meteo/Sentri
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Apply group weight system to API token modifications

Browse Source
This commit is contained in:
Marco
2026-05-19 22:30:38 +02:00
parent 995eca4111
commit fa5459df56
5 changed files with 75 additions and 54 deletions
Download Patch File Download Diff File Expand all files Collapse all files

41
pub/api/classes/API_apitoken.php
View File

@@ -3,6 +3,7 @@
namespace api\classes;
use api\classes\API;
use api\classes\API_users;
require_once 'API.php';
@@ -25,6 +26,46 @@ class API_apitoken extends API
return $tokens;
}
public function getUserTokens($returnBoolean = false)
{
list($query, $types, $params) = $this->buildDynamicQuery('system_api_tokens');
$items = $this->generalGetFunction($query, $types, $params, $returnBoolean, 'User');
return $items;
}
public function checkTokenPermissions()
{
# First we need to find to what user the api_token belongs to if its not given.
# If the user_uuid is unknown, get the user_uuid based on the api_token_being.
if (!$this->data['user_uuid']) {
$_GET['builder'] = [1 => ['where' => [0 => 'api_token_uuid', 1 => $this->data['api_token_uuid']]]];
$this->data['user_uuid'] = $this->getUserTokens()[0]['user_uuid'];
}
if ($this->getUserUuid() === $this->data['user_uuid']) {
# The user is modifying its own api_token
$this->checkPermissions('user-apitoken-self', 'RW');
} else {
# An API token is being modified owned by another user. We need to make sure the current user is allowed to
# modify tokens of others.
$this->checkPermissions('user-apitoken-others', 'RW');
# Now get the user_group_uuid and then retrieve the group_weight
require_once 'API_users.php';
$API_users = new API_users();
$_GET['builder'] = [1 => ['where' => [0 => 'user_uuid', 1 => $this->data['user_uuid']]]];
$user_group_uuid = $API_users->getUser()[0]['user_group_uuid'];
$user_group_weight = $API_users->getUserGroupWeight($user_group_uuid);
if ($user_group_weight < $_SESSION['user']['user_group_weight']) {
$this->apiOutput(401, ['error' => 'You are not authorized to access this resource.']);
}
}
}
public function createNewToken()
{

6
pub/api/classes/API_users.php
View File

@@ -90,12 +90,14 @@ The Sentri gnomes';
$this->apiOutput(200, ['success' => 'User created successfully. mail has been sent']);
}
private function getUserGroupWeight()
public function getUserGroupWeight($user_group_uuid = false)
{
require_once 'API_usergroups.php';
$API_usergroups = new API_usergroups();
$_GET['builder'] = [1 => ['where' => [0 => 'user_group_uuid', 1 => $this->data['user_group_uuid']]]];
$uuid = $user_group_uuid ?: $this->data['user_group_uuid'];
$_GET['builder'] = [1 => ['where' => [0 => 'user_group_uuid', 1 => $uuid]]];
return $API_usergroups->getUserGroup()[0]['user_group_weight'];
}

49
pub/api/v1/user/apitoken/index.php
View File

@@ -19,14 +19,7 @@ if ($API_apitoken->request_method === 'GET') {
$API_apitoken->validateData($requiredFields);
if ($API_apitoken->getUserUuid() === $API_apitoken->data['user_uuid']) {
$API_apitoken->checkPermissions('user-apitoken-self', 'RW');
} else {
$API_apitoken->checkPermissions('user-apitoken-others', 'RO');
}
$API_apitoken->checkTokenPermissions($API_apitoken->data['user_uuid']);
$apitokens = $API_apitoken->getTokens();
@@ -46,23 +39,7 @@ if ($API_apitoken->request_method === 'GET') {
$API_apitoken->validateData($requiredFields, $optionalFields);
# First retrieve the user_uuid from the post and lookup the user
require_once $_SERVER['DOCUMENT_ROOT'] . '/api/classes/API_users.php';
$API_users = new API_users();
$_GET['builder'] = [1 => ['where' => [0 => 'user_uuid', 1 => $API_apitoken->data['user_uuid']]]];
$user_data = $API_users->getUser()[0];
if ($API_apitoken->getUserUuid() === $API_apitoken->data['user_uuid']) {
$API_apitoken->checkPermissions('user-apitoken-self', 'RW');
} else {
if ($user_data['user_email'] === 'superuser') {
$API_apitoken->apiOutput(401, ['error' => 'You are not authorized to access this resource.']);
}
$API_apitoken->checkPermissions('user-apitoken-others', 'RW');
}
$API_apitoken->checkTokenPermissions();
$API_apitoken->createNewToken();
@@ -77,18 +54,12 @@ if ($API_apitoken->request_method === 'GET') {
'api_token_uuid' => ['type' => 'uuid'],
'api_token_revoked' => ['type' => 'boolean'],
];
$API_apitoken->validateData($requiredFields);
$api_token_data = $API_apitoken->getToken();
if ($API_apitoken->getUserUuid() === $api_token_data['user_uuid']) {
$API_apitoken->checkPermissions('user-apitoken-self', 'RW');
} else {
if ($api_token_data['user_email'] === 'superuser') {
$API_apitoken->apiOutput(401, ['error' => 'You are not authorized to access this resource.']);
}
$API_apitoken->checkPermissions('user-apitoken-others', 'RW');
}
$API_apitoken->checkTokenPermissions();
$API_apitoken->revokeToken();
@@ -103,17 +74,11 @@ if ($API_apitoken->request_method === 'GET') {
$requiredFields = [
'api_token_uuid' => ['type' => 'uuid'],
];
$API_apitoken->validateData($requiredFields);
$api_token_data = $API_apitoken->getToken();
if ($API_apitoken->getUserUuid() === $api_token_data['user_uuid']) {
$API_apitoken->checkPermissions('user-apitoken-self', 'RW');
} else {
if ($api_token_data['user_email'] === 'superuser') {
$API_apitoken->apiOutput(401, ['error' => 'You are not authorized to access this resource.']);
}
$API_apitoken->checkPermissions('user-apitoken-others', 'RW');
}
$API_apitoken->checkTokenPermissions();
$API_apitoken->deleteToken();

