Some user attributes cannot be edited through API

CrazyMax

Hi Flarum team!

First off all thanks for this developer focused forum. I'm an old esoTalk user and it's nice to see the continuity with Flarum!

So I have an issue with your API endpoint api/users/<userid>. Creation works fine with this cURL command:

curl 'http://flarum:8000/api/users' \
  -X POST \
  -H 'Content-Type: application/json; charset=utf-8' \
  -H 'Authorization: Token MYTOKEN; userId=1' \
  -d '{"data":{"type":"users","attributes":{"username":"auser","email":"email@domain.com","password":"apassword"}}}'

Response:

{
    "data": {
        "type": "users",
        "id": "4",
        "attributes": {
            "username": "auser",
            "displayName": "auser",
            "avatarUrl": null,
            "joinTime": "2019-11-28T14:47:46+00:00",
            "discussionCount": 0,
            "commentCount": 0,
            "canEdit": true,
            "canDelete": true,
            "lastSeenAt": null,
            "isEmailConfirmed": true,
            "email": "email@domain.com",
            "markedAllAsReadAt": null,
            "unreadNotificationCount": 0,
            "newNotificationCount": 0,
            "preferences": {
                "notify_discussionRenamed_alert": true,
                "notify_postLiked_alert": true,
                "notify_discussionLocked_alert": true,
                "notify_postMentioned_alert": true,
                "notify_postMentioned_email": false,
                "notify_userMentioned_alert": true,
                "notify_userMentioned_email": false,
                "notify_newPost_alert": true,
                "notify_newPost_email": true,
                "notify_userSuspended_alert": true,
                "notify_userUnsuspended_alert": true,
                "notify_selectBestAnswer_alert": true,
                "followAfterReply": false,
                "discloseOnline": true,
                "indexProfile": true,
                "locale": null
            },
            "newFlagCount": 0,
            "suspendedUntil": null,
            "canSuspend": true
        }
    }
}

Now if I want to edit the avatarUrl attribute of this new user I use the following command:

curl 'http://flarum:8000/api/users/4' \
  -X PATCH \
  -H 'Content-Type: application/json; charset=utf-8' \
  -H 'Authorization: Token MYTOKEN; userId=1' \
  -d '{"data":{"attributes":{"avatarUrl":"https://example.com/avatars/default.png"}}}'

But looking at the response it's not working.

{
    "data": {
        "type": "users",
        "id": "4",
        "attributes": {
            "username": "auser",
            "displayName": "auser",
            "avatarUrl": null,
            "joinTime": "2019-11-28T14:47:46+00:00",
            "discussionCount": 0,
            "commentCount": 0,
            "canEdit": true,
            "canDelete": true,
            "lastSeenAt": null,
            "isEmailConfirmed": true,
            "email": "email@domain.com",
            "suspendedUntil": null,
            "canSuspend": true
        },
        "relationships": {
            "groups": {
                "data": []
            }
        }
    }
}

Are there any attributes that are limited through API?

Thanks!

clarkwinkelmann

That's correct. Using an avatar url instead of uploading a file is only possible by editing the database directly at the moment.

You can see the attributes that can be edited through the API here https://github.com/flarum/core/blob/d492579638fb52dafbfe65f1f36a95eb6047f7f3/src/User/Command/EditUserHandler.php

If you want to upload a file instead of providing an url, then you can use the /users/{id}/avatar endpoint, which is the same that's used when changing the avatar from the app.

If you wanted to add support to set the avatar url via the API, it's not a complicated thing to implement. You can simply listen to the Flarum\User\Event\Saving event and add your own saving code. Here's an example on how that could be implemented (albeit for a different attribute here) https://github.com/clarkwinkelmann/flarum-ext-status/blob/master/src/Extenders/SaveStatus.php

CrazyMax

clarkwinkelmann Thanks for the tips! I will take a look on this.