Task list portal – key and endpoints
How the key of the sign-in-free task list is built, what it can show, the token of the AJAX actions and the assignee check.
Overview
A task list opened from e-mail without sign-in: ?key= plus 32 hexadecimal characters. The key contains the masked user ID and a check hash; both are derived from a secret fixed in the source code (COMMENT_SECRET).
Data model
Table names carry the installation's own prefix in the database.
Tables read and written: task, task_assignee, task_comment, company, category.
Endpoints
| Endpoint | Behaviour |
|---|---|
task/tasklist | decodeKey() → user; open tasks per company, overdue, today and upcoming counters, comments; error page for a bad key |
task/tasklist.addComment | 2–2000 characters, optional event date, assignee of the task only (isTaskAssignee) |
task/tasklist.markDone | after the assignee check markTaskDone() and an automatic comment |
task/tasklist.getCompleted | the user's completed tasks |
The AJAX actions expect POST fields user_id and token; the token is the first 32 characters of sha256(user_id:COMMENT_SECRET).
Known limitations
- The secret of the key and the token is fixed in the source code, not an installation-specific setting.