The civicrm_tools from colorfield

civicrm_tools's People

Contributors

Watchers

civicrm_tools's Issues

Limit REST exposed data via configuration

Problem/motivation

The current implementation of the REST endpoint dedicated to users by group (/api/civicrm_tools/users/group/{group_id}) potentially exposes CiviCRM contacts as their Drupal user counterpart.
It must be reduced to what is necessary for a third party application.

There are two scopes

CiviCRM groups
User data

This is mitigated by the fact that

the CiviCRM contact must have a Drupal user account and must be part of a CiviCRM group to be exposed by the web service
the authenticated user that creates the request must have the 'view user information' permission.

Proposed resolution

A first naive approach is a per endpoint configuration to limit groups and fields.
A more sustainable approach could be a relation between entities (user, group, ...) and web service client(s).

User data that are exposed by default

                "uid": [{
			"value": "1"
		}],
		"uuid": [{
			"value": "xxx"
		}],
		"langcode": [{
			"value": "en"
		}],
		"preferred_langcode": [{
			"value": "en"
		}],
		"preferred_admin_langcode": [{
			"value": "en"
		}],
		"name": [{
			"value": "[email protected]"
		}],
		"mail": [{
			"value": "[email protected]"
		}],
		"timezone": [{
			"value": "Europe\/Brussels"
		}],
		"status": [{
			"value": "1"
		}],
		"created": [{
			"value": "1442908689"
		}],
		"changed": [{
			"value": "1527584362"
		}],
		"access": [{
			"value": "1528284678"
		}],
		"login": [{
			"value": "1528280397"
		}],
		"init": [{
			"value": "email address"
		}],
		"roles": [{
			"target_id": "administrator"
		}],
		"default_langcode": [{
			"value": "1"
		}],
		"metatag": [],
		"path": [{
			"pid": "1",
			"source": "\/user\/1",
			"alias": "\/user\/profile\/1",
			"langcode": "en"
		}],
		"content_translation_source": [{
			"value": "und"
		}],
		"content_translation_outdated": [{
			"value": "0"
		}],
		"content_translation_uid": [{
			"target_id": "0"
		}],
		"content_translation_status": [{
			"value": "1"
		}],
		"content_translation_created": [{
			"value": "1522826475"
		}],
		"user_picture": []

Recommend Projects