0

I'm scripting a Weblate (version 4.3.2) installation and I've successfully fetched existing localizations from Weblate REST API using curl and pass the Authorization Token value from the Weblate profile settings (login, open profile menu from top right, select Settings - API Access and copy-paste the "personal API key").

In short, the GET /api/translations/(string:project)/(string:component)/(string:language)/file/ request works according to documentation at https://docs.weblate.org/en/weblate-4.3.2/api.html#get--api-translations-(string-project)-(string-component)-(string-language)-file- and I'm getting the expected results with pretty good performance.

However, the POST /api/translations/(string:project)/(string:component)/(string:language)/file/ request documented at https://docs.weblate.org/en/weblate-4.3.2/api.html#post--api-translations-(string-project)-(string-component)-(string-language)-file- always fails and results in following response:

HTTP/2 403 
server: WSGIServer/0.2 CPython/3.8.10
content-type: application/json
vary: Accept,Cookie
allow: GET, POST, PUT, HEAD, OPTIONS
x-ratelimit-limit: 5000
x-ratelimit-remaining: 4878
x-ratelimit-reset: 107
x-frame-options: DENY
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
referrer-policy: same-origin

with the response body

{"detail":"You do not have permission to perform this action."}

I'm trying to use is the default admin account of the Weblate installation so I'd expect it to have all the required permissions. I get different error if token is incorrect so I'm pretty sure this is not related to token error. The HTTP/2 status in the response is caused by our reverse proxy and I'd assume that Weblate normally serves HTTP/1.1 traffic only.

I've also granted all possible permissions in Projects - Browser all Projects - (project name) - Manage (menu) - Users; namely "Administration", "Glossary", "Languages", "Memory", "Screenshots", "Sources", "Translate", "VCS".

In addition I've used the backend Django admin interface accessible via Wrench icon in top right and selecting Tools and Django admin interface. I've granted all the groups that I've thought might affect the permissions. In practice, this user account has following value for "User groups":

Users,Viewers,All@Sources,All@Languages,All@Administration,All@Translate,All@Glossary,All@Memory,All@Screenshots,All@VCS

and it has enabled status for both "Active" and "Superuser status".

Can you suggest anything else to try? I seems like clear permission problem but what I'm missing?

Mikko Rantalainen
  • 14,132
  • 10
  • 74
  • 112

1 Answers1

1

Most likely method or conflicts parameters are wrong. The API code raises permission error in these cases, but it should rather tell user what is wrong.

The error messages should be more useful in the next release, I've improved this in https://github.com/WeblateOrg/weblate/commit/4abf2193ed57cb7822db804376c6adde9cccb753

Michal Čihař
  • 9,799
  • 6
  • 49
  • 87
  • Thank you, the issue was similar to https://github.com/WeblateOrg/weblate/issues/4199 and the problem was that we had gettext compatible `.po` and `.pot` files and tried to update the base strings with `method=source` which caused the above problem. Using `method=replace` instead works nicely but requires merging changes from multiple sources locally because `replace` overwrites all changes. I successfully created scripts to fetch localizations, merge locally if needed and push changes using `method=replace`. – Mikko Rantalainen Dec 10 '21 at 10:01
  • By the way, can you explain the difference between `method=add` vs `method=translate`? Those seem really similar to me. – Mikko Rantalainen Dec 10 '21 at 10:06
  • See https://docs.weblate.org/en/latest/user/files.html#import-methods – Michal Čihař Dec 14 '21 at 19:47
  • `translate`: "Imported translations are added as translations" vs `add`: "Adds new strings to the translation". What's the difference? – Mikko Rantalainen Dec 15 '21 at 15:20
  • 1
    `translate` translates existing strings, `add` adds currently non-existing strings – Michal Čihař Dec 28 '21 at 12:36
  • Thanks, so if the input is `messges.pot` then `translate` would do nothing and `add` would add previously unknown `msgid` strings. – Mikko Rantalainen Dec 29 '21 at 11:05