Remove authentication for public endpoints

[sebgie]

This belongs to the OAuth Epic: #4004 - please read this for the big picture of what this issue is for :)

---

Requires: #4179 and #4180

The authorization method needs to be changed to allow access to the following API endpoints without requiring authentication:

• GET /ghost/api/v0.1/posts/ (status == published)
• GET /ghost/api/v0.1/posts/<id> (status == published)
• GET /ghost/api/v0.1/posts/slug/<slug> (status == published)
• GET /ghost/api/v0.1/tags/
• GET /ghost/api/v0.1/settings/ (type == blog)
• GET /ghost/api/v0.1/settings/<key> (type == blog)
• GET /ghost/api/v0.1/users/<id>
• GET /ghost/api/v0.1/users/slug/<slug>
• GET /ghost/api/v0.1/users/email/<email>

While implementing this issue it would be good to investigate if it is possible to do the authentication only if a bearer token is available in the request body and let canThis() deny access if authentication is required.

Attention: Third party access to public endpoints should not be allowed before all permissions are in place (#3911).

[recursivefunk]

Very interested in getting this going any help needed here?

[julianlam]

Latest blog comments plugin for NodeBB seems to rely on these routes to be publically accessible, so that particular plugin is no longer compatible with v0.5

👍 for this issue.

[fuzzmz]

👍 from me as well. There are workaround to making the routes publically
accessible, but it's not a clean solution.

-- Serban Constantin

On Wed, Oct 8, 2014 at 12:52 AM, Julian Lam notifications@github.com
wrote:

Latest blog comments plugin for NodeBB
http://psychobunny/nodebb-plugin-blog-comments seems to rely on these
routes to be publically accessible, so that particular plugin is no longer
compatible with v0.5

[image: 👍] for this issue.

—
Reply to this email directly or view it on GitHub
#4181 (comment).

[ErisDS]

There's a big chain of dependencies here starting with #3910 but we'd absolutely love someone to get stuck in and give us a hand.

[recursivefunk]

Cool. I have a first pass as what I think might be a good solution I'll solicit feed back in the coming week hopefully.

[novaugust]

@jrayaustin Feel free to put up a PR with [WIP] prefixing the title if you to claim this even while you're working things out =)

[recursivefunk]

Will do! @novaugust

[recursivefunk]

You guys can monitor the progress for this #4251