Apply group weight system to API token modifications

pub/api/classes/API_apitoken.php

@@ -3,6 +3,7 @@
 namespace api\classes;
 
 use api\classes\API;
+use api\classes\API_users;
 
 require_once 'API.php';
 
@@ -25,6 +26,46 @@ class API_apitoken extends API
         return $tokens;
     }
 
+    public function getUserTokens($returnBoolean = false)
+    {
+        list($query, $types, $params) = $this->buildDynamicQuery('system_api_tokens');
+
+        $items = $this->generalGetFunction($query, $types, $params, $returnBoolean, 'User');
+
+        return $items;
+    }
+
+    public function checkTokenPermissions()
+    {
+        # First we need to find to what user the api_token belongs to if its not given.
+        # If the user_uuid is unknown, get the user_uuid based on the api_token_being.
+        if (!$this->data['user_uuid']) {
+            $_GET['builder'] = [1 => ['where' => [0 => 'api_token_uuid', 1 => $this->data['api_token_uuid']]]];
+            $this->data['user_uuid'] = $this->getUserTokens()[0]['user_uuid'];
+        }
+
+        if ($this->getUserUuid() === $this->data['user_uuid']) {
+            # The user is modifying its own api_token
+            $this->checkPermissions('user-apitoken-self', 'RW');
+
+        } else {
+            # An API token is being modified owned by another user. We need to make sure the current user is allowed to
+            # modify tokens of others.
+            $this->checkPermissions('user-apitoken-others', 'RW');
+
+            # Now get the user_group_uuid and then retrieve the group_weight
+            require_once 'API_users.php';
+            $API_users = new API_users();
+            $_GET['builder'] = [1 => ['where' => [0 => 'user_uuid', 1 => $this->data['user_uuid']]]];
+            $user_group_uuid = $API_users->getUser()[0]['user_group_uuid'];
+            $user_group_weight = $API_users->getUserGroupWeight($user_group_uuid);
+
+            if ($user_group_weight < $_SESSION['user']['user_group_weight']) {
+                $this->apiOutput(401, ['error' => 'You are not authorized to access this resource.']);
+            }
+        }
+    }
+
     public function createNewToken()
     {