通过RESTful API通过Python安装ArangoDB Foxx请求导致“未经授权”错误

Question

We use ArangoDB and Python using the requests module to use Arango's HTTP API. I'm having authorisation problems deploying a Foxx app programically via the HTTP API which we'd like to do as part of our automated testing process. The only program example I can find of uploading an app appears to use obsolete routes. I can upload the zip:

http://mydev:8529/_db/mydb/_api/upload

I get back:

{"filename": "uploads/tmp-13-718410"}

...and the file is there. But then trying this with the post data {"zipFile": "uploads/tmp-13-718410"}:

http://mydev:8529/_db/mydb/_admin/aardvark/foxxes/zip?mount=%2Fmy-mount-point

I get back {"error": "unauthorized"}. I realise that it's telling me what's wrong but I'm using basic auth both for the _system db and mydb (the username/password is the same for both). I can create/drop databases via the HTTP API no problem but I can't seem to use the aardvark module.

I am using 2.6.8.

My code in python is:

import requests

self._requests = requests.Session()
self._requests.auth = ('user', 'password')

# create the database
r = self._requests.post('http://mydev:8529/_api/database', json={'name': 'mydb', 'users': [{'username': 'user' 'passwd': 'password'}]})

...all searches, inserts, etc. via the HTTP API all work.

Then when later installing a Foxx app via the HTTP API:

r = self._requests.post('http://mydev:8529/_db/mydb/_api/upload', data=data) # succeeds
filename = r.json()['filename']

data = {'zipFile': filename}
r = self._requests.put(
    r'http://mydev:8529/_db/mydb/_admin/aardvark/foxxes/zip?mount=%2Fmy-mount-point',
    json=data
)

I get back {"error": "unauthorized"}.

The app works fine when I install the app using the UI or simply copying the files to the correct location and bouncing the database.

Do I need to separately send credentials to use the aardvark route in a way I'm not doing it here? Am I missing a step?

Answer 1

I think when all URLs in the /_admin/aardvark realm require separate (cookie-based) authentication, as they belong to the (graphical) admin interface. Calling such URL in the browser will probably bring up the login screen, regardless of whether HTTP basic authentication data is sent with the request.

To install a Foxx application via the REST API, I think the better API endpoint is HTTP PUT /_admin/foxx/install .

It will require a JSON body to be sent, with attributes named mount and appInfo . mount needs to contain the mountpoint (needs to start with a forward slash). appInfo is the application to be mounted. It can contain the filename as previously returned by the server from the call to /_api/upload , eg

{ 
    "appInfo" : "uploads/tmp-30573-2010894858", 
    "mount" : "/my-mount-point" 
}