From 99779c905350b63b88ad50483a3792667c101ea2 Mon Sep 17 00:00:00 2001
From: Miguel N <miguel456@spacejewel-hosting.com>
Date: Tue, 30 Mar 2021 01:27:49 +0100
Subject: [PATCH] API key management interface

---
 app/ApiKey.php                                |  25 ++++
 app/Http/Controllers/ApiKeyController.php     | 103 +++++++++++++++
 app/Http/Requests/CreateApiKeyRequest.php     |  30 +++++
 app/Providers/JSONProvider.php                |   1 +
 app/User.php                                  |   5 +
 config/adminlte.php                           |   5 +
 .../migrations/2021_03_29_224932_api_keys.php |  42 +++++++
 ...2021_03_29_231944_add_name_to_api_keys.php |  32 +++++
 ...03_29_232842_add_last_used_to_api_keys.php |  34 +++++
 .../views/dashboard/user/api/index.blade.php  | 118 ++++++++++++++++++
 routes/web.php                                |  14 ++-
 11 files changed, 406 insertions(+), 3 deletions(-)
 create mode 100644 app/ApiKey.php
 create mode 100644 app/Http/Controllers/ApiKeyController.php
 create mode 100644 app/Http/Requests/CreateApiKeyRequest.php
 create mode 100644 database/migrations/2021_03_29_224932_api_keys.php
 create mode 100644 database/migrations/2021_03_29_231944_add_name_to_api_keys.php
 create mode 100644 database/migrations/2021_03_29_232842_add_last_used_to_api_keys.php
 create mode 100644 resources/views/dashboard/user/api/index.blade.php

diff --git a/app/ApiKey.php b/app/ApiKey.php
new file mode 100644
index 0000000..6a97f85
--- /dev/null
+++ b/app/ApiKey.php
@@ -0,0 +1,25 @@
+<?php
+
+namespace App;
+
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+
+class ApiKey extends Model
+{
+    use HasFactory;
+
+    protected $fillable = [
+        'name',
+        'status',
+        'discriminator',
+        'last_used',
+        'secret',
+        'owner_user_id'
+    ];
+
+    public function user()
+    {
+        return $this->belongsTo('App\User', 'id');
+    }
+}
diff --git a/app/Http/Controllers/ApiKeyController.php b/app/Http/Controllers/ApiKeyController.php
new file mode 100644
index 0000000..0975df9
--- /dev/null
+++ b/app/Http/Controllers/ApiKeyController.php
@@ -0,0 +1,103 @@
+<?php
+
+namespace App\Http\Controllers;
+
+use App\ApiKey;
+use App\Http\Requests\CreateApiKeyRequest;
+use App\User;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Hash;
+
+class ApiKeyController extends Controller
+{
+    /**
+     * Display a listing of the resource.
+     *
+     */
+    public function index()
+    {
+        return view('dashboard.user.api.index')
+            ->with('keys', Auth::user()->keys);
+    }
+
+    /**
+     * Store a newly created resource in storage.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     */
+    public function store(CreateApiKeyRequest $request)
+    {
+        $discriminator = "#" . bin2hex(openssl_random_pseudo_bytes(7));
+        $secret = bin2hex(openssl_random_pseudo_bytes(32));
+
+        $key = ApiKey::create([
+            'name' => $request->keyName,
+            'discriminator' => $discriminator,
+            'secret' => Hash::make($secret),
+            'status' => 'active',
+            'owner_user_id' => Auth::user()->id
+        ]);
+
+        if ($key)
+        {
+            $request->session()->flash('success', 'Key successfully registered!');
+            $request->session()->flash('finalKey', $discriminator . '.' . $secret);
+
+            return redirect()
+                ->back();
+        }
+
+        return redirect()
+            ->back()
+            ->with('error', 'An error occurred whilst trying to create an API key.');
+    }
+
+
+   public function revokeKey(Request $request, ApiKey $key)
+   {
+       if (Auth::user()->is($key->user) || Auth::user()->hasRole('admin'))
+       {
+           if ($key->status == 'active')
+           {
+               $key->status = 'disabled';
+               $key->save();
+           }
+           else
+           {
+               return redirect()
+                   ->back()
+                   ->with('error', 'Key already revoked.');
+           }
+
+           return redirect()
+               ->back()
+               ->with('success', 'Key revoked. Apps using this key will stop working.');
+       }
+
+       return redirect()
+           ->back()
+           ->with('error', 'You do not have permission to modify this key.');
+   }
+
+    /**
+     * Remove the specified resource from storage.
+     */
+    public function destroy($id)
+    {
+        $key = ApiKey::findOrFail($id);
+
+        if (Auth::user()->is($key->user) || Auth::user()->hasRole('admin'))
+        {
+            $key->delete();
+
+            return redirect()
+                ->back()
+                ->with('success', 'Key deleted successfully. Apps using this key will stop working.');
+        }
+
+        return redirect()
+            ->back()
+            ->with('error', 'You do not have permission to modify this key.');
+    }
+}
diff --git a/app/Http/Requests/CreateApiKeyRequest.php b/app/Http/Requests/CreateApiKeyRequest.php
new file mode 100644
index 0000000..d7bf22c
--- /dev/null
+++ b/app/Http/Requests/CreateApiKeyRequest.php
@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+class CreateApiKeyRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     *
+     * @return bool
+     */
+    public function authorize()
+    {
+        return true;
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array
+     */
+    public function rules()
+    {
+        return [
+            'keyName' => 'required|string'
+        ];
+    }
+}
diff --git a/app/Providers/JSONProvider.php b/app/Providers/JSONProvider.php
index 6403201..b5ef403 100644
--- a/app/Providers/JSONProvider.php
+++ b/app/Providers/JSONProvider.php
@@ -2,6 +2,7 @@
 
