You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Schema Analyzer calls don't have the refreshed token which causes 401 error #564
API Platform version(s) affected: api: 3.3, admin: 3.4.6
Description
When accessing a resource from the admin, several extra calls seem to be made on top of the main call fetching the data:
These calls seem to be initiated by the Guesser Components to fetch the schema:
These calls do include a JWT but this token is not refreshed if expired. The JWT in the "main" call is correctly updated.
How to reproduce
Clone Api Platform Demo repository
Remove components so that the Guesser components do their job
Possible Solution
n/a
Additional Context
Code is very close to the Demo:
// Admin.jsxconstapiDocumentationParser=(session)=>async()=>{try{returnawaitparseHydraDocumentationWithEnums(ENTRYPOINT,{headers: {Authorization: `Bearer ${session?.accessToken}`,},});}catch(result){// @ts-ignoreconst{ api, response, status }=result;if(status!==401||!response){throwresult;}return{
api,
response,
status,};}};constAdminUI=({ children, session })=>{constdataProvider=useRef();const{ docType }=useContext(DocContext);dataProvider.current=hydraDataProvider({entrypoint: ENTRYPOINT,httpClient: (url,options={})=>fetchHydra(url,{
...options,headers: {Authorization: `Bearer ${session?.accessToken}`,},}),apiDocumentationParser: apiDocumentationParser(session),});returndocType==="hydra" ? (<HydraAdminrequireAuthauthProvider={authProvider}// @ts-ignoredataProvider={dataProvider.current}entrypoint={window.origin}i18nProvider={i18nProvider}layout={MyLayout}>{!!children&&children}</HydraAdmin>) : (<OpenApiAdminrequireAuthauthProvider={authProvider}// @ts-ignoredataProvider={dataProvider.current}entrypoint={window.origin}docEntrypoint={`${window.origin}/docs.json`}i18nProvider={i18nProvider}layout={MyLayout}>{!!children&&children}</OpenApiAdmin>);};constAdminWithContext=({ session })=>{const[docType,setDocType]=useState(store.getItem("docType","hydra"),);return(<DocContext.Providervalue={{
docType,
setDocType,}}><AdminUIsession={session}>
// No Resources defined here unlike in the demo repo
</AdminUI></DocContext.Provider>);};
Calls are made every time we access the resource from the admin if no ApiFilter is defined in the API
If ApiFilter is defined in the API then calls are only made the first time we try to access the resource. If the resource is not accessed at least once before the initial token expires the problem remains
Issue seems to be coming from the api-doc-parser where the getParameters function is returned for each Resource with the token saved into it. Since parseHydraDocumentation is only called once when the page is loaded the JWT is never updated in the resource function call.
@dunglas would such a change to the getParameters callback be accepeted ? Adding a "in_options" argument to eventually override at runtime the headers that can be sent to fetch resource parameters.
Options (with Authentication headers) could then either be passed down from the FilterGuesser (and other Guessers) or (less likely I guess) fetched directly in the schemaAnalyzer (using local storage maybe ?).
Unless you see another solution to have the updated tokens passed down to the getParameter requests !
Activity
greggailly commentedon Jun 3, 2024
Issue seems to be coming from the api-doc-parser where the getParameters function is returned for each Resource with the token saved into it. Since parseHydraDocumentation is only called once when the page is loaded the JWT is never updated in the resource function call.
resource.getParameters = (): Promise<Parameter[]> => getParameters(resource, options);https://github.com/api-platform/api-doc-parser/blob/e8b49f2b452c4a19fab5eea86ec742c8201d381f/src/hydra/parseHydraDocumentation.ts#L475-L476
greggailly commentedon Jun 3, 2024
@dunglas would such a change to the getParameters callback be accepeted ? Adding a "in_options" argument to eventually override at runtime the headers that can be sent to fetch resource parameters.
If yes then to be discussed, the schemaAnalyzer could be modified to take a new argument with the options.
Options (with Authentication headers) could then either be passed down from the FilterGuesser (and other Guessers) or (less likely I guess) fetched directly in the schemaAnalyzer (using local storage maybe ?).
Unless you see another solution to have the updated tokens passed down to the getParameter requests !
papppeter commentedon Oct 2, 2024
Do you have a solution? it v4 is affected.
papppeter commentedon Oct 2, 2024
#578 helped me to solve my issue. i created a custom parser where i did set the proper headers for authentication. but any better idea is wellcome.