On 13 April 2017 at 12:41, Sam Ruby <[email protected]> wrote: > I'll note that PM is based on ElasticSearch which has its own API. > Direct access to ES could enable the secmail tool to build a truly > custom interface. > > One way to deal with the credentials issue would be for PonyMail to > expose a read-only interface to ES that is only available to ASF > members. An nginx example of doing this can be found here: > > http://stackoverflow.com/questions/14115475/easy-way-to-make-an-elasticsearch-server-read-only > > This could readily be adapted to Apache HTTPD, and make use of LDAP > for authentication.
The ES database contains private messages; I assume all ASF members would have access to all mails so AFAICT granting arbitrary read-only access would not expose data that they cannot see anyway. There are some fields in the mbox records that are not currently exposed, but probably those are not any more private than the message data. However the ES database also stores other data - e.g. per-user account data - which I don't believe should be made available to all members. Unless access to that other data can be restricted in some way by URL I think it will be necessary to filter requests through some local scripts installed on the server. > - Sam Ruby > > > On Thu, Apr 13, 2017 at 5:31 AM, sebb <[email protected]> wrote: >> The PM API is described here: >> >> https://github.com/apache/incubator-ponymail/blob/master/docs/API.md >> >> Since the messages are private, it would also be necessary to sign in >> with the ASF oauth system to get the auth cookie. >> This is handled partly in Javascript. I don't think there is any >> explicit docn for this. >> >> Then one would need to use the API to find the matches and finally >> return the document(s). >> >> It would be a lot easier to use the web interface directly. >> i.e. Whimsy could generate links with the appropriate search settings >> to be run in a separate tab or Window. >> >> Since manual searches update the browser URL, it should be easy enough >> to perform some sample searches and record the URLs which can be >> updated for different searches. >> >> >> On 10 April 2017 at 23:30, Craig Russell <[email protected]> wrote: >>> Looping in dev@ponymail... >>> >>> tl;dr is there a way to use ponymail from within the whimsy secmail >>> application? I'd like to search private mail when processing iclas for new >>> committers. >>> >>> Craig >>> >>>> On Apr 7, 2017, at 4:34 PM, Craig Russell <[email protected]> wrote: >>>> >>>> Hi, >>>> >>>> Should I use dev@ponymail for this question? >>>> >>>> I'd like to improve my use of pony mail for the purpose of filing new >>>> iclas for committers. >>>> >>>> Currently I open lists.apache.org and type the name of the person filing >>>> an icla and tab to the subject line and type [RESULT][VOTE] and search all >>>> lists. >>>> >>>> Sometimes the names are complicated and the name on the icla doesn't >>>> exactly match the name voted by the pmc. So what I'd like to do is enter >>>> both the public name and the full name and see results that match >>>> [RESULT][VOTE] in the subject and match any of the names in the quick >>>> search field. >>>> >>>> I tried putting names into the subject field along with [RESULT][VOTE] but >>>> that returned zero results. >>>> >>>> The second thing I would like is for whimsy to query lists.apache.org via >>>> an api. Is there such a thing as an api to pony mail? >>>> >>>> Thanks, >>>> >>>> Craig >>>> >>>> Craig L Russell >>>> Secretary, Apache Software Foundation >>>> [email protected] http://db.apache.org/jdo >>>> >>> >>> >>>
