Add user-based RBAC for API keys

API keys now run as a user and inherit that user's module, operation, and client permissions. Drops per-key client scoping and removes existing keys (must be recreated). Adds an edit modal to change a key's user.

admin/api_keys.php

@@ -9,7 +9,7 @@ require_once "includes/inc_all_admin.php";
 $sql = mysqli_query(
     $mysqli,
     "SELECT SQL_CALC_FOUND_ROWS * FROM api_keys
-    LEFT JOIN clients on api_keys.api_key_client_id = clients.client_id
+    LEFT JOIN users on api_keys.api_key_user_id = users.user_id
     WHERE (api_key_name LIKE '%$q%')
     ORDER BY $sort $order LIMIT $record_from, $record_to"
 );
@@ -80,8 +80,8 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                             </a>
                         </th>
                         <th>
-                            <a class="text-dark" href="?<?php echo $url_query_strings_sort; ?>&sort=api_key_client_id&order=<?php echo $disp; ?>">
-                                Client <?php if ($sort == 'api_key_client_id') { echo $order_icon; } ?>
+                            <a class="text-dark" href="?<?php echo $url_query_strings_sort; ?>&sort=api_key_user_id&order=<?php echo $disp; ?>">
+                                User <?php if ($sort == 'api_key_user_id') { echo $order_icon; } ?>
                             </a>
                         </th>
                         <th>
@@ -115,11 +115,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                             $api_key_expire = $api_key_expire . " (Expired)";
                         }
 
-                        if ($row['api_key_client_id'] == 0) {
-                            $api_key_client = "<i>All Clients</i>";
-                        } else {
-                            $api_key_client = escapeHtml($row['client_name']);
-                        }
+                        $api_key_user = !empty($row['user_name']) ? escapeHtml($row['user_name']) : "<i>None</i>";
 
                         ?>
                         <tr>
@@ -129,7 +125,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                 </div>
                             </td>
                             <td class="text-bold"><?php echo $api_key_name; ?></td>
-                            <td><?php echo $api_key_client; ?></td>
+                            <td><?php echo $api_key_user; ?></td>
                             <td><?php echo $api_key_secret; ?></td>
                             <td><?php echo $api_key_created_at; ?></td>
                             <td><?php echo $api_key_expire; ?></td>
@@ -139,6 +135,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
                                         <i class="fas fa-ellipsis-h"></i>
                                     </button>
                                     <div class="dropdown-menu">
+                                        <a class="dropdown-item ajax-modal" href="#" data-modal-url="modals/api/api_key_edit.php?id=<?php echo $api_key_id; ?>">
+                                            <i class="fas fa-fw fa-edit mr-2"></i>Edit
+                                        </a>
                                         <?php if ($api_key_expire > date("Y-m-d H:i:s")) { ?>
                                             <a class="dropdown-item text-danger text-bold confirm-link" href="post.php?revoke_api_key=<?php echo $api_key_id; ?>&csrf_token=<?php echo $_SESSION['csrf_token'] ?>">
                                                 <i class="fas fa-fw fa-times mr-2"></i>Revoke

admin/database_updates/2.4.7.php

@@ -0,0 +1,18 @@
+<?php
+
+/*
+ * ITFlow - Database update to version 2.4.7 (from 2.4.6)
+ * Included by admin/database_updates.php - do not access directly
+ */
+
+defined('FROM_DB_UPDATER') || die("Direct file access is not allowed");
+
+    // API keys now run as a user and inherit that user's RBAC (module / operation / client).
+    // Existing keys predate this and can't be safely mapped to a user, so they are removed
+    // and must be recreated with an owning user.
+    mysqli_query($mysqli, "DELETE FROM api_keys");
+
+    // Tie keys to a user; client access now derives from that user, so the old per-key
+    // client scope is removed.
+    mysqli_query($mysqli, "ALTER TABLE `api_keys` ADD COLUMN `api_key_user_id` INT(11) NOT NULL DEFAULT 0");
+    mysqli_query($mysqli, "ALTER TABLE `api_keys` DROP COLUMN `api_key_client_id`");

