write:favorites scopes does not allow to toggle favorite status
I was under the impression that the write:favorites
scope would authorize an access token to toggle the favorite state of a track. With Funkwhale 0.21.1 and open.audio
, I apparently get a 403 Forbidden
response with the following response:
POST /api/v1/favorites/tracks/ HTTP/1.1
Accept: application/json, */*;q=0.5
Accept-Encoding: gzip, deflate
Authorization: Bearer [REDACTED]
Connection: keep-alive
Content-Length: 14
Content-Type: application/json
Host: [REDACTED]
User-Agent: HTTPie/2.2.0
{
"track": "1"
}
HTTP/1.1 403 Forbidden
Allow: GET, POST, HEAD, OPTIONS
Content-Length: 63
Content-Type: application/json
Date: Sun, 16 Aug 2020 12:38:42 GMT
Server: nginx
Vary: Cookie, Origin
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Xss-Protection: 1; mode=block
{
"detail": "You do not have permission to perform this action."
}
I tried with an access token using the global scopes read write
, and the result is the same.
Are the /api/v1/favorites/tracks/[remove/]
endpoints not included in these scopes?