Skip to content

Route can be protected using the login system or admin rights.

Login system

To protect a route using the login system you must specify: logged=True

@route('protected', logged=True)
def protected_route():
    user = api.get_logged_user()
    return user

User information can be accessed using get_logged_user method.

Admin

Admin could auto log to any user account on local mode

Condition

To be an admin a user must have at least one condition:

  • a role > 9
  • specify the magic password has admin API parameter
  • connect using an admin ip. The ips admin list must be defined in the api.json configuration files under the key=admins_ips

How to use

If you met one of the admin condition you do not need any password in order to log has any of the user in the database.

You could be logged for specific routes using the single route mode or to any route using the login/logout system.

Single route mode

  • You could specifiy either admin_user_id={user_id} or admin_user_name={username} directly into any request in order to login with this user for this specific route.

Exemple

/anyroute?admin_user_id=1000

Login to the api

Use the route /auth/su in order to set an admin session that is valid until the end of the api runtime.

  • You must specifiy either admin_user_id={user_id} or admin_user_name={username}

Exemple

/auth/su?admin_user_id=1000

Logout from the api

Use the route /logout/su in order to logout.