🐛: Can't authorize /api/principal

[jorgecarleitao]

What happened?

GET /api/principal using an API key results in 401 and 403, even though the token has the necessary permissions (role tenant-admin, which includes permission principal-list).

This happens in 0.13.2.

How can we reproduce the problem?

[package]
name = "minimal"
version = "0.1.0"
edition = "2024"

[dependencies]
reqwest = { version = "0.11", features = ["json", "rustls-tls"] }
tokio = { version = "1", features = ["rt-multi-thread", "macros"] }
serde_json = "1.0"

use reqwest::Client;
use reqwest::header;
use serde_json::Value;
use serde_json::json;

pub async fn token(
    client: &Client,
    base_url: &str,
    token: &str,
) -> Result<String, Box<dyn std::error::Error>> {
    let body = json!({
        "type": "code",
        "client_id": "webadmin",
        "redirect_uri": "stalwart://auth",
        "nonce": token,
    });

    let response = client
        .post(format!("{base_url}api/oauth"))
        .bearer_auth(token)
        .header(header::CONTENT_TYPE, "application/json")
        .header(header::ACCEPT, "application/json")
        .json(&body)
        .send()
        .await?;

    let status = response.status();
    if status.is_client_error() || status.is_server_error() {
        return Err(format!("Error fetching Stalwart token: {}", status).into());
    }
    let body = response.json::<Value>().await?;
    Ok(body["data"].as_object().unwrap()["code"]
        .as_str()
        .unwrap()
        .to_string())
}

pub async fn principals(
    client: &Client,
    base_url: &str,
    token: &str,
) -> Result<Value, Box<dyn std::error::Error>> {
    let response = client
        .get(format!("{base_url}api/principal"))
        .bearer_auth(token)
        .header(header::ACCEPT, "application/json")
        .send()
        .await?;

    let status = response.status();
    if status.is_client_error() || status.is_server_error() {
        return Err(format!("Error fetching Stalwart principals: {}", status).into());
    }

    Ok(response.json().await?)
}

#[tokio::main]
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    let client = Client::new();

    let base_url = std::env::var("STALWART_URL").expect("STALWART_URL must be set");
    let token = std::env::var("STALWART_TOKEN").expect("STALWART_TOKEN must be set");

    let token = stalwart::token(&client, &base_url, &token).await?;
    let right = stalwart::principals(&client, &base_url, &token).await?;
    println!("Body: {:#?}", right);

    Ok(())
}

results in Error: "Error fetching Stalwart principals: 401 Unauthorized".
Commenting out the fetch token line results in Error: "Error fetching Stalwart principals: 403 Forbidden".

Version

v0.13.x

What database are you using?

RocksDB

What blob storage are you using?

RocksDB

Where is your directory located?

OIDC

What operating system are you using?

Linux

Relevant log output

Code of Conduct

• I agree to follow this project's Code of Conduct

[mdecimus]

Please try using the API key as a bearer token, OAuth might not work when using an external OIDC server.
Also check the logs for any permissions errors.

[mauriciogior]

I had the same issue, I added an API Key without any roles, but permissions to access all principal endpoints, and it gives me 403. When I add the admin role, it works.

[jorgecarleitao]

I tried both:

Commenting out the fetch token line results in Error: "Error fetching Stalwart principals: 403 Forbidden".

which is what you are asking to try.

[stratacast]

Same issue for me here too. I have tried setting all principal and domain permissions and use the API key as a bearer token and I am getting 403s on 0.15.5

[mdecimus]

Please try again with v0.16 (once released), the REST API is being replaced by a JMAP API.