mastodon / mastodon/documentation
Authorization scope for API calls favourited_by and reblogged_by
Nobody has claimed this yet.
- Dominant language
- SCSS
- Stars
- 1.7k
- Forks
- 978
- PR merge metrics
- No merged PRs in 30d
Description
https://github.com/mastodon/documentation/blob/main/content/en/methods/statuses.md?plain=1#L944 says that the OAuth user token for /api/v1/statuses/:id/favourited_by needs scope read:statuses for private statuses. In contrast to this, the source code (https://github.com/mastodon/mastodon/blob/main/app/controllers/api/v1/statuses/favourited_by_accounts_controller.rb#L4) looks like scope read:accounts is required. (Also the actual behavior requires read:accounts.)
The same problem seems to exist for /api/v1/statuses/:id/reblogged_by.
Or does the API documentation correctly describe the intended behavior and there is a bug in the implementation?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Compare the scope statement near line 944 of content/en/methods/statuses.md with the linked favourited_by controller and the corresponding reblogged_by endpoint. Verify the behavior using tokens with the relevant scopes, then determine whether the documented scope or implementation is intended and update the affected documentation or report the implementation discrepancy.
Written by the indexing model from the issue text.
Assessment
- Domain
- api, authentication, documentation
- Issue type
- Documentation
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100