API support

[blacklight]

I have a large trove of health data points stored over the years on my database, and I'd like to move their cloud backup from Google Fit to NextCloud Health.

I have done a bit of digging in the codebase and found e.g. the WeightApi that exposes a REST interface for manipulating data.

I have indeed managed to retrieve the datapoints through:

http -a 'user:app-pwd' 'https://myhost/apps/health/weight/dataset/person/1'

However, I'm not able to update any data, even though the payload is formatted according to the same structure as the requests made by the UI. Example:

echo '{"date": "2021-12-09", "weight": 75}' | http -a 'user:app-pwd' 'https://myhost/apps/health/weight/dataset/person/1

This returns either an empty list (with no data being updated) or {"message":"CSRF check failed"}.

The only difference I see between the requests made by the UI and the ones I'm trying over API is that the UI obviously provides a bunch of session headers/cookies/CSRF tokens, while a non-interactive client of course can only provide the authentication data.

Is there actually any support for the API for non-interactive clients, or is it only supported when used within the web client?

I really see a lot of value in being able to import (and export) data from (/to) other sources and platform. If not over API, at least it should be possible over CSV. If NextCloud doesn't support either methods then it won't be very useful in integrating with existing datasets and health applications...

[RedPaes]

When you look at the source code there is an annotation to disable CSRF checks:
https://github.com/datenangebot/health/blob/49f0a68458057dd39989e45ee09516ef8ae4618d/lib/Controller/FeelingdataController.php#L45
CSRF is required for security on writing endpoints without additional CORS.
The nextcloud way is to use the "@cors" annotation which disable session based authentication as described here: https://docs.nextcloud.com/server/latest/developer_manual/digging_deeper/rest_apis.html and here https://help.nextcloud.com/t/why-nocsrfrequired-for-an-appss-rest-api/112210/3

@datenangebot : I'm willing to contribute to that. Would you accept PRs for this?
My first thought would be to adding CORS headers to existing controller and if needed make the UI compatible.
Another solution would be a dedicated api controller.

[datenangebot]

Hi,
PR are all fine.
But it will take time to react.
My primary job is to fight against log4j...

I have to check the cors annotations thing, I thought not to use or disable any security checks.

@blacklight Is it a possible way for you to put the data directly into the db from your NC?

[blacklight]

@datenangebot

Is it a possible way for you to put the data directly into the db from your NC?

That's eventually what I resorted to, but it took me a while to dig the structure of the oc_health_* tables and set up all the db connectors and permissions to push the data.

IMHO there are tons of apps out there to measure weight, sleep, activities etc., and many of them offer ways to programmatically export or sync new data. NC Health could be a great place for me to store all this data, instead of using dozens of interfaces or having to resort to Google Fit. But the lack of an API to automate data I/O is quite a drawback - yes, I can resort to direct db I/O, but that requires me to set up tunnels and permissions to programmatically access the db from the outside, or set up some queue/API service in between if I want to push data from multiple clients. Having an API for the Health app would really be a big push for me to move all the data that I currently have in many other apps.

[datenangebot]

Not in focus for me right now.
https://github.com/datenangebot/health/wiki

Feel free to send me a pull request...

[datenangebot]

still need some time, but will do a simple api...

[datenangebot]

Version 1.5 is out with api support. Can you test it?

[blacklight]

Thanks! So, just to confirm, do the public endpoints have the same structure as the previously existing ones? I have tried the following call and it works without CSRF errors:

$ curl "https://$NC_USER:$NC_PWD@cloud.myown.com/nextcloud/apps/health/weight/dataset/person/1"

[Nboutika]

Hello !, I have the same problem, all my GET works fine but every POST/DELETE/PUT keeps showing "message": "CSRF check failed", I've tried in different computer with different nextcloud (local / hosted) did you find a solution please ? Thanks

[GVLLIFESTYLE]

maybe thats an idea to solve the issues??
#139

[pktiuk]

Version 1.5 is out with api support. Can you test it?

Some docs for this API would be useful: https://github.com/nextcloud/health/wiki/API