Get the currently logged in user

[brecht-vermeersch]

How can I get the currently logged in user (piece)?

[abea]

Are you looking for all users currently logged in? There could be many. Regardless, I don't think there's a REST API for that as it's not a property on the user document.

[brecht-vermeersch]

I probably worded my question poorly. When i am using the api as a logged in user, i would like to get all information about that user (the apostrophe-user piece). Thanks in advance!

[brecht-vermeersch]

In a view on the website i can get that information from data.user

[boutell]

Hmm. For security reasons we don't currently give users any default read access to the user piece type at all. I can see how an option to grant some access to some safe properties of "yourself" would make sense and the door could also get propped open to profile editing and so on, but we haven't done that so far.

…

On Tue, Nov 24, 2020 at 10:21 AM Brecht Vermeersch ***@***.***> wrote: In a view on the website i can get that information from data.user — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#61 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAAH27PKPICNHE4UQX2XSLDSRPFN5ANCNFSM4UA4BKOQ> .

-- THOMAS BOUTELL | CHIEF TECHNOLOGY OFFICER APOSTROPHECMS | apostrophecms.com | he/him/his

[boutell]

(Of course if the user is an admin they can get everything they want about users, but this is probably not your use case.)

…

On Tue, Nov 24, 2020 at 11:00 AM Tom Boutell ***@***.***> wrote: Hmm. For security reasons we don't currently give users any default read access to the user piece type at all. I can see how an option to grant some access to some safe properties of "yourself" would make sense and the door could also get propped open to profile editing and so on, but we haven't done that so far. On Tue, Nov 24, 2020 at 10:21 AM Brecht Vermeersch < ***@***.***> wrote: > In a view on the website i can get that information from data.user > > — > You are receiving this because you are subscribed to this thread. > Reply to this email directly, view it on GitHub > <#61 (comment)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/AAAH27PKPICNHE4UQX2XSLDSRPFN5ANCNFSM4UA4BKOQ> > . > -- THOMAS BOUTELL | CHIEF TECHNOLOGY OFFICER APOSTROPHECMS | apostrophecms.com | he/him/his

-- THOMAS BOUTELL | CHIEF TECHNOLOGY OFFICER APOSTROPHECMS | apostrophecms.com | he/him/his

[boutell]

Seeing this ticket has been closed, I do think it's a mistake not to implement it. Headless developers should enjoy parity with what Nunjucks and Astro-based projects have access to. So I'm bringing it back to life.

Since this ticket was written we have added the /api/v1/@apostrophecms/settings API, which can be used to load and store the properties of their user piece that the user is allowed to directly change. But, this API does not return username and email unless configured to allow the user to change them, which I definitely wouldn't recommend without additional design work because of the security risks.

So, I think we should add a separate API to fetch the same information that is always available in the "body data" if Apostrophe is fully rendering the page with Nunjucks:

          aposBodyData.user = {
            title: req.user.title,
            _id: req.user._id,
            username: req.user.username
          };

I think we'd probably implement this one as:

/api/v1/@apostrophecms/user/_me

But I'll discuss with the team.

[boutell]

I think adding the email address to the list also makes sense, and it should be configurable from there.

[boutell]

(Nothing is stopping any developer from writing an apiRoute at project level for this of course, but I agree you shouldn't have to.)

[boutell]

An update: I see this is on the old A2 headless module, where it definitely won't be built. But I'll open a new ticket for current Apostrophe.

[boutell]

See new ticket: apostrophecms/apostrophe#4810