No task_log permission available for API

[schmunk42]

We would like to log time for tasks via API, all users should be able to log time even when the task is not assigned to them.

There's a task_log permission here:
https://github.com/kevinpapst/TaskManagementBundle/blob/master/Controller/API/TaskController.php#L303

But we were not able to find it in the backend.

---

Using master from early August.

[kevinpapst]

This permission is not mentioned in the docs because it is internal and cannot be assigned.
See https://github.com/kevinpapst/TaskManagementBundle/blob/master/Voter/TaskVoter.php#L147

Use task_start_all and do NOT assign the task to anyone.
See https://github.com/kevinpapst/TaskManagementBundle#permissions

[schmunk42]

@kevinpapst Sadly, it does not work, we get this error message now:

Request URL: https://kimai.hrzg.de/api/tasks/613/log
Request Method: PATCH
Status Code: 403
Response: {code: 403, message: "Cannot log time for that task, not assigned to the user"}

Task is not assigned to any user. We are also unable to log time for a task via the API (Swagger) directly:

curl -X PATCH "https://kimai.ourserver/api/tasks/545/log" -H "accept: application/json" -H "Content-Type: application/json" -H "X-AUTH-USER: someone" -H "X-AUTH-TOKEN: ZE7777777fDx" -d "{"begin": "2021-09-29T15:25:00","end": "2021-09-29T16:25:00"}"

Response:

{"code":403,"message":"Cannot log time for that task, not assigned to the user"}

If we leave out the X-AUTH header (as suggested by Swagger?! shows an open lock) we get an error, that they are missing.

[kevinpapst]

Hm, looking at the code you are right.

I missed the part log in

We would like to log time for tasks via API

The permission task_start_all only allows to start the tasks by now., see here: https://github.com/kevinpapst/TaskManagementBundle/blob/master/Voter/TaskVoter.php#L102-L113

You could patch this line: https://github.com/kevinpapst/TaskManagementBundle/blob/master/Voter/TaskVoter.php#L153 with the logic from above.

[schmunk42]

There should be also a permission like task_log_all, right?

[kevinpapst]

Either that or

1. we rename the permission or
2. we re-use the task_start_all permission (starting and logging leads to the same result at the end)
3. we make this a global configuration, which switches the task management plugin from a user-based approach to a task-based approach => whiner a task is not assigned it is open to be used by everyone

The permission has the benefit, that you can have a mixed mode instead of (3).
Re-using (2) has the benefit that we do not need new migrations.
So I am in favor of 2.