2

Background

I am working on a React app for event participation management using the CiviCRM ajax API. There is a little more to this that isn't relevant.

Each user has access to their own API key, but no CiviCRM or CMS account. I have used the civitest_civicrm_alterAPIPermissions hook to expose/restrict various entities. I have given each user the "access AJAX API" permission.

Issue

Before I go looking through the code, I had a question about an issue I am having:

Users with CMS accounts and the exact same permissions (i.e. no "access CiviCRM" and cannot log into CMS) can access the API fine, but those without get the error "ERROR: No CMS user associated with given api-key"

The error is pretty self explanatory, but I was curious if there was a way to work around it that is built into CiviCRM.

Setup

Joomla 3.8

CiviCRM 4.7.22

Improve this question
3
  • I doubt if you can skip the CMS user, because the permissions are assigned to the CMS user (in the case of Drupal). Maybe the description of bootstrapping CiviCRM, see docs.civicrm.org/dev/en/latest/framework/bootstrap is useful.
    – Kainuk - CiviCooP
    Commented Jan 3, 2018 at 7:37
  • I do agree with @Kainuk-CiviCooP point. But, If you want to access CiviCRM without a drupal user account - then don't try to access rest api directly - you may use plain PHP file in the extension and then try connecting to the rest api - ( I was about to test this but didn't get a chance to do so) - good luck
    – Ramesh - ARTECH Consultancy
    Commented Jan 3, 2018 at 10:11
  • Thanks for the help. I went through the Rest.php file and see what you mean. In Joomla, the anonymous (Public) users group is given their own permission set. The CMS user is unnecessary in this case. I will look into creating my own script. However, it may just be easier to create the contact a CMS user with no groups; this will give that contact the same permissions as an anonymous (Public) user.
    – David Hayes
    Commented Jan 3, 2018 at 17:18

1 Answer 1

Reset to default
0

I think you can bypass permission using permission_check hook.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.