API Resources and first endpoints

app/Http/Controllers/ApiKeyController.php

@@ -11,29 +11,13 @@ use Illuminate\Support\Facades\Hash;
 
 class ApiKeyController extends Controller
 {
-    /**
-     * Display a listing of the resource.
-     *
-     */
+
     public function index()
     {
-        return view('dashboard.user.api.index')
-            ->with('keys', Auth::user()->keys);
-    }
+        $this->authorize('viewAny', ApiKey::class);
 
-    public function adminKeys()
-    {
-        if (Auth::user()->hasRole('admin'))
-        {
-            return view('dashboard.administration.keys')
-                ->with('keys', ApiKey::all());
-        }
-        else
-        {
-            return redirect()
-                ->back()
-                ->with('error', 'You do not have permission to access this page.');
-        }
+        return view('dashboard.administration.keys')
+            ->with('keys', ApiKey::all());
     }
 
     /**
@@ -43,6 +27,8 @@ class ApiKeyController extends Controller
      */
     public function store(CreateApiKeyRequest $request)
     {
+        $this->authorize('create', ApiKey::class);
+
         $discriminator = "#" . bin2hex(openssl_random_pseudo_bytes(7));
         $secret = bin2hex(openssl_random_pseudo_bytes(32));
 
@@ -71,28 +57,24 @@ class ApiKeyController extends Controller
 
    public function revokeKey(Request $request, ApiKey $key)
    {
-       if (Auth::user()->is($key->user) || Auth::user()->hasRole('admin'))
-       {
-           if ($key->status == 'active')
-           {
-               $key->status = 'disabled';
-               $key->save();
-           }
-           else
-           {
-               return redirect()
-                   ->back()
-                   ->with('error', 'Key already revoked.');
-           }
+       $this->authorize('update', $key);
 
+       if ($key->status == 'active')
+       {
+           $key->status = 'disabled';
+           $key->save();
+       }
+       else
+       {
            return redirect()
                ->back()
-               ->with('success', 'Key revoked. Apps using this key will stop working.');
+               ->with('error', 'Key already revoked.');
        }
 
        return redirect()
            ->back()
-           ->with('error', 'You do not have permission to modify this key.');
+           ->with('success', 'Key revoked. Apps using this key will stop working.');
+
    }
 
     /**
@@ -101,18 +83,13 @@ class ApiKeyController extends Controller
     public function destroy($id)
     {
         $key = ApiKey::findOrFail($id);
+        $this->authorize('delete', $key);
 
-        if (Auth::user()->is($key->user) || Auth::user()->hasRole('admin'))
-        {
-            $key->delete();
-
-            return redirect()
-                ->back()
-                ->with('success', 'Key deleted successfully. Apps using this key will stop working.');
-        }
+        $key->delete();
 
         return redirect()
             ->back()
-            ->with('error', 'You do not have permission to modify this key.');
+            ->with('success', 'Key deleted successfully. Apps using this key will stop working.');
+
     }
 }

app/Http/Controllers/ApplicationController.php

@@ -23,6 +23,7 @@ namespace App\Http\Controllers;
 
 use App\Application;
 use App\Events\ApplicationDeniedEvent;
+use App\Http\Resources\ApplicationResource;
 use App\Notifications\ApplicationMoved;
 use App\Notifications\NewApplicant;
 use App\Response;
@@ -56,39 +57,58 @@ class ApplicationController extends Controller
 
     public function showUserApp(Request $request, Application $application)
     {
-        $this->authorize('view', $application);
+        if (!$request->wantsJson())
+        {
+            $this->authorize('view', $application);
 
-        if (! is_null($application)) {
-            return view('dashboard.user.viewapp')
-                ->with(
-                    [
-                        'application' => $application,
-                        'comments' => $application->comments,
-                        'structuredResponses' => json_decode($application->response->responseData, true),
-                        'formStructure' => $application->response->form,
-                        'vacancy' => $application->response->vacancy,
-                        'canVote'  => $this->canVote($application->votes),
-                    ]
-                );
-        } else {
-            $request->session()->flash('error', 'The application you requested could not be found.');
+            if (! is_null($application)) {
+                return view('dashboard.user.viewapp')
+                    ->with(
+                        [
+                            'application' => $application,
+                            'comments' => $application->comments,
+                            'structuredResponses' => json_decode($application->response->responseData, true),
+                            'formStructure' => $application->response->form,
+                            'vacancy' => $application->response->vacancy,
+                            'canVote'  => $this->canVote($application->votes),
+                        ]
+                    );
+            } else {
+                $request->session()->flash('error', 'The application you requested could not be found.');
+            }
+
+            return redirect()->back();
         }
 
