Change Details

tl;dr: create a generic Bash script to test API endpoints, using Aaron Schulz's script as a starting point. Details: While many of our APIs have convenient sandboxes, not all do. And even for those that do, it is sometimes convenient during development and testing to hit the endpoint directly, so that the request can be fully customized. This is particularly helpful when generating malformed requests to exercise error behavior. For endpoints that allow anonymous access, this can be conveniently done in several ways (browser, curl, Postman, etc.). But for endpoints that require authentication, especially when confirming csrf token behavior, this is much less convenient. Obtaining the necessary tokens through the Action API endpoints requires several steps, and is daunting to people unfamiliar with the process. @aaron wrote a [[ https://gist.github.com/AaronSchulz/a859b366701beb7ea2419d7117f1cdff | great little Bash script ]] for invoking API endpoints from the command line. It performs all the token handling, requiring only that the user do a bit of copy/paste and enter their password, then invokes and Action API endpoint and a REST API endpoint. @BPirkle [[ https://gist.github.com/bpirkle/add6448c1a9dd6795cfb2ed09ef9139c | customized this ]] to call the under-development Reading Lists endpoints, and to echo the full curl commands. The idea is that you run the script once, then copy the curl commands and manually execute them. This allows convenient testing of the endpoints during development by using your command history. Here is [[ https://drive.google.com/file/d/1_jNW-qVZ4mPJVPxxPy4Y_FDlz_QZiucl/view?usp=sharing | a video of me demoing the script ]], just to make sure all of that is clear. While this is useful as-is, it is very specific to the current endpoints being developed. We should consider how to extend this script to make it more generic and generally useful. For example, we might allow it to read the list of endpoints to be executed from a separate file. And/or generate a Postman collection, allowing the commands to be executed from Postman rather than the command line for people who prefer that. (Here's [[ https://github.com/postmanlabs/OpenAPI-to-Postman | code that generates a Postman collection from a swagger spec ]]. While that's not what we want here, it might be possible to steal ideas from it.) Or whatever else we can think of. Steps to be completed for this task: [] execute [[ https://gist.github.com/bpirkle/add6448c1a9dd6795cfb2ed09ef9139c | the script ]] against [[ https://gerrit.wikimedia.org/r/c/mediawiki/extensions/ReadingLists/+/972399 | the development Reading Lists REST API endpoints ]]. [] consider ways to improve/extend the script and post those ideas as a comment to this task [] implement the most promising ideas [] share the resulting improvements. Your personal Github is fine to start with.

tl;dr: create a generic Bash script to test API endpoints, using Aaron Schulz's script as a starting point. Details: While many of our APIs have convenient sandboxes, not all do. And even for those that do, it is sometimes convenient during development and testing to hit the endpoint directly, so that the request can be fully customized. This is particularly helpful when generating malformed requests to exercise error behavior. For endpoints that allow anonymous access, this can be conveniently done in several ways (browser, curl, Postman, etc.). But for endpoints that require authentication, especially when confirming csrf token behavior, this is much less convenient. Obtaining the necessary tokens through the Action API endpoints requires several steps, and is daunting to people unfamiliar with the process. @aaron wrote a [[ https://gist.github.com/AaronSchulz/a859b366701beb7ea2419d7117f1cdff | great little Bash script ]] for invoking API endpoints from the command line. It performs all the token handling, requiring only that the user do a bit of copy/paste and enter their password, then invokes and Action API endpoint and a REST API endpoint. @BPirkle [[ https://gist.github.com/bpirkle/add6448c1a9dd6795cfb2ed09ef9139c | customized this ]] to call the under-development Reading Lists endpoints, and to echo the full curl commands. The idea is that you run the script once, then copy the curl commands and manually execute them. This allows convenient testing of the endpoints during development by using your command history. Here is [[ https://drive.google.com/file/d/1_jNW-qVZ4mPJVPxxPy4Y_FDlz_QZiucl/view?usp=sharing | a video of me demoing the script ]], just to make sure all of that is clear. While this is useful as-is, it is very specific to the current endpoints being developed. We should consider how to extend this script to make it more generic and generally useful. For example, we might allow it to read the list of endpoints to be executed from a separate file. And/or generate a Postman collection, allowing the commands to be executed from Postman rather than the command line for people who prefer that. (Here's [[ https://github.com/postmanlabs/OpenAPI-to-Postman | code that generates a Postman collection from a swagger spec ]]. While that's not what we want here, it might be possible to steal ideas from it.) Or whatever else we can think of. Steps to be completed for this task: [] execute [[ https://gist.github.com/bpirkle/add6448c1a9dd6795cfb2ed09ef9139c | the script ]] against [[ https://gerrit.wikimedia.org/r/c/mediawiki/extensions/ReadingLists/+/972399 | the development Reading Lists REST API endpoints ]]. [] consider ways to improve/extend the script and post those ideas as a comment to this task [] implement the most promising ideas [] share the resulting improvements. Your personal Github is fine to start with. Edit: this need not remain a Bash script. It could be converted to another language (such as a standalone PHP script) if that seems better.

tl;dr: create a generic Bash script to test API endpoints, using Aaron Schulz's script as a starting point. Details: While many of our APIs have convenient sandboxes, not all do. And even for those that do, it is sometimes convenient during development and testing to hit the endpoint directly, so that the request can be fully customized. This is particularly helpful when generating malformed requests to exercise error behavior. For endpoints that allow anonymous access, this can be conveniently done in several ways (browser, curl, Postman, etc.). But for endpoints that require authentication, especially when confirming csrf token behavior, this is much less convenient. Obtaining the necessary tokens through the Action API endpoints requires several steps, and is daunting to people unfamiliar with the process. @aaron wrote a [[ https://gist.github.com/AaronSchulz/a859b366701beb7ea2419d7117f1cdff | great little Bash script ]] for invoking API endpoints from the command line. It performs all the token handling, requiring only that the user do a bit of copy/paste and enter their password, then invokes and Action API endpoint and a REST API endpoint. @BPirkle [[ https://gist.github.com/bpirkle/add6448c1a9dd6795cfb2ed09ef9139c | customized this ]] to call the under-development Reading Lists endpoints, and to echo the full curl commands. The idea is that you run the script once, then copy the curl commands and manually execute them. This allows convenient testing of the endpoints during development by using your command history. Here is [[ https://drive.google.com/file/d/1_jNW-qVZ4mPJVPxxPy4Y_FDlz_QZiucl/view?usp=sharing | a video of me demoing the script ]], just to make sure all of that is clear. While this is useful as-is, it is very specific to the current endpoints being developed. We should consider how to extend this script to make it more generic and generally useful. For example, we might allow it to read the list of endpoints to be executed from a separate file. And/or generate a Postman collection, allowing the commands to be executed from Postman rather than the command line for people who prefer that. (Here's [[ https://github.com/postmanlabs/OpenAPI-to-Postman | code that generates a Postman collection from a swagger spec ]]. While that's not what we want here, it might be possible to steal ideas from it.) Or whatever else we can think of. Steps to be completed for this task: [] execute [[ https://gist.github.com/bpirkle/add6448c1a9dd6795cfb2ed09ef9139c | the script ]] against [[ https://gerrit.wikimedia.org/r/c/mediawiki/extensions/ReadingLists/+/972399 | the development Reading Lists REST API endpoints ]]. [] consider ways to improve/extend the script and post those ideas as a comment to this task [] implement the most promising ideas [] share the resulting improvements. Your personal Github is fine to start with. Edit: this need not remain a Bash script. It could be converted to another language (such as a standalone PHP script) if that seems better.