Web API

[Dinoosawruss]

Is there a web API that we can use to grab data from PLAN on servers such as total players joined or average essentials balance?

Additional context

(I'm trying to make a modular plan addon for a discord bot)

[AuroraLS3]

The data that is on different tabs of the panel is available https://github.com/plan-player-analytics/Plan/blob/master/Plan/json-endpoints.md - The docs are missing some, but you can probably look at the Browser Dev console Networking tab while opening the site to find any missing ones (Remember to enable logging of XMLHTTPRequests on dev console settings)

Extension data is not available through these endpoints (I haven't serialized the object representation into json anywhere) - it needs to be accessed from the database

• https://github.com/plan-player-analytics/Plan/wiki/Database-Schema
• https://github.com/plan-player-analytics/Plan/wiki/APIv5-Query-API

[Dinoosawruss]

How would one get around the username and password with the json endpoints?

[AuroraLS3]

endpoint /auth/login?user=name&password=pass can be used to get a login cookie (Response sends Set-Cookie header).
If the cookie is not present or expires the responses will 301 (redirect) to /login?from=original address, the cookie can expire when server reboots or after the expiry time given with the cookie (Max-Age=seconds).

A proper API-key thing is probably needed at some point, but it needs web-user permissions to be redone.

[Dinoosawruss]

I seem to be getting an error every time I run it:
Exception has occurred: SSLError HTTPSConnectionPool(host='HIDDEN', port=8804): Max retries exceeded with url: /v1/auth/login?user=HIDDEN&password=HIDDEN (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1108)')))

[AuroraLS3]

It sounds like you are using an out of date certificate. This can happen if you're using the self-signed cert inside Plan (which expired in 2018) or if your cert expired

[Dinoosawruss]

So its an issue with the server running Plan not what I'm doing?

[AuroraLS3]

Yep - If you have a self signed cert on the server you might need to add it to the trust store of the client you're connecting with

[Dinoosawruss]

Both my cert and the one on the server are now up-to-date and I seem to be getting a <Response 401>

[Vankka]

HTTP 401 stands for Unauthorized, check that the username & password are correct

[Dinoosawruss]

Sorry I feel like I'm being a bit of a pain

The /auth/login?... endpoint seems to return a 404

[AuroraLS3]

It sounds like you're using version older than build 545 (where cookie based login was introduced) - try updating to latest build to see if it fixes the issue https://github.com/plan-player-analytics/Plan/releases

[Dinoosawruss]

Even when the login is correct I get a user and password doesn't match error

• It happens with both the logins on the site

[AuroraLS3]

What is the full response body that you get as the error?

[Dinoosawruss]

"error": "User and Password did not match",
"status": 400,
"requestedTarget": "/auth/login"
}```

[AuroraLS3]

Try URI encoding the username and password - that might help
Here is how Plan uses the /auth/login endpoint https://github.com/plan-player-analytics/Plan/blob/master/Plan/common/src/main/resources/assets/plan/web/login.html#L206

[Dinoosawruss]

I get the same error even with them URI encoded

[AuroraLS3]

Could you send some code to see what is going on

[Dinoosawruss]

data = requests.get(f"https://{config['address']}/auth/login?user={config['uname']}&password={config['password']}")
This is the only relevant code

Config file:

{
    "address": "host.lazuritemc.org:8804",
    "serverName": "LazuriteMC",
    "uname": "Dinoosawruss",
    "password": "URI ENCODED PASSWORD"
}

[AuroraLS3]

Hmm, looks correct to me, if you put the request into Postman what do you get back?

[Dinoosawruss]

<script src="vendor/bootstrap/js/bootstrap.bundle.min.js"></script>

<!-- Custom scripts for all pages-->
<script src="js/xmlhttprequests.js"></script>
<script src="js/color-selector.js"></script>

<script src="js/logonsine.js"></script>
<script id="mainScript">
    drawSine("decoration");

    const msg = $(`#fail-msg`);

    function displayError(message) {
        msg.text(message);
        msg.removeClass('hidden');
    }

    $('#forgot-button').click(() => $('#forgotModal').modal());
    $('#login-button').click(() => {
        msg.addClass('hidden');
        const user = $('#inputUser').val();
        if (!user || user.length < 1) {
            return displayError('You need to specify a Username');
        }
        if (user.length > 50) {
            return displayError('Username can be up to 50 characters, yours is ' + user.length);
        }
        const password = $('#inputPassword').val();
        if (!password || password.length < 1) {
            return displayError('You need to specify a Password');
        }
        jsonRequest(`./auth/login?user=${encodeURIComponent(user)}&password=${encodeURIComponent(password)}`, (json, error) => {
            if (error) {
                if (error.includes("HTTP 403")) {
                    location.reload();
                }
                $('#inputPassword').val("");
                return displayError('Login failed: ' + error);
            }
            if (json && json.success) {
                const urlParams = new URLSearchParams(window.location.search);
                const cameFrom = urlParams.get('from');
                window.location.href = cameFrom ? cameFrom : './';
            } else {
                return displayError('Login failed: ' + json.error);
            }
        });
    })
</script>
</body>

</html>

Sorry for the late response I've been busy the last few days

I get that back on all requests made to the endpoint

[AuroraLS3]

That looks like login.html so it sounds like the request is responded with a redirect to the login page.

[AuroraLS3]

Was that given for a GET /auth/login?user=user&pass=pass?

[Dinoosawruss]

Yeah I get that on all requests I make including the auth/... ones

[AuroraLS3]

If you open dev tools network tab in the browser before logging in and then login, does the request to /auth/login in the browser differ in some way from the request made from your script?
Does the browser get the same response?

These might help debugging the script