Personal API Tokens

Improvements

• Introduce security filter config to allow tokens as child type of jnt:user

Improvements

• Introduced a mechanism allowing modules to whitelist URLs with the urlPatterns property

Misc

• Improved documentation on personal-api-tokens for verifyToken, cli example, token Management and others
• Updated webpack from 5.40.0 to 5.103.0

• Introduced a new permission admin-personal-api-tokens to make it possible for an admin to manage a user's personal API token.

• Extended graphql-annotation range following upgrade of GraphQL libraries in Jahia core

Note: This change was necessary for the module to be compatible with both Jahia 8.1 and Jahia 8.2 going forward. This particular release does not provide any improvements or bug fixes for environments running with Jahia 8.1x.

• Extended graphql-annotations compability range
• Upgraded Jahia configuration plugin version
• Removed the duplicated "resolutions" entry in package.json

• Updated jahia-depends property to have more accurate dependencies

• Added a new permission "Personal api tokens" (under "Developer tools") to restrict access to "My API tokens"
• Added French and German translations
• Upgraded packages to fix javascript vulnerabilities
• Added noImportExport mixin to prevent export of the tokens

• Added a new permission "Personal api tokens" (under "Developer tools") to restrict access to "My API tokens"

• Included personal-api-tokens module in the jahia build
• Added the possibility to add scopes when creating a token
• Updated code after GraphQL libraries upgrade (see GraphQL v2.7.0)
• Updated dependencies after moving Security filter module into a Core bundle
• Fixed issue with previous scope still selected when creating a new token
• Fixed css issue when personal-api-token is deployed

• Added the possibility to register new servlets using api tokens

This version of Personal API Tokens includes the following features:

• My API tokens view to allow a user to create and manage his/her own tokens
• User API Tokens view to allow an administrator to update/delete other users' tokens
• Management of tokens through the API (create own/update/delete)
• Management of tokens through the filesystem (create/update/delete)

This version of Personal API Tokens only provides the token service (no GraphQL API, no GUI and valve are not configurable as there's no OSGi support for valves in Jahia 7).

Here are examples on how to use it. Note that to be able to run it in the groovy console you'll need to remove the line setResult("remove");. You can also add the script in a .groovy file and drop it in /digital-factory-data/patches

Create a token

setResult("remove");
org.jahia.services.content.JCRTemplate.getInstance().doExecuteWithSystemSession({ session ->
    org.jahia.osgi.BundleUtils.getOsgiService("org.jahia.modules.apitokens.TokenService", null)
        .tokenBuilder("/users/root", "test-token123456", session)
        .setToken("WtkC/5HJS6WYY0y2E3nFGAmmLoOxKhRPy2IY4GkWVvA=")
        .setActive(true)
        .setExpirationDate(new org.joda.time.DateTime('2021-12-31').toCalendar(Locale.getDefault()))
        .create()
    session.save(); })

Update a token

setResult("remove");
org.jahia.services.content.JCRTemplate.getInstance().doExecuteWithSystemSession({ session ->
    def service = org.jahia.osgi.BundleUtils.getOsgiService("org.jahia.modules.apitokens.TokenService", null)
    def tokenDetails = service.getTokenDetails("9201cd9b-4e62-415e-b523-e198dd7e4756", session)
    tokenDetails.setActive(false)
    service.updateToken(tokenDetails, session)
    session.save();
})

Remove a token

setResult("remove");
org.jahia.services.content.JCRTemplate.getInstance().doExecuteWithSystemSession({ session ->    org.jahia.osgi.BundleUtils.getOsgiService("org.jahia.modules.apitokens.TokenService", null).deleteToken("9201cd9b-4e62-415e-b523-e198dd7e4756", session)
    session.save();
})