Control if Authentication is Used

Marking this as postponed as we focus on the vertical slice POC.

Do we need option disable authentication for methods like Patch, Post, Delete? By default Drupal will require some authentication for these methods. Can you help understand what is expected out of this issue.

@pratik_kamble good question. I can't imagine many cases where it would be a good idea to do this, but it is possible in the admin UI to do things like grant anonymous users permission to delete articles. In that case, would it be possible to use the DELETE method anonymously with JSON:API? If so, I think we should provide an option to disable authentication for all JavaScript methods regardless of http method used. If it is literally impossible to configure Drupal to allow JSON:API CRUD operations anonymously, then it seems like it would make sense to limit this to GET.

Does that help clarify?

This will conflict a bit with the changes in https://www.drupal.org/project/api_client/issues/3418939 → Might be easier to merge that one first if that works out. The types there are an improvement.

Setting to needs work to integrate changes recently merged to canary.

Let's hold off on merging this one for now. Being able to stage a few releases will make it easier to test our publishing workflow.

Merging now that we have automation in place.

Automatically closed - issue fixed for 2 weeks with no activity.