API: several get routes need a session token

[CharlesNepote]

Reproducing:

• open a web browser
• enter https://nutripatrol.openfoodfacts.org/api/v1/flags

=> the answer is {"detail":"Missing session token"}

This is annoying for apps/people who just want to get the data, for whatever reason (stats, RAD, prototypes...).

This is the case for:

• /api/v1/flags
• /api/v1/flags/{flag_id}
• /api/v1/tickets
• /api/v1/tickets/{ticket_id}
• /api/v1/stats

Solution

Return the data without the need of a session token.

[teolemon]

@CharlesNepote there's stuff that's not suitable for the general public in nutri-patrol (that's the thinking for auth)

[CharlesNepote]

there's stuff that's not suitable for the general public in nutri-patrol (that's the thinking for auth)

I don't get the point... Nutripatrol is not reserved for moderators. The general public can easily have access to the data if they register. It's just slowing down potential experiments and reuses. We don't do this for Folksonomy Engine or Open Food Facts.

[devsk18]

Hi @teolemon and @CharlesNepote
I’d like to work on this issue.

Could you confirm:

1. Whether the routes we intend to make public should fully bypass auth checks or override certain parts?

Please share your thoughts.