're also restricting the read right, which is what the get_web_data needs to read while not logged-in

Since MW doesn't have native ability to restrict groups to namespaces, my only option is to apply a global read-restriction.

Then, i create exceptions to that restriction with $wgWhitelistReadRegexp

Since the API falls into the restricted space, my bot will have to login to use the API.

Correct? Any reason the bot can't or shouldn't login? Any reason logging-in will fail for the bot?