Techjoomla API using same ACL as site

Question

First Context:

I am making a JS application that needs to call an api.

The application is a form full of multiple choice select elements. Depending on the selected elements data is sent to the api. The api should return an article's full text.

I have the following code which works. (no logic being done yet but I can do that later)

<?php

include ("/components/com_content/models/article.php");

class WdtoptionsApiResourceOptions extends ApiResource
{

    public function post()
    {   
        $data = new \stdClass;
        $data = json_decode(file_get_contents("php://input"));
        
        $result       = new \stdClass;
        $result->name = "WDTOptions Test";
        $result->id = 6;
        
        JModelLegacy::addIncludePath(JPATH_SITE . '/components/com_content/models' );
        
        $article = JModelLegacy::getInstance( 'article', 'ContentModel');
        
        $body = $article->getItem(6);
        

        $result->optionlist = $body->introtext . $body->fulltext;
        $result->postData = $data;
        
        $this->plugin->setResponse( $result );

    }
}
?>

The issue is that the article's text is returned by the api regardless of whether the user is logged into my site. This means that third parties could run their own apps off my api. They could also probe my api to work out how to use it. As my business depends on selling licences to this app I want to avoid that.

It has occurred to me that I could solve the problem by having my api output a hyperlink to the article and then having my front end call the article separately by a separate AJAX call. However this seems clunky and generally poor practice.

Is there way to have the ACL from the site apply to the API itself? I don't really want to use the JWT authentication process unless I have to.

Just to clarify I'm not expecting full code answers. Psudocode or overview is fine.

Answer 1

If your js is attached to a joomla page then you can get your users to login to joomla in the usual way. Then when your js executes an ajax call to the server, because the browser sends the session cookie in the http request, joomla knows if the http request is associated with a logged-in user. So inside your server code handling the ajax request you can do

use Joomla\CMS\Factory;

$user = Factory::getUser();
$accessLevels = $user->getAuthorisedViewLevels();

(See User API Guide).

Then you can check if the user has access by checking if the Access field associated with the article is present within the $accessLevels of the user. Some of your articles may have public access, so you may wish to show those to visitors who aren't logged in.

Another aspect to implement is to include the Joomla form token within your form using (in the joomla layout file):

<?php echo JHtml::_('form.token'); ?>

and include this html input field in your ajax request.

Then in your ajax request handling code:

if (!JSession::checkToken('get')) 
{
    echo new JResponseJson(null, JText::_('JINVALID_TOKEN'), true);
}

This means that anyone trying to copy your ajax request from elsewhere will have the request rejected.

There is documentation on including js code within joomla in Adding Javascript and CSS to the page and also worked examples in the Joomla MVC Tutorial steps Adding a Map and Adding Ajax.