It's missing an entry to show in the API docs :)

@mattia, if you need an example of how to do this, you can see how new API endpoints are added with this commit: https://pagure.io/pagure/c/1b7d305d06af42f0996ae54fea223ecc5a081b72

There are some failed tests, can you take a look at them?

05:17:53  FAILED tests/test_pagure_flask_api_project.py::PagureFlaskApiProjectVerifyAPITokenTests::test_api_verifyapitoken_no_headers
05:17:53  FAILED tests/test_pagure_flask_api_project.py::PagureFlaskApiProjectVerifyAPITokenTests::test_api_verifyapitoken_not_valid
05:17:53  FAILED tests/test_pagure_flask_api_project.py::PagureFlaskApiProjectVerifyAPITokenTests::test_api_verifyapitoken_valid
05:17:53  FAILED tests/test_style.py::TestStyle::test_code_with_black - AssertionError:...

Still three failures:

03:49:19  FAILED tests/test_pagure_flask_api_project.py::PagureFlaskApiProjectVerifyAPITokenTests::test_api_verifyapitoken_no_headers
03:49:19  FAILED tests/test_pagure_flask_api_project.py::PagureFlaskApiProjectVerifyAPITokenTests::test_api_verifyapitoken_not_valid
03:49:19  FAILED tests/test_pagure_flask_api_project.py::PagureFlaskApiProjectVerifyAPITokenTests::test_api_verifyapitoken_valid

This currently can only verify tokens with modify_project ACL. Ideally, this should work with any ACL, but I have to figure out how to do so without listing all ACLs in the api_login_required decorator...

I've changed the logic in _check_token() and now there are several tests failing... is it really correct the current logic in _check_token? It only raises an error within the if api_authenticated() block, but if api_authenticated() is False there's no token that could be validated, so shouldn't it raise an error as well?

I think you're probably right here. We want this to fail when the user isn't authenticated/authorized to access the API.

I think you're probably right here. We want this to fail when the user isn't authenticated/authorized to access the API.

So, I'll try to firstly look at changing _check_token() behavior and analyze tests failures and try to fix them. Then I'll rebase this PR on top of that.

That sounds like a good plan of action!

Well, after some digging in Pagure code, I think I'm going to retire this PR. I'm really confused on how this all work and can't figure it out.
Also, as I understand it, check_token() checks a token is valid for a project if the token is project specific, while the token is system wide only checks if the call of check_token() must be for a project specific or not (so it doesn't really check token validity).