anonymous readonly api requests should not require an OAuth key

[Martin Pool]

It's now possible for an api client to "log in anonymously" to get at public readonly objects, which is great. It would be nice if we took the next step and just let API GET methods be sent without requiring an OAuth token at all.

To reproduce:
GET https://api.launchpad.net/bzr/+bug/98836/

What does happen:
> Request is missing an OAuth consumer key.

What should happen:
I get a json representation of that bug.

Why:
- This would make it a bit easier for people to write non-launchpadlib-based api clients, and to experiment with new approaches to client access.
- It would help with interactive examination of the API (by posting things into a browser)
- It would cut a few roundtrips off startup time
- It might make it easier to pull json into other apps or mashups
- It may reduce pressure to do screenscraping
- The restriction seems pointless

We may want to encourage clients to send a meaningful User-Agent header, and to make it easier for launchpadlib users to specify a string to add to that (if they don't already.) Then we can track or throttle usage.

Arguably clients should check robots.txt before reading many files.

I'm told there's a workaround of adding '/api/beta' to the user-oriented url but I can't get that to work.

[James Westby (james-w)]

https://api.launchpad.net/api/beta/bzr/+bug/98836/

[Martin Pool (mbp)]

Leonard started on this (yay!) https://code.edge.launchpad.net/~leonardr/launchpad/true-anonymous-access/+merge/30088

[Launchpad QA Bot (lpqabot)]

Fixed in stable r11153 <http://bazaar.launchpad.net/~launchpad-pqm/launchpad/stable/revision/11153>.

[Martin Pool (mbp)]

On 20 July 2010 09:33, Launchpad QA Bot <email address hidden> wrote:
> Fixed in stable r11153 <http://bazaar.launchpad.net/~launchpad-
> pqm/launchpad/stable/revision/11153>.
>
> ** Changed in: launchpad-foundations
>    Milestone: None => 10.08
>
> ** Tags added: qa-needstesting

This doesn't work on https://api.staging.launchpad.net/bzr/+bug/98836/
 yet, but staging's footer says it's still on r9549.

--
Martin

[Leonard Richardson (leonardr)]

Verified on edge, still not present on staging.

[Martin Pool (mbp)]

On 20 July 2010 14:27, Leonard Richardson
<email address hidden> wrote:
> Verified on edge, still not present on staging.

<https://api.edge.launchpad.net/bzr/+bug/98836/> is a bit strange
because it displays what looks like a Python object repr:

  Object: <canonical.launchpad.webapp.servers.WebServiceClientRequest
instance URL=https://api.edge.launchpad.net>, name: ''

I guess this should be a 404 or some other error? Probably this was
latent all the time?

<https://api.edge.launchpad.net/1.0/bugs/98836/> works well though
when you ask for json. Thanks.

I guess this needs as a followon some way to tell launchpadlib to
start working with no oauth?

--
Martin

[Gary Poster (gary)]

On Jul 20, 2010, at 8:54 AM, Martin Pool wrote:
...
> I guess this needs as a followon some way to tell launchpadlib to
> start working with no oauth?

Why is an anonymous oauth connection (https://help.launchpad.net/API/launchpadlib#Anonymous%20access) not sufficient/effectively equivalent?

[Martin Pool (mbp)]

On 20 July 2010 15:23, Gary Poster <email address hidden> wrote:
> On Jul 20, 2010, at 8:54 AM, Martin Pool wrote:
> ...
>> I guess this needs as a followon some way to tell launchpadlib to
>> start working with no oauth?
>
> Why is an anonymous oauth connection
> (https://help.launchpad.net/API/launchpadlib#Anonymous%20access) not
> sufficient/effectively equivalent?

I thought that it needed to do some extra roundtrips to generate the
anonymous token, but I was wrong. It just sends oauth_version="1.0",
oauth_token="", oauth_signature="%26". So never mind.

Thanks
--
Martin