-        return redirect()->back();
+        return (new ApplicationResource($application))->additional([
+            'meta' => [
+                'code' => 200,
+                'status' => 'success'
+            ]
+        ]);
     }
 
-    public function showAllApps()
+    public function showAllApps(Request $request)
     {
-        $this->authorize('viewAny', Application::class);
+        if (!$request->wantsJson())
+        {
+            $this->authorize('viewAny', Application::class);
 
-        return view('dashboard.appmanagement.all')
-          ->with('applications', Application::paginate(6));
+            return view('dashboard.appmanagement.all')
+                ->with('applications', Application::paginate(6));
+        }
+
+
+        // todo: eager load all relationships used
+        return ApplicationResource::collection(Application::paginate(6))->additional([
+            'code' => '200',
+            'status' => 'success',
+        ]);
     }
 
 
     public function renderApplicationForm(Request $request, $vacancySlug)
     {
-        // FIXME: Get rid of references to first(), this is a wonky query
         $vacancyWithForm = Vacancy::with('forms')->where('vacancySlug', $vacancySlug)->get();
 
         $firstVacancy = $vacancyWithForm->first();
@@ -96,10 +116,8 @@ class ApplicationController extends Controller
         if (! $vacancyWithForm->isEmpty() && $firstVacancy->vacancyCount !== 0 && $firstVacancy->vacancyStatus == 'OPEN') {
             return view('dashboard.application-rendering.apply')
                 ->with([
-
                     'vacancy' => $vacancyWithForm->first(),
                     'preprocessedForm' => json_decode($vacancyWithForm->first()->forms->formStructure, true),
-
                 ]);
         } else {
             abort(404, 'The application you\'re looking for could not be found or it is currently unavailable.');

app/Http/Kernel.php

@@ -21,6 +21,7 @@
 
 namespace App\Http;
 
+use App\Http\Middleware\APIAuthenticationMiddleware;
 use Illuminate\Foundation\Http\Kernel as HttpKernel;
 
 class Kernel extends HttpKernel
@@ -60,6 +61,7 @@ class Kernel extends HttpKernel
         'api' => [
             'throttle:60,1',
             \Illuminate\Routing\Middleware\SubstituteBindings::class,
+            APIAuthenticationMiddleware::class
         ],
     ];
 

app/Http/Middleware/APIAuthenticationMiddleware.php

@@ -0,0 +1,61 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\ApiKey;
+use App\Facades\JSON;
+use Carbon\Carbon;
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Str;
+
+class APIAuthenticationMiddleware
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  \Closure  $next
+     * @return mixed
+     */
+    public function handle(Request $request, Closure $next)
+    {
+        $key = $request->bearerToken();
+
+        if (!is_null($key))
+        {
+            // we have a valid discriminator
+            $discriminator = Str::before($key, '.');
+            $loneKey = Str::after($key, '.');
+
+            $keyRecord = ApiKey::where('discriminator', $discriminator)->first();
+
+            if ($keyRecord && Hash::check($loneKey, $keyRecord->secret) && $keyRecord->status == 'active')
+            {
+                Log::alert('API Authentication Success', [
+                    'discriminator' => $discriminator
+                ]);
+
+                $keyRecord->last_used = Carbon::now();
+                $keyRecord->save();
+
+                return $next($request);
+            }
+
+            return JSON::setResponseType('error')
+                ->setStatus('authfail')
+                ->setMessage('Invalid / Revoked API key.')
+                ->setCode(401)
+                ->build();
+        }
+
+        return JSON::setResponseType('error')
+            ->setStatus('malformed_key')
+            ->setMessage('Missing or malformed API key.')
+            ->setCode(400)
+            ->build();
+
+    }
+}

