Pub API support?

[davidmartos96]

Hello!
Is it possible to access the pub API, like <host>/api/packages/<package>?
The private pub platform I'm coming from Jetbrains Spaces, allowed this functionality by using the token as a Bearer token.

I belive this feature could be interesting because it would be useful for tools like renovatebot, which automatically pull package dependencies

[bsutton]

Yes. The onepub API conforms to the standard pub.dev API. know if you have any other questions You can access the token by running 'onepub export'. Let me know if you have any questions.

…

On Thu, 19 Dec 2024, 9:26 pm David Martos, ***@***.***> wrote: Hello! Is it possible to access the pub API, like <host>/api/packages/<package>? The private pub platform I'm coming from Jetbrains Spaces, allowed this functionality by using the token as a Bearer token. I belive this feature could be interesting because it would be useful for tools like renovatebot, which automatically pull package dependencies — Reply to this email directly, view it on GitHub <#547>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAG32OGERUET47KQWYQK2BL2GKNNHAVCNFSM6AAAAABT4VBSUSVHI2DSMVQWIX3LMV43ERDJONRXK43TNFXW4OZXG4YTGOJSGE> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[davidmartos96]

I tried, but I'm getting a 403 response. (Trying via Insomnia)

https://onepub.dev/api/<onepubid>/api/packages/<package> and Bearer <token>

[davidmartos96]

@bsutton Hello! Am I using the wrong URL for the pub API? Or is this a missing feature in the server?

[bsutton]

Here is a curl command that I tested (and works):

curl -H "Authorization: Bearer XXXXXXX" https://onepub.dev/api/yyyyyy/api/packages/node_mgmt_lib

The 403 suggest that your token is invalid?

The token is obtained from running:

onepub export
OnePub version: 5.0.0

Exporting OnePub token for OnePub.

Add the following environment variable to your CI/CD secrets.

ONEPUB_TOKEN=XXXXX

Note that the token may have a trailing '=' which MUST be included in the bearer token.

[bsutton]

I've edited the above comment a few times to add info.

[davidmartos96]

@bsutton Thank you for the details. Unfortunately I'm still having issues. I've obtained the token with onepub export, but curl with the header fails. It returns a 403, but it doesn't seem to be related to an invalid token. It returns the following html:

[davidmartos96]

pub get with private dependencies is working fine, it's just the API access that I'm unable to access

[bsutton]

So that is a cloudflare error, you need to provide the cloudflare ray id for me to see why it is blocking you.

[davidmartos96]

Sure, that would be 8f470cbdf88ceca2

[davidmartos96]

If you need the onepub ID I can also provide it if you tell me to which email I can send it.

[bsutton]

are you in spain?

[davidmartos96]

Yes

[bsutton]

so cloudflare thinks you are a bot and is rejecting the request.

[davidmartos96]

My only guess is that it was flagged because I first tested the API call with Insomnia. But still, it's odd.
Can it be marked as false positive?

[bsutton]

I don't think marking it as a false positive will be viable as cloudflare gives us limited tools and in a ci/cd environment you ip address will change continuously.

[davidmartos96]

If possible, it might make sense to not restrict too much the <pub_host>/api route, as it might be legitimately used by tools that could be flagged as bots. Like renovatebot, for instance

[bsutton]

can you give me some more details on what you are trying to achieve?

[davidmartos96]

@bsutton I'm configuring renovatebot for the repos in our organization, which uses some private packages published in onepub.
The tool automatically creates merge requests with up to date dependencies. For that, it uses the pub API to fetch new versions of the packages, fetch changelogs...

[bsutton]

can you set a user agent?
onepub uses 'onepub 2.15.0'

[bsutton]

I've just added an exception for the onepub user agent as above. Try that and let me know how it goes.

[bsutton]

just added RenovateBot/* as well.

[davidmartos96]

@bsutton That's working now. Thank you!