admin/modals/api/api_key_add.php

@@ -55,22 +55,23 @@ ob_start();
                 </div>
 
                 <div class="form-group">
-                    <label>Client Access <strong class="text-danger">*</strong></label>
+                    <label>Run as User <strong class="text-danger">*</strong></label>
                     <div class="input-group">
                         <div class="input-group-prepend">
-                            <span class="input-group-text"><i class="fa fa-fw fa-user"></i></span>
+                            <span class="input-group-text"><i class="fa fa-fw fa-user-shield"></i></span>
                         </div>
-                        <select class="form-control select2" name="client" required>
-                            <option value="0"> ALL CLIENTS </option>
+                        <select class="form-control select2" name="run_as_user" required>
+                            <option value="">- Select a user -</option>
                             <?php
-                            $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
-                            while ($row = mysqli_fetch_assoc($sql)) {
-                                $client_id = intval($row['client_id']);
-                                $client_name = escapeHtml($row['client_name']); ?>
-                                <option value="<?php echo $client_id; ?>"><?php echo "$client_name  (Client ID: $client_id)"; ?></option>
+                            $sql_run_users = mysqli_query($mysqli, "SELECT user_id, user_name FROM users WHERE user_type = 1 AND user_status = 1 AND user_archived_at IS NULL ORDER BY user_name ASC");
+                            while ($run_user = mysqli_fetch_assoc($sql_run_users)) {
+                                $run_user_id = intval($run_user['user_id']);
+                                $run_user_name = escapeHtml($run_user['user_name']); ?>
+                                <option value="<?php echo $run_user_id; ?>"><?php echo $run_user_name; ?></option>
                             <?php } ?>
                         </select>
                     </div>
+                    <small class="form-text text-muted">The key inherits this user's module permissions and client access.</small>
                 </div>
             </div>
 

admin/modals/api/api_key_edit.php

@@ -0,0 +1,79 @@
+<?php
+
+require_once '../../../includes/modal_header.php';
+
+$api_key_id = intval($_GET['id']);
+
+$sql = mysqli_query($mysqli, "SELECT * FROM api_keys WHERE api_key_id = $api_key_id LIMIT 1");
+$row = mysqli_fetch_assoc($sql);
+$api_key_name = escapeHtml($row['api_key_name']);
+$api_key_expire = escapeHtml($row['api_key_expire']);
+$api_key_user_id = intval($row['api_key_user_id']);
+
+ob_start();
+?>
+
+<div class="modal-header bg-dark">
+    <h5 class="modal-title"><i class="fas fa-fw fa-key mr-2"></i>Editing API Key:
+        <strong><?php echo $api_key_name; ?></strong></h5>
+    <button type="button" class="close text-white" data-dismiss="modal">
+        <span>&times;</span>
+    </button>
+</div>
+<form action="post.php" method="post" autocomplete="off">
+    <div class="modal-body">
+
+        <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
+        <input type="hidden" name="api_key_id" value="<?php echo $api_key_id; ?>">
+
+        <div class="form-group">
+            <label>Name <strong class="text-danger">*</strong></label>
+            <div class="input-group">
+                <div class="input-group-prepend">
+                    <span class="input-group-text"><i class="fa fa-fw fa-sticky-note"></i></span>
+                </div>
+                <input type="text" class="form-control" name="name" placeholder="Key Name" maxlength="255"
+                       value="<?php echo $api_key_name; ?>" required autofocus>
+            </div>
+        </div>
+
+        <div class="form-group">
+            <label>Expiration Date <strong class="text-danger">*</strong></label>
+            <div class="input-group">
+                <div class="input-group-prepend">
+                    <span class="input-group-text"><i class="fa fa-fw fa-calendar"></i></span>
+                </div>
+                <input type="date" class="form-control" name="expire" min="<?php echo date('Y-m-d')?>" max="2999-12-31"
+                       value="<?php echo $api_key_expire; ?>" required>
+            </div>
+        </div>
+
+        <div class="form-group">
+            <label>Run as User <strong class="text-danger">*</strong></label>
+            <div class="input-group">
+                <div class="input-group-prepend">
+                    <span class="input-group-text"><i class="fa fa-fw fa-user-shield"></i></span>
+                </div>
+                <select class="form-control select2" name="run_as_user" required>
+                    <option value="">- Select a user -</option>
+                    <?php
+                    $sql_run_users = mysqli_query($mysqli, "SELECT user_id, user_name FROM users WHERE user_type = 1 AND user_status = 1 AND user_archived_at IS NULL ORDER BY user_name ASC");
+                    while ($run_user = mysqli_fetch_assoc($sql_run_users)) {
+                        $run_user_id = intval($run_user['user_id']);
+                        $run_user_name = escapeHtml($run_user['user_name']); ?>
+                        <option value="<?php echo $run_user_id; ?>" <?php if ($run_user_id == $api_key_user_id) { echo "selected"; } ?>><?php echo $run_user_name; ?></option>
+                    <?php } ?>
+                </select>
+            </div>
+            <small class="form-text text-muted">The key inherits this user's module permissions and client access.</small>
+        </div>
+
+    </div>
+    <div class="modal-footer">
+        <button type="submit" name="edit_api_key" class="btn btn-primary text-bold"><i class="fas fa-check mr-2"></i>Save</button>
+        <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fas fa-times mr-2"></i>Cancel</button>
+    </div>
+</form>
+
+<?php
+require_once "../../../includes/modal_footer.php";