app/Http/Resources/ApplicationResource.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Http\Resources;
+
+use App\Response;
+use App\User;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+class ApplicationResource extends JsonResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return array
+     */
+    public function toArray($request)
+    {
+        return [
+            'id' => $this->id,
+            'applicationStatus' => $this->applicationStatus,
+            'applicant' => new UserResource(User::findOrFail($this->applicantUserID)),
+            'response' => new ResponseResource(Response::findOrFail($this->applicantFormResponseID)),
+            'created_at' => $this->created_at,
+            'updated_at' => $this->updated_at
+        ];
+    }
+}

app/Http/Resources/AppointmentResource.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Http\Resources;
+
+use Illuminate\Http\Resources\Json\JsonResource;
+
+class AppointmentResource extends JsonResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return array
+     */
+    public function toArray($request)
+    {
+        return parent::toArray($request);
+    }
+}

app/Http/Resources/BanResource.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Http\Resources;
+
+use Illuminate\Http\Resources\Json\JsonResource;
+
+class BanResource extends JsonResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return array
+     */
+    public function toArray($request)
+    {
+        return parent::toArray($request);
+    }
+}

app/Http/Resources/FormResource.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Http\Resources;
+
+use Illuminate\Http\Resources\Json\JsonResource;
+
+class FormResource extends JsonResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return array
+     */
+    public function toArray($request)
+    {
+        return [
+            'id' => $this->id,
+            'formName' => $this->formName,
+            'formStructure' => json_decode($this->formStructure),
+            'formStatus' => $this->formStatus,
+            'created_at' => $this->created_at,
+            'updated_at' => $this->updated_at
+        ];
+    }
+}

app/Http/Resources/OptionResource.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Http\Resources;
+
+use Illuminate\Http\Resources\Json\JsonResource;
+
+class OptionResource extends JsonResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return array
+     */
+    public function toArray($request)
+    {
+        return parent::toArray($request);
+    }
+}

app/Http/Resources/ProfileResource.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Http\Resources;
+
+use Illuminate\Http\Resources\Json\JsonResource;
+
+class ProfileResource extends JsonResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return array
+     */
+    public function toArray($request)
+    {
+        return parent::toArray($request);
+    }
+}

app/Http/Resources/ResponseResource.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Http\Resources;
+
+use App\Form;
+use App\Vacancy;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+class ResponseResource extends JsonResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return array
+     */
+    public function toArray($request)
+    {
+        return [
+            'id' => $this->id,
+            'form' => new FormResource(Form::findOrFail($this->responseFormID)),
+            'responseData' => json_decode($this->responseData),
+            'vacancy' => new VacancyResource(Vacancy::findOrFail($this->associatedVacancyID)),
+            'created_at' => $this->created_at,
+            'updated_at' => $this->updated_at
+        ];
+    }
+}

app/Http/Resources/TeamFileResource.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Http\Resources;
+
+use Illuminate\Http\Resources\Json\JsonResource;
+
+class TeamFileResource extends JsonResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return array
+     */
+    public function toArray($request)
+    {
+        return parent::toArray($request);
+    }
+}

app/Http/Resources/TeamResource.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Http\Resources;
+
+use Illuminate\Http\Resources\Json\JsonResource;
+
+class TeamResource extends JsonResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return array
+     */
+    public function toArray($request)
+    {
+        return parent::toArray($request);
+    }
+}

app/Http/Resources/UserResource.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Http\Resources;
+
+use Illuminate\Http\Resources\Json\JsonResource;
+
+class UserResource extends JsonResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return array
+     */
+    public function toArray($request)
+    {
+        return [
+            'id' => $this->id,
+            'uuid' => $this->uuid,
+            'name' => $this->name,
+            'email' => $this->email,
+            'username' => $this->username,
+            'created_at' => $this->created_at,
+            'updated_at' => $this->updated_at,
+            'current_team_id' => $this->current_team_id
+        ];
+    }
+}

app/Http/Resources/VacancyResource.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Http\Resources;
+
+use Illuminate\Http\Resources\Json\JsonResource;
+
+class VacancyResource extends JsonResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return array
+     */
+    public function toArray($request)
+    {
+        return parent::toArray($request);
+    }
+}