 namespace App\Providers;
 
+use App;
 use App\Helpers\JSON;
 use Illuminate\Support\ServiceProvider;
 
diff --git a/app/User.php b/app/User.php
index a39fb5e..e3907ba 100755
--- a/app/User.php
+++ b/app/User.php
@@ -92,6 +92,11 @@ class User extends Authenticatable implements MustVerifyEmail
         return $this->hasMany('App\TeamFile', 'uploaded_by');
     }
 
+    public function keys()
+    {
+        return $this->hasMany('App\ApiKey', 'owner_user_id');
+    }
+
     // UTILITY LOGIC
 
     public function isBanned()
diff --git a/config/adminlte.php b/config/adminlte.php
index af5ad9e..35c930a 100755
--- a/config/adminlte.php
+++ b/config/adminlte.php
@@ -268,6 +268,11 @@ return [
             'icon' => 'fas fa-user-circle',
             'url' => '/profile/settings/account',
         ],
+        [
+            'text' => 'Programmatic Access',
+            'icon' => 'fas fa-wrench',
+            'route' => 'keys.index'
+        ],
         [
             'header' => 'h_app_management',
             'can' => ['applications.view.all', 'applications.vote'],
diff --git a/database/migrations/2021_03_29_224932_api_keys.php b/database/migrations/2021_03_29_224932_api_keys.php
new file mode 100644
index 0000000..43a990d
--- /dev/null
+++ b/database/migrations/2021_03_29_224932_api_keys.php
@@ -0,0 +1,42 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+class ApiKeys extends Migration
+{
+    /**
+     * Run the migrations.
+     *
+     * @return void
+     */
+    public function up()
+    {
+        // API keys can only access resources the owner's account can access
+        Schema::create('api_keys', function (Blueprint $table) {
+
+            $table->id();
+            $table->string('discriminator');
+            $table->string('secret');
+            $table->enum('status', ['disabled', 'active']);
+            $table->bigInteger('owner_user_id')->unsigned();
+
+            $table->foreign('owner_user_id')
+                ->references('id')
+                ->on('users')
+                ->cascadeOnDelete()
+                ->cascadeOnUpdate();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     *
+     * @return void
+     */
+    public function down()
+    {
+        //
+    }
+}
diff --git a/database/migrations/2021_03_29_231944_add_name_to_api_keys.php b/database/migrations/2021_03_29_231944_add_name_to_api_keys.php
new file mode 100644
index 0000000..3861e08
--- /dev/null
+++ b/database/migrations/2021_03_29_231944_add_name_to_api_keys.php
@@ -0,0 +1,32 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+class AddNameToApiKeys extends Migration
+{
+    /**
+     * Run the migrations.
+     *
+     * @return void
+     */
+    public function up()
+    {
+        Schema::table('api_keys', function (Blueprint $table) {
+            $table->string('name')->after('secret');
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     *
+     * @return void
+     */
+    public function down()
+    {
+        Schema::table('api_keys', function (Blueprint $table) {
+            $table->dropColumn('name');
+        });
+    }
+}
diff --git a/database/migrations/2021_03_29_232842_add_last_used_to_api_keys.php b/database/migrations/2021_03_29_232842_add_last_used_to_api_keys.php
new file mode 100644
index 0000000..9feba69
--- /dev/null
+++ b/database/migrations/2021_03_29_232842_add_last_used_to_api_keys.php
@@ -0,0 +1,34 @@
+<?php
+
+use Illuminate\Database\Migrations\Migration;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\Schema;
+
+class AddLastUsedToApiKeys extends Migration
+{
+    /**
+     * Run the migrations.
+     *
+     * @return void
+     */
+    public function up()
+    {
+        Schema::table('api_keys', function (Blueprint $table) {
+            $table->dateTime('last_used')->after('owner_user_id')->nullable();
+            $table->timestamps();
+        });
+    }
+
+    /**
+     * Reverse the migrations.
+     *
+     * @return void
+     */
+    public function down()
+    {
+        Schema::table('api_keys', function (Blueprint $table) {
+            $table->dropColumn('last_used');
+            $table->dropTimestamps();
+        });
+    }
+}
diff --git a/resources/views/dashboard/user/api/index.blade.php b/resources/views/dashboard/user/api/index.blade.php
new file mode 100644
index 0000000..4c2fe06
--- /dev/null
+++ b/resources/views/dashboard/user/api/index.blade.php
@@ -0,0 +1,118 @@
+@extends('adminlte::page')
+
+@section('title', config('app.name') . ' | ' . __('API Key Management'))
+
+@section('content_header')
+
+    <h4>Profile / Settings / API Keys</h4>
+
+@stop
+
+@section('js')
+    <x-global-errors></x-global-errors>
+@stop
+
+@section('content')
+
+    <x-modal id="createKeyModal" modal-label="createKeyModalLabel" modal-title="New API Key" include-close-button="true">
+