admin/post/api_keys.php

@@ -12,17 +12,17 @@ if (isset($_POST['add_api_key'])) {
 
     $name = escapeSql($_POST['name']);
     $expire = escapeSql($_POST['expire']);
-    $client_id = intval($_POST['client']);
+    $user_id = intval($_POST['run_as_user']);
     $secret = escapeSql($_POST['key']); // API Key
 
     // Credential decryption password
     $apikey_specific_encryption_ciphertext = encryptUserSpecificKey(trim($_POST['password']));
 
-    mysqli_query($mysqli,"INSERT INTO api_keys SET api_key_name = '$name', api_key_secret = '$secret', api_key_decrypt_hash = '$apikey_specific_encryption_ciphertext', api_key_expire = '$expire', api_key_client_id = $client_id");
+    mysqli_query($mysqli,"INSERT INTO api_keys SET api_key_name = '$name', api_key_secret = '$secret', api_key_decrypt_hash = '$apikey_specific_encryption_ciphertext', api_key_expire = '$expire', api_key_user_id = $user_id");
 
     $api_key_id = mysqli_insert_id($mysqli);
 
-    logAudit("API Key", "Create", "$session_name created API key $name set to expire on $expire", $client_id, $api_key_id);
+    logAudit("API Key", "Create", "$session_name created API key $name set to expire on $expire", 0, $api_key_id);
 
     flashAlert("API Key <strong>$name</strong> created");
 
@@ -30,6 +30,25 @@ if (isset($_POST['add_api_key'])) {
 
 }
 
+if (isset($_POST['edit_api_key'])) {
+
+    validateCSRFToken();
+
+    $api_key_id = intval($_POST['api_key_id']);
+    $name = escapeSql($_POST['name']);
+    $expire = escapeSql($_POST['expire']);
+    $user_id = intval($_POST['run_as_user']);
+
+    mysqli_query($mysqli,"UPDATE api_keys SET api_key_name = '$name', api_key_expire = '$expire', api_key_user_id = $user_id WHERE api_key_id = $api_key_id");
+
+    logAudit("API Key", "Edit", "$session_name edited API key $name", 0, $api_key_id);
+
+    flashAlert("API Key <strong>$name</strong> updated");
+
+    redirect();
+
+}
+
 if (isset($_GET['revoke_api_key'])) {
 
     validateCSRFToken();
@@ -37,13 +56,12 @@ if (isset($_GET['revoke_api_key'])) {
     $api_key_id = intval($_GET['revoke_api_key']);
 
     // Get API Key Name
-    $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name, api_key_client_id FROM api_keys WHERE api_key_id = $api_key_id"));
+    $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name FROM api_keys WHERE api_key_id = $api_key_id"));
     $api_key_name = escapeSql($row['api_key_name']);
-    $client_id = intval($row['api_key_client_id']);
 
     mysqli_query($mysqli,"UPDATE api_keys SET api_key_expire = NOW() WHERE api_key_id = $api_key_id");
 
-    logAudit("API Key", "Revoke", "$session_name revoked API key $name", $client_id);
+    logAudit("API Key", "Revoke", "$session_name revoked API key $name", 0);
 
     flashAlert("API Key <strong>$name</strong> revoked", 'error');
 
@@ -58,13 +76,12 @@ if (isset($_GET['delete_api_key'])) {
     $api_key_id = intval($_GET['delete_api_key']);
 
     // Get API Key Name
-    $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name, api_key_client_id FROM api_keys WHERE api_key_id = $api_key_id"));
+    $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name FROM api_keys WHERE api_key_id = $api_key_id"));
     $api_key_name = escapeSql($row['api_key_name']);
-    $client_id = intval($row['api_key_client_id']);
 
     mysqli_query($mysqli,"DELETE FROM api_keys WHERE api_key_id = $api_key_id");
 
-    logAudit("API Key", "Delete", "$session_name deleted API key $name", $client_id);
+    logAudit("API Key", "Delete", "$session_name deleted API key $name", 0);
 
     flashAlert("API Key <strong>$name</strong> deleted", 'error');
 
