Skip to content

Fix broken API routes and add CSRF bypass for ExApp REST calls - #132

Closed
marcelklehr with Copilot wants to merge 20 commits into
mainfrom
copilot/test-new-tools-in-pr-127
Closed

Fix broken API routes and add CSRF bypass for ExApp REST calls#132
marcelklehr with Copilot wants to merge 20 commits into
mainfrom
copilot/test-new-tools-in-pr-127

Conversation

CopilotAI commented Mar 17, 2026•
edited by marcelklehr
Loading

Copy link
Copy Markdown
  • bookmarks: Auth doesn't work, likely due to how the app handles auth
  • tasks: Works
  • circles: Works, although deleting members and circles doesn't seem to work for me on stable33
  • cookbook: Mostly works. Updating recipes doesn't work, though
  • deck
  • files
  • forms
  • mail: broken, list_mail_folders uses a nonexistent route and everything else depends on that
  • music
  • news
  • notes
  • passwords
  • polls
  • sharing

marcelklehrand others added 17 commits March 11, 2026 12:09
@marcelklehr
feat: Implement bookmarks app tools
c24bdde
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
@marcelklehr
feat: Implement tools related to tasks
e5b6480
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
@marcelklehr
feat: Implement tools related to circles
891b330
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
@marcelklehr
feat: Implement tools for the cookbook app
9c49ec8
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
@marcelklehr
feat: Implement more tools for deck
3303b52
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
@marcelklehr
feat: Implement more tools for files
293514b
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
@marcelklehr
feat: Implement tools for the forms app
7bc16c9
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
@marcelklehr
feat: Implement more tools for the mail app
a275b9a
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
@marcelklehr
feat: Implement tools for the music app
e2657ec
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
@marcelklehr
feat: Implement tools for the news app
c1678cd
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
@marcelklehr
feat: Implement tools for the notes app
e3c6509
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
@marcelklehr
feat: Implement tools for the passwords app
0e9de90
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
@marcelklehr
feat: Implement tools for photo albums
ab24c37
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
@marcelklehr
feat: Implement tools for the polls app
f41a132
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
@marcelklehr
feat: Implement tools for sharing
1b1d20b
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
@marcelklehr
fix(calendar): Fix new tasks tools to use ics library
374a5ea
Signed-off-by: Marcel Klehr <mklehr@gmx.net>
Initial plan
b8a9d30
CopilotAIand others added 2 commits March 17, 2026 22:07
Merge branch 'feat/moartools' ofhttps://github.com/nextcloud/context…
64e674c
…_agent into copilot/test-new-tools-in-pr-127
@marcelklehr
Fix broken API routes in deck, mail, polls, forms, and files tools
8516fa8
- deck.py: Fix list_boards() returning response.text instead of response.json()
- mail.py: Fix wrong docstring on get_mail_account_list(), rewrite
list_mail_folders, search_emails, get_email_messages, move_email_to_folder,
delete_email to use correct Nextcloud Mail REST API routes instead of
nonexistent OCS routes
- polls.py: Fix all routes to include correct /api/v1.0/ prefix, fix
create_poll payload (API doesn't accept description), fix add_poll_option
payload structure, fix vote_on_poll to use correct URL-based answer format
- forms.py: Update from nonexistent v2.4 API to correct v3 API, fix
create_form to use two-step create+update pattern, fix add_question_to_form
payload, fix option creation to use batch optionTexts parameter
- files.py: Fix get_folder_tree to use params= instead of json= for GET request
Co-authored-by: marcelklehr <986878+marcelklehr@users.noreply.github.com>
CopilotAI changed the title [WIP] Test new tools and fix issues from PR #127Fix broken API routes in deck, mail, polls, forms, and files toolsMar 17, 2026
CopilotAI requested a review from marcelklehrMarch 17, 2026 22:24
@marcelklehr

marcelklehr commented Mar 18, 2026

Copy link
Copy Markdown
Member

@copilot Make sure that the APIs we use do not requre the sending of CSRF tokens, as we don't have those in an ex app context

@marcelklehr
Add OCS-APIREQUEST header to all REST API calls to bypass CSRF checks
faac2a1
Nextcloud's SecurityMiddleware enforces CSRF checks on controller methods
without @NoCSRFRequired. ExApps don't have CSRF tokens, but Nextcloud's
Request::passesCSRFCheck() bypasses CSRF if the OCS-APIREQUEST header is
present (any non-empty value).
The nc_py_api library sets this header on the main OCS adapter, but NOT
on fresh adapters created via _create_adapter(True) used for REST calls.
Added "OCS-APIREQUEST": "true" header to all non-DAV REST API calls in:
bookmarks, cookbook, deck, mail, music, news, passwords, photos.
DAV calls (files.py, contacts.py, calendar.py) use /remote.php/dav/ which
goes through Sabre auth (AppAPIAuthBackend), not the CSRF middleware.
OCS calls (forms.py, polls.py, notes.py, circles.py, shares.py) already
have CSRF bypass via the OCS adapter's built-in OCS-APIREQUEST header.
Co-authored-by: marcelklehr <986878+marcelklehr@users.noreply.github.com>

CopilotAI commented Mar 18, 2026

Copy link
Copy Markdown
Author

@copilot Make sure that the APIs we use do not requre the sending of CSRF tokens, as we don't have those in an ex app context

Audited all API routes for CSRF requirements. The issue: nc._session._create_adapter(True) creates a fresh adapter without the OCS-APIREQUEST header, so Nextcloud's SecurityMiddleware would throw CrossSiteRequestForgeryException on controllers lacking @NoCSRFRequired.

The fix in faac2a1: added "OCS-APIREQUEST": "true" to all non-DAV REST calls (bookmarks, cookbook, deck, mail, music, news, passwords, photos). Nextcloud's Request::passesCSRFCheck() returns true when this header is present, bypassing CSRF.

Routes that don't need this fix:

  • OCS routes (forms, polls, notes, circles, shares): the nc.ocs() adapter already sets OCS-APIREQUEST: true
  • DAV routes (files, contacts, calendar): use /remote.php/dav/ with Sabre auth (AppAPIAuthBackend), not the CSRF middleware

CopilotAI changed the title Fix broken API routes in deck, mail, polls, forms, and files toolsFix broken API routes and add CSRF bypass for ExApp REST callsMar 18, 2026
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@marcelklehrmarcelklehrAwaiting requested review from marcelklehr

Assignees

@marcelklehrmarcelklehr

Copilot code reviewCopilot

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@marcelklehr