1

Is it possible to skip api key check at Relationships delete? We'd like to create one-click link for altering Contact, where users of certain Drupal Role should be able to click "Resign" link and all magic happens behind the scenes. Since there are a lot (really) users of acting role, playing with individual user api key(s), described here http://wiki.civicrm.org/confluence/display/CRMDOC/REST+interface#RESTinterface-CreatingAPIkeysforusers , doesn't sound like a good idea. So, are there something like "skip_key_check" for such a cases? Here's a piece of code currently being used:

CRM.api3('Contact', 'create', {
  "contact_type": "Individual",
  "id": key,
  "is_deceased": 1,
  "deceased_date":yestrDate,
      "custom_197": 0,
    // Relationships part - this is here  api key is being asked
    'api.Relationship.create': { 
       "id": value.rel_ID , 
       "contact_id_a" : value.cont_A, 
       "contact_id_b" : value.cont_B,   
       "relationship_type_id" : value.relationship_type_ID,  
       "end_date": yestrDate,
        "is_active": 0
        // Would be nice to have "skip_permissions_check": 1, here
     },
3

you seem to me mixing two related but different concepts:

  • the REST API, that's an interface to connect to Civi, mostly from external servers (eg another application). In principle, the api_keys and server key shouldn't be visible to the end user but stored in a configuration setting somewhere.
  • the ajax API, that's how a user interact with civicrm to avoid to reload the page completely. This one doesn't need the api_key, as it relies on the user authentication to know what is allowed

In both case, it's not possible to bypass the permissions from an external call directly, it would defy the purpose of having a permission system in the first place ;)

What I would suggest you to do is to write a simple civicrm extension that offers a "member.resign" API and a new "quiter" permission (name to be improved ;) and configure the api so it's only the quiters that can resign.

your api can then call the apis to remove the relationship or whatever else you want to do, and can have the skip_permissions parameter

Then you simply have to grant that permissions to the roles you want in drupal and call your new api CRM.api3('member','resign', {...}) and voila

As an aside, I'm not a lawyer and I don't want to speculate what you do with your contacts that resign, but marking them as deceased is likely to be considered illegal in most jurisdictions ;)

|improve this answer|||||
  • Especially since I do not know a lot of deceased people who can actively resign...... – ErikH - CiviCooP Jan 28 '16 at 15:38
  • well, the one that resign could have his life status changed between the time he clicks on the "resign" button and the time the ajax call hits the server... – Xavier Jan 28 '16 at 15:57
  • true enough, but almost as likely as us drinking warm beer? – ErikH - CiviCooP Jan 28 '16 at 17:13
  • It's about AJAX API than, since it's all supposed to be happened within same domain. And it requires higher permissions level than seems to be logical: now it tells, that ""API permission check failed for RelationshipType\/getlist call; insufficient permission: require administer CiviCRM", but I'm not sure "administer CiviCRM" should be granted to anyone. – yurg Jan 28 '16 at 21:06
  • It, so to say, "cured itself" so no additional extensions was needed. – yurg Jan 29 '16 at 18:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.