+        <form id="createKey" method="post" action="{{ route('keys.store') }}">
+            @csrf
+
+            <div class="form-group">
+                <label for="name">Give your new API key a name to easily identify it.</label>
+                <input type="text" name="keyName" class="form-control" id="name" required>
+            </div>
+
+        </form>
+
+        <x-slot name="modalFooter">
+            <button onclick="$('#createKey').submit()" type="button" class="btn btn-success"><i class="fas fa-key"></i> Register new key</button>
+        </x-slot>
+
+    </x-modal>
+
+    <div class="row">
+        <div class="col">
+            <div class="alert alert-warning">
+                <p><i class="fas fa-exclamation-triangle"></i> <b>Friendly reminder: </b> API keys can access your whole account and the resources it has access to. Please treat them like a password. If they are leaked, please revoke them.</p>
+            </div>
+        </div>
+    </div>
+
+    @if (session()->has('finalKey'))
+        <div class="row">
+            <div class="col">
+                <div class="alert alert-success">
+                    <p><i class="fas fa-key"></i> This is your API key: {{ session('finalKey') }}</p>
+                    <p>Please copy it <b>now</b> as it'll only appear once.</p>
+                </div>
+            </div>
+        </div>
+    @endif
+
+    <div class="row">
+        <div class="col">
+            <x-card id="keyListing" card-title="Manage API Keys" footer-style="text-center">
+
+                <x-slot name="cardHeader"></x-slot>
+
+                @if(!$keys->isEmpty())
+                    <table class="table table-borderless">
+                        <thead>
+                            <tr>
+                                <th>Key name</th>
+                                <th>Status</th>
+                                <th>Last Used</th>
+                                <th>Last Modified</th>
+                                <th>Actions</th>
+                            </tr>
+                        </thead>
+
+                        <tbody>
+
+                            @foreach($keys as $key)
+                                <tr>
+                                    <td>{{ $key->name }}</td>
+                                    <td><span class="badge badge-{{ ($key->status == 'disabled') ? 'danger' : 'primary' }}">{{ ($key->status == 'disabled') ? 'Revoked' : 'Active' }}</span></td>
+                                    <td><span class="badge badge-{{ ($key->last_used == null) ? 'danger' : 'primary' }}">{{ ($key->last_used == null) ? 'No recent activity' : $key->last_used }}</span></td>
+                                    <td><span class="badge badge-primary">{{ $key->updated_at }}</span></td>
+                                    <td>
+                                        @if ($key->status == 'active')
+                                            <form class="d-inline-block" action="{{ route('revokeKey', ['key' => $key->id]) }}" method="post">
+                                                @csrf
+                                                @method('PATCH')
+                                                <button type="submit" class="btn btn-danger btn-sm ml-2"><i class="fas fa-lock"></i> Revoke</button>
+                                            </form>
+                                        @endif
+                                        <form class="d-inline-block" action="{{ route('keys.destroy', ['key' => $key->id]) }}" method="post">
+                                            @csrf
+                                            @method('DELETE')
+                                            <button type="submit" class="btn btn-danger btn-sm ml-2"><i class="fas fa-trash"></i> Delete</button>
+                                        </form>
+                                    </td>
+                                </tr>
+                            @endforeach
+
+                        </tbody>
+                    </table>
+                @else
+                    <div class="alert alert-success">
+                        <p><i class="fa fa-info-circle"></i> You don't have any API keys yet.</p>
+                    </div>
+                @endif
+
+                <x-slot name="cardFooter">
+                    <button onclick="$('#createKeyModal').modal('show')" type="button" class="btn btn-secondary"><i class="fas fa-plus"></i> New API Key</button>
+                </x-slot>
+
+            </x-card>
+        </div>
+    </div>
+
+@stop
+
+
+@section('footer')
+    @include('breadcrumbs.dashboard.footer')
+@stop
diff --git a/routes/web.php b/routes/web.php
index b13425b..3132a3b 100755
--- a/routes/web.php
+++ b/routes/web.php
@@ -19,6 +19,7 @@
  *     along with Raspberry Staff Manager.  If not, see <https://www.gnu.org/licenses/>.
  */
 
