Flag content in Drupal via external HTTP request

Question

I'm writing an iOS app that displays content from a website managed by Drupal. I figured how I can create views in Drupal for delivering the content as JSON to the app. But now I want to enable my logged-in users to flag content as their favorites. Users can create an account on the website and are also able to log in inside the app. Favorites are stored per user.

In Drupal this is implemented using the Flag module, which renders corresponding links for toggling the flags on the website. Those links point to a specific URL that also contains a token to prevent spoofing. Calling the URL without the token leads to access denial.

Now unfortunately I can't generate those tokens in my app. Is there a way to flag content without using the website?

I'm new to Drupal. All I need is basically a hint on how to implement my own HTTP APIs that allow external programs to manipulate content.

Answer 1

It turns out I had to write my own module that provides a menu callback entry. My favorites_api.module file looks like this:

/**
 * Implements hook_menu().
 */
function favorites_api_menu() {
    $items['node/%/favorite/%'] = array(
        'title' => 'Mark as favorite',
        'page callback' => 'favorites_api_toggle_favorite',
        'page arguments' => array(1, 3),
        'access callback' => 'user_access',
        'access arguments' => array('access content'),
        'type' => MENU_CALLBACK,
    );

    return $items;
}

/**
 * Callback for above menu entry
 */
function favorites_api_toggle_favorite($entity_id, $action) {
    $favorites_flag = flag_get_flag('favorites') or die('no "favorites" flag defined');
    $favorites_flag->flag($action, $entity_id);

    // error handling and return message
    // ...
}

Now I can call http://myurl/node/3/favorite/flag to mark node 3 as favorite and http://myurl/node/3/favorite/unflag to unmark it.

Having to write a menu entry to create a custom URL action is a bit misleading, though...

Answer 2

Download and enable the "session api" module (https://drupal.org/project/session_api).

As said when you create/edit a flag module in the "Flag access" section:

Anonymous users may flag content if the Session API module is installed.

Every anonymous users will have the same token (line 2358 in "flag.module" file):

md5(drupal_get_private_key() . $entity_id)

You can then build this token in your app if you can get the entity/node id (private key can be fixed and set in Drupal configuration).

Edit: you will have to add a permission for your flag name for anonymous user in the permissions. list