API validation

[saltydk]

Is there a good reason the url validation doesn't validate against the API and uses the /documents endpoint? This breaks forwardauth style SSO solutions where they just whitelist the /api endpoints.

Ideally only the api endpoints should be used.

Relevant code:

paperless-ai/services/setupService.js

Lines 30 to 42 in f16dfde

	async validatePaperlessConfig(url, token) {
	try {
	const response = await axios.get(`${url}/documents/`, {
	headers: {
	'Authorization': `Token ${token}`
	}
	});
	return response.status === 200;
	} catch (error) {
	console.error('Paperless validation error:', error.message);
	return false;
	}
	}

[clusterzx]

Sorry, I dont know why you mention SSO solutions in the same context with the provided code?
It is just an endpoint, it would not make any difference if /api/documents, /api/tags/ or just /api is used.

[saltydk]

Well, I tried to help.

[clusterzx]

Ok sorry, I see what I misunderstood now. You mean the auth provider only lets /api calls through.

You are right with the setup part. It only tries to get a valid 200 back without using the api.

Big sorry I was going to bed and maybe I am more exhausted and brain afk as I thought.

The appending with /api is done in all other scenarios BUT this one here.

My bad my bad.

[saltydk]

Yeah, maybe the forwardauth explanation wasn't clear if you aren't using that on a regular basis. That is the exact scenario that fails here.

[clusterzx]

That will be a quick fix tomorrow. Literally only 4 chars 😅

[clusterzx]

Yeah, maybe the forwardauth explanation wasn't clear if you aren't using that on a regular basis. That is the exact scenario that fails here.

No no that was totally fine. I am just dumb as f... 🌞