[openstreetmap/openstreetmap-website] Notes Api: 403 Forbidden when downloading notes with logged in user (OAuth) (#2085)

[Tobias Zwick]

For the API endpoints concerning downloading notes (in a bbox, searching, downloading single notes), I am now getting a...
`Forbidden (403) You have not permitted the application access to this facility`
...when doing the request with a logged in user (OAuth).

It is irrelevant whether the OAuth token for the user has all permissions checked (in particular "modify notes.", I presume) or none checked. The API always returns a 403.

Not tested with an anonymous user.

The bug became visible for me today at around 21:00 UTC 12.12.2018 when I started receiving bug reports for StreetComplete. [Integration tests of osmapi](https://github.com/westnordost/osmapi/blob/master/src/test/java/de/westnordost/osmapi/notes/NotesDaoTest.java#L311-L319) are also failing now.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/openstreetmap/openstreetmap-website/issues/2085
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstreetmap.org/pipermail/rails-dev/attachments/20181212/94a72f27/attachment.html>