Unable to publish message on behalf of another user

Hi jeffshurtliff,

For security reasons, I would advise against trying to take the username and password as part of this endpoint. Any endpoint can be passed a REST V1 Session key (just add a request parameter named restapi.session_key=<thesessionkey>), so it's ideal to have the caller call /authentication/sessions/login endpoint and then pass the REST V1 Session key that gets returned with any endpoint that needs authentication.

So you'd first want to make a call like the following to the /authentication/sessions/login endpoint to get a REST V1 Session Key:

curl --location --request POST 'https://community.some.com/restapi/vc/authentication/sessions/login?restapi.response_format=json' \
--form 'user.login="yourlogin"' \
--form 'user.password="yourpassword"'

That should return a response like this:

{
  "response": {
    "status": "success",
    "value": {
      "type": "string",
      "$": "XYSopedCuqLQT179LjNxyFgTSne5vdLUb1MMgxmcSGQ."
    }
  }
}

Then you would call your endpoint, passing the session key returned from the /authentication/sessions/login call to the endpoint:

curl --location --request POST 'https://community.some.com/plugins/custom/yourcustomername/yourcommuntiyname/messagepostingendpoint' \
--header 'Content-Type: application/json' \
--header 'Li-Api-Session-Key: XYSopedCuqLQT179LjNxyFgTSne5vdLUb1MMgxmcSGQ.'

Also, I would advise against adding the .admin(true) option at all, as this could give an attacker a way to flood your community with message posts.

I think you also have some spaces in between your builder method calls that might be causing an issue as well.

I would recommend using a function like this to do the message posts:

<#-------------------- Function: publishNewMessage -------------------->
<#-- This function publishes a new message and returns the API response -->
<#function publishNewMessage payload>
  <#if user.anonymous>
    <#return {
        "status" : "error",
        "message" : "You are not authorized to make this request",
        "data": {
          "type": "error_data",
          "code": 224,
          "developer_message": "",
          "more_info": ""
        }
      } />
  <#else>
    <#local messagePostCall = restBuilder()
      .method("POST")
      .path("/messages")
      .body(payload)
      .admin(false) />
    <#local response = messagePostCall.call() />
    <#return response />
  </#if>
</#function>

Here is a usage example, which includes a macro for rendering out an error response (assuming your endpoint is using application/json for its content type):

<#-------------------- Macro: errorResponse -------------------->
<#-- This macro returns a REST V2 style JSON response for errors -->
<#macro errorResponse error>
  {
    "status": "error",
    "message": "${error.message}",
    "data": {
      "type": "error_data",
      "code": ${error.data.code},
      "developer_message": "${error.data.developer_message}",
      "more_info": "${error.data.more_info}"
    }
  }
</#macro>

<#assign payload = {
  "data": {
    "type": "message",
    "board": {
      "id": "Otis"
    },
    "subject": "This is a product advisory",
    "body": "This is the body of the message"
  }
} />
<#assign response = publishNewMessage(payload) />
<#if response.status == "error">
  <@errorResponse error=response />
<#else>
  ${apiv2.toJson(response)}
</#if>

I hope that helps!

-Doug

Hi DougS,

Thank you for the detailed response in this thread, and particularly around your suggestions regarding error reporting macros, which is super useful.

Unfortunately I think you may have misinterpreted the primary ask and a few details in my original post:

• What I'm ultimately trying to do is "ghostwrite" a message for another author.  For example, allowing the admin user JohnDoe to publish a TKB article that shows the author as JaneDoe rather than himself.  (To be even more specific, we want to publish release notes and other content under a generic "ProductTeam" user account rather than our product management team having to publish content under their own names.)
• I am not having credentials passed at all via custom endpoint, and instead the getSessionKey function referenced above is a private function called within the endpoint just to generate a valid session key to use in the "ghostwritten" message creation.
• The functions above are not the entire custom endpoint but are just small fragments of it.  The full endpoint can only be executed by an authenticated user belonging to specific roles, leverages CSRF tokens, etc. to prevent unauthorized API calls, and as mentioned does not request any credentials or other sensitive data over the wire.
• The primary issue with which I need help is that whenever I use the rest, restadmin or restBuilder directives and supply a valid session key in the header or as a query parameter, the provided session key is always trumped by my own and the messages are still always show me (or whoever calls the endpoint) as the message author rather than the account associated with the supplied session key.
  • Is there a way to force the directives above to select one session key over another, or is there perhaps a different directive/method to leverage instead to publish the post within the endpoint?
  • Is there maybe a different way that the author can be specified by the Community APIs when creating a new message?  For example, if I pass "author": {"type": "user", "id": "12345"} in the payload when creating the message will that specify the author or will it be ignored?

I hope this helps to clarify things.

Thanks again!