PHP API create call without logged in user?

[thgie]

I am working on a module with a very specific use case: The creation of items from an anonymous user. The following call throws a 403, of course.

$reaction = $this->api()->create('items', $data, $this->params()->fromFiles(), $auth)->getContent();

I was wondering if there is a way around this? One of my attempts to circumvent the problem is to create a user, aptly named “Anonymous”, who’s API credentials I could use. But I somehow can’t attach them to the API call’s $data object.

I will try the guest module. But the requirements are, to have as little interaction necessary to create the new item.

Any tipps?

[jflatnes]

Sometimes we’ve done this kind of thing by altering the ACL around the call, so anonymous users are allowed to create just for that call. This is how Collecting works, which does something similar. The ACL is accessible as the service Omeka\Acl, and in the simplest case you could, for example, just call $acl->allow() to allow everything (and then removeAllow() to revert to the normal rules afterwards).

Otherwise, to act as a particular user, you’d have to set them as the current user through the AuthenticationService. There’s no support for just acting as another user by passing a parameter to the API.

[thgie]

Hey @jflatnes, thank you very much for your feedback! I’ll keep that in mind.

My current solution is to add an ”anonymous” user and use it’s auth credentials to curl post to the rest API from within the controller. It’s a super ugly hack but working good enough for the prototype we’re whipping up here