29
pub/bin/pages/portal-management/pageAccessControl_admin_view.php
View File

@@ -60,6 +60,11 @@ if ($result->num_rows == 1) {
$_GET['user_uuid'] = $user_uuid;
$userHashigherGroupWeight = false;
if ($admin_data['user_group_weight'] > $_SESSION['user']['user_group_weight']) {
$userHashigherGroupWeight = true;
};
$API_token = new API_apitoken();
$requiredFields = ['user_uuid' => ['type' => 'uuid']];
$API_token->validateData($requiredFields);
@@ -258,10 +263,13 @@ if ($admin_data) { ?>
<?php if ($API_token->checkPermissions('user-apitoken-others', 'RW', true)) { ?>
<form method="POST" action="/api/v1/user/apitoken/">
<input type="hidden" name="user_uuid" value="<?php echo $user_uuid ?>">
<input type="hidden" name="_return" value="/accesscontrol/?admin_view=<?php echo $user_uuid ?>">
<button type="submit" href="#" class="btn btn-primary">
<i class="fa-solid fa-plus"></i> Generate new token
<input type="hidden" name="_return" value="/userprofile/">
<div class="input-group mb-3">
<input type="text" name="api_token_name" class="form-control" placeholder="API Token name..." aria-label="API Token name..." aria-describedby="button-addon2" <?php echo($userHashigherGroupWeight ? '' : 'disabled') ?>>
<button type="submit" href="#" class="btn btn-success" <?php echo($userHashigherGroupWeight ? '' : 'disabled') ?>>
<i class="fa-solid fa-plus"></i> <?php echo __('generate_new_api_token') ?>
</button>
</div>
</form>
<?php } ?>
</div>
@@ -269,7 +277,8 @@ if ($admin_data) { ?>
<table class="table table-hover table-striped">
<thead>
<tr>
<th>token</th>
<th>Token id</th>
<th>Token Name</th>
<th>Expiration</th>
<th>Created</th>
<th>Last used</th>
@@ -281,23 +290,27 @@ if ($admin_data) { ?>
<tr>
<td class="text-nowrap" style="max-width: 100%;">
<div class="d-flex align-items-center gap-2" style="max-width: 100%;">
<div class="text-truncate" style="max-width: 200px;">
<?php echo substr($token_data['api_token'], 0, 15) . '...'; ?>
<div class="text-truncate" style="max-width: 200px;" id="<?php echo $token_data['api_token_uuid'] ?>" data-copy-data="<?php echo $token_data['api_token_uuid']; ?>">
<?php echo $token_data['api_token_uuid']; ?>
</div>
<button type="button" class="btn btn-sm btn-outline-secondary" data-copy-target="<?php echo $token_data['api_token_uuid'] ?>" title="Copy ID">
<i class="fa-solid fa-copy"></i>
</button>
</div>
</td>
<td><?php echo $token_data['api_token_name'] ?></td>
<td><?php showTime($token_data['api_token_expiration_timestamp']) ?></td>
<td><?php showTime($token_data['api_token_created_timestamp']) ?></td>
<td><?php showTime($token_data['api_token_last_used_timestamp']) ?></td>
<td>
<label class="switch">
<input type="checkbox" class="checkbox" data-api-data='<?php echo json_encode(['api_token_uuid' => $token_data['api_token_uuid'], 'api_token_revoked' => $token_data['api_token_revoked'] ? 1 : 0]) ?>' data-api-changevalue="api_token_revoked" data-api-url="/api/v1/user/apitoken/" <?php echo((($token_data['api_token_revoked'])) ? 'checked' : '') ?>>
<input type="checkbox" class="checkbox" data-api-data='<?php echo json_encode(['api_token_uuid' => $token_data['api_token_uuid'], 'api_token_revoked' => $token_data['api_token_revoked'] ? 1 : 0]) ?>' data-api-changevalue="api_token_revoked" data-api-url="/api/v1/user/apitoken/" <?php echo((($token_data['api_token_revoked'])) ? 'checked' : '') ?> <?php echo($userHashigherGroupWeight ? '' : 'disabled') ?>>
<div class="slider"></div>
</label>
</td>
<?php if ($API_token->checkPermissions('user-apitoken-others', 'RW', true)) { ?>
<td class="text-nowrap">
<a href="#" class="btn btn-danger btn-sm btn-rounded delete-btn" data-item-uuid="<?php echo $token_data['api_token_uuid'] ?>" data-item-name="api_token_uuid" data-api-url="/api/v1/user/apitoken/"><i class="fas fa-trash-alt"></i></a>
<a href="#" class="btn btn-danger btn-sm btn-rounded delete-btn <?php echo($userHashigherGroupWeight ? '' : 'disabled') ?>" data-item-uuid="<?php echo $token_data['api_token_uuid'] ?>" data-item-name="api_token_uuid" data-api-url="/api/v1/user/apitoken/"><i class="fas fa-trash-alt"></i></a>
</td>
<?php } ?>
</tr>

2
sql-update-1.2.2.sql
View File

@@ -1 +1 @@
ALTER TABLE `system_api_tokens` ADD COLUMN `api_token_name` CHAR(64) NOT NULL AFTER `api_token`;
ALTER TABLE `system_api_tokens` ADD COLUMN `api_token_name` CHAR(64) AFTER `api_token`;