@@ -86,13 +103,12 @@ if (isset($_POST['bulk_delete_api_keys'])) {
             $api_key_id = intval($api_key_id);
 
             // Get API Key Name
-            $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name, api_key_client_id FROM api_keys WHERE api_key_id = $api_key_id"));
+            $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name FROM api_keys WHERE api_key_id = $api_key_id"));
             $api_key_name = escapeSql($row['api_key_name']);
-            $client_id = intval($row['api_key_client_id']);
 
             mysqli_query($mysqli, "DELETE FROM api_keys WHERE api_key_id = $api_key_id");
 
-            logAudit("API Key", "Delete", "$session_name deleted API key $name", $client_id);
+            logAudit("API Key", "Delete", "$session_name deleted API key $name", 0);
 
         }
 

agent/post/client.php

@@ -394,7 +394,6 @@ if (isset($_GET['delete_client'])) {
 
     // Delete Associations
     // Delete Client Data
-    mysqli_query($mysqli, "DELETE FROM api_keys WHERE api_key_client_id = $client_id");
     mysqli_query($mysqli, "DELETE FROM certificates WHERE certificate_client_id = $client_id");
     mysqli_query($mysqli, "DELETE FROM documents WHERE document_client_id = $client_id");
 

api/v1/assets/read.php

@@ -8,41 +8,41 @@ require_once '../require_get_method.php';
 // Asset via ID (single)
 if (isset($_GET['asset_id'])) {
     $id = intval($_GET['asset_id']);
-    $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_id = $id AND asset_client_id LIKE '$client_id'");
+    $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_id = $id AND 1=1 " . apiClientScopeSql('asset_client_id') . "");
 
 } elseif (isset($_GET['asset_type'])) {
     // Asset query via type
     $type = mysqli_real_escape_string($mysqli, ucfirst($_GET['asset_type']));
-    $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_type = '$type' AND asset_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_type = '$type' AND 1=1 " . apiClientScopeSql('asset_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset");
 
 } elseif (isset($_GET['asset_name'])) {
     // Asset query via name
     $name = mysqli_real_escape_string($mysqli, $_GET['asset_name']);
-    $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_name = '$name' AND asset_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_name = '$name' AND 1=1 " . apiClientScopeSql('asset_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset");
 
 } elseif (isset($_GET['asset_serial'])) {
     // Asset query via serial
     $serial = mysqli_real_escape_string($mysqli, $_GET['asset_serial']);
-    $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_serial = '$serial' AND asset_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_serial = '$serial' AND 1=1 " . apiClientScopeSql('asset_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset");
 
 } elseif (isset($_GET['asset_mac'])) {
     // Asset query via mac
     $mac = mysqli_real_escape_string($mysqli, $_GET['asset_mac']);
-    $sql = mysqli_query($mysqli, "SELECT * FROM assets LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1 WHERE interface_mac = '$mac' AND asset_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM assets LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1 WHERE interface_mac = '$mac' AND 1=1 " . apiClientScopeSql('asset_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset");
 
 } elseif (isset($_GET['asset_uri'])) {
     // Asset query via uri
     $uri = mysqli_real_escape_string($mysqli, $_GET['asset_uri']);
-    $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_uri = '$uri' AND asset_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_uri = '$uri' AND 1=1 " . apiClientScopeSql('asset_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset");
 
 } elseif (isset($_GET['asset_uri_2'])) {
     // Asset query via uri2
     $uri2 = mysqli_real_escape_string($mysqli, $_GET['asset_uri_2']);
-    $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_uri_2 = '$uri2' AND asset_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_uri_2 = '$uri2' AND 1=1 " . apiClientScopeSql('asset_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset");
 
 }else {
     // All assets (by client ID or all in general if key permits)
-    $sql = mysqli_query($mysqli, "SELECT * FROM assets LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1 WHERE asset_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM assets LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1 WHERE 1=1 " . apiClientScopeSql('asset_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset");
 }
 
 // Output

api/v1/certificates/read.php

@@ -8,16 +8,16 @@ require_once '../require_get_method.php';
 // Specific certificate via ID (single)
 if (isset($_GET['certificate_id'])) {
     $id = intval($_GET['certificate_id']);
-    $sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_id = '$id' AND certificate_client_id LIKE '$client_id'");
+    $sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_id = '$id' AND 1=1 " . apiClientScopeSql('certificate_client_id') . "");
 
