- Issue created by @clearly local
- Merge request !13Query `whoAmI` endpoint instead of `users` endpoint to check connection (#3509327) → (Open) created by Unnamed author
In order to test the connection, which is required before the plugin can be used, the `checkMemsourceConnection` method is called, which queries the `api2/v1/users` endpoint. It seems there have recently been changes to the Phrase TMS API that result in this endpoint returning 403 errors if the current user lacks the "View users created by other users" permission (previously, a 200 response was returned, with a filtered list containing only users that the current user had permission to view).
As an LSP, adding the "View users created by other users" permission to our customer's account isn't a satisfactory solution, as it allows them to view potentially sensitive data (e.g. email addresses) of our other customers.
1. In Phrase, create a user with `PROJECT_MANAGER` role but lacking the fine-grained "View users created by other users" permission.
2. In TMGMT, attempt to set up a `phrase` provider that connects via that user.
3. Upon attempting to connect, observe the error message: "Please check your login credentials and try to connect again."
One or both of the following:
1. Call `/api2/v1/auth/whoAmI` endpoint instead, which requires no special permissions.
2. Revert the Phrase TMS API change to returning a 200 with a filtered (possibly empty) list of users if "View users created by other users" permission is lacking.
Active
1.0
Code