+use App\Http\Controllers\ApiKeyController;
 use App\Http\Controllers\ApplicationController;
 use App\Http\Controllers\AppointmentController;
 use App\Http\Controllers\Auth\TwofaController;
@@ -68,11 +69,11 @@ Route::group(['prefix' => LaravelLocalization::setLocale(), 'middleware' => ['lo
         ->name('processDeleteConfirmation');
 
     Route::group(['middleware' => ['auth', 'forcelogout', 'passwordexpiration', '2fa', 'verified']], function () {
-        
+
 
 
         Route::group(['middleware' => ['passwordredirect']], function(){
-           
+
             Route::get('/dashboard', [DashboardController::class, 'index'])
             ->name('dashboard')
             ->middleware('eligibility');
@@ -107,7 +108,7 @@ Route::group(['prefix' => LaravelLocalization::setLocale(), 'middleware' => ['lo
 
             Route::get('team/files/{teamFile}/download', [TeamFileController::class, 'download'])
                 ->name('downloadTeamFile');
-            
+
         });
 
         Route::group(['prefix' => '/applications', 'middleware' => ['passwordredirect']], function () {
@@ -163,6 +164,13 @@ Route::group(['prefix' => LaravelLocalization::setLocale(), 'middleware' => ['lo
                 ->name('showProfileSettings')
                 ->middleware('passwordredirect');
 
+            Route::resource('keys', ApiKeyController::class)
+                ->middleware('passwordredirect');
+
+            Route::patch('keys/revoke/{key}', [ApiKeyController::class, 'revokeKey'])
+                ->name('revokeKey')
+                ->middleware('passwordredirect');
+
             Route::patch('/settings/save', [ProfileController::class, 'saveProfile'])
                 ->name('saveProfileSettings')
                 ->middleware('passwordredirect');