Add support for APIs so that delivery of secrets can be scripted

[markAcomm]

I am busy working on a set of automated scripts for setting up users. One of our best practices is to deliver the credentials for the user to the person via an email containing a link produced by Agrippa. Ideally, I would love to have a restful API that I can call with the appropriate data and timeout parameters that would simply deliver me the new URL. In this way, I could programmatically build the welcome email along with credential URL and incorporate it into my user setup scripts.

(thanks for the cool project by-the-way. Anything we can do to improve security is a great thing)

[bemosior]

Thanks for the suggestion!

I'll take a look at a few different patterns for building REST APIs with Laravel 5 and see what's involved. I can't promise anything yet, though. 😄

I'll just make a note of a few references that might be useful:

• https://tutorials.kode-blog.com/laravel-5-rest-api
• http://esbenp.github.io/2016/04/11/modern-rest-api-laravel-part-1/
• Might be some built-ins we can leverage (more reading required): https://laravel.com/docs/5.1/controllers

[markAcomm]

I don't expect any promises... so don't worry. FYI, I was able to automate the process already just by faking out the forms and parsing the responses. My concern is mostly that my automation is somewhat brittle. A few things that are a concern longer term with my implementation:

I need to make a GET call in order to extract the value that goes into the _token parameter of the form POST. In an idealized RESTful system, I should not have to provide this context in the post request. But to be honest, I am not sure why the _token is there in the first place (probably cross-side scripting protection)

On the response side, I had to basically look for the one-and-only-one 'pre' tag with an assumption that this is where the URL is hiding. But if you ever change the web page layout, that logic could break.

Overall, not too much work with a module of about 42 lines of Python.

[bemosior]

Got it. Interesting workaround! While you're right that it might be brittle, the rate of change on this project is pretty low, so you're probably safe for the foreseeable future.

That said, I really like the idea of an API endpoint, so I'll keep this on my to-do list.