 } elseif (isset($_GET['certificate_name'])) {
     // Certificate by name
     $name = mysqli_real_escape_string($mysqli, $_GET['certificate_name']);
-    $sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_name = '$name' AND certificate_client_id LIKE '$client_id' ORDER BY certificate_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_name = '$name' AND 1=1 " . apiClientScopeSql('certificate_client_id') . " ORDER BY certificate_id LIMIT $limit OFFSET $offset");
 
 } else {
     // All certificates (by client ID or all in general if key permits)
-    $sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_client_id LIKE '$client_id' ORDER BY certificate_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE 1=1 " . apiClientScopeSql('certificate_client_id') . " ORDER BY certificate_id LIMIT $limit OFFSET $offset");
 }
 
 // Output

api/v1/contacts/read.php

@@ -8,21 +8,21 @@ require_once '../require_get_method.php';
 // Specific contact via ID (single)
 if (isset($_GET['contact_id'])) {
     $id = intval($_GET['contact_id']);
-    $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_id = '$id' AND contact_client_id LIKE '$client_id'");
+    $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_id = '$id' AND 1=1 " . apiClientScopeSql('contact_client_id') . "");
 
 } elseif (isset($_GET['contact_email'])) {
     // Specific contact via email (single)
     $email = mysqli_real_escape_string($mysqli, $_GET['contact_email']);
-    $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_email = '$email' AND contact_client_id LIKE '$client_id'");
+    $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_email = '$email' AND 1=1 " . apiClientScopeSql('contact_client_id') . "");
 
 } elseif (isset($_GET['contact_phone_or_mobile'])) {
     // Specific contact via phone number or mobile (single)
     $phone_or_mob = mysqli_real_escape_string($mysqli, $_GET['contact_phone_or_mobile']);
-    $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_mobile = '$phone_or_mob' OR contact_phone = '$phone_or_mob' AND contact_client_id LIKE '$client_id' LIMIT 1");
+    $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_mobile = '$phone_or_mob' OR contact_phone = '$phone_or_mob' AND 1=1 " . apiClientScopeSql('contact_client_id') . " LIMIT 1");
 
 } else {
     // All contacts (by client ID, or all in general if key permits)
-    $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_client_id LIKE '$client_id' ORDER BY contact_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE 1=1 " . apiClientScopeSql('contact_client_id') . " ORDER BY contact_id LIMIT $limit OFFSET $offset");
 }
 
 // Output

api/v1/credentials/read.php

@@ -17,13 +17,13 @@ if (isset($_GET['credential_id']) && !empty($api_key_decrypt_password)) {
 
     $id = intval($_GET['credential_id']);
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_id = '$id' AND credential_client_id LIKE '$client_id' LIMIT 1");
+    $sql = mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_id = '$id' AND 1=1 " . apiClientScopeSql('credential_client_id') . " LIMIT 1");
 
 
 } elseif (!empty($api_key_decrypt_password)) {
     // All credentials ("credentials")
 
-    $sql = mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_client_id LIKE '$client_id' ORDER BY credential_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM credentials WHERE 1=1 " . apiClientScopeSql('credential_client_id') . " ORDER BY credential_id LIMIT $limit OFFSET $offset");
 
 }
 

api/v1/documents/read.php

@@ -8,11 +8,11 @@ require_once '../require_get_method.php';
 if (isset($_GET['document_id'])) {
     // Document via ID (single)
     $id = intval($_GET['document_id']);
-    $sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_id = '$id' AND document_client_id LIKE '$client_id'");
+    $sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_id = '$id' AND 1=1 " . apiClientScopeSql('document_client_id') . "");
 
 } else {
     // All documents (by client ID if given, or all in general if key permits)
-    $sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_client_id LIKE '$client_id' ORDER BY document_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE 1=1 " . apiClientScopeSql('document_client_id') . " ORDER BY document_id LIMIT $limit OFFSET $offset");
 }
 
 // Output

api/v1/domains/read.php

@@ -8,16 +8,16 @@ require_once '../require_get_method.php';
 // Specific domain via ID (single)
 if (isset($_GET['domain_id'])) {
     $id = intval($_GET['domain_id']);
-    $sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_id = '$id' AND domain_client_id LIKE '$client_id'");
+    $sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_id = '$id' AND 1=1 " . apiClientScopeSql('domain_client_id') . "");
 
 } elseif (isset($_GET['domain_name'])) {
     // Domain by name
     $name = mysqli_real_escape_string($mysqli, $_GET['domain_name']);
-    $sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_name = '$name' AND domain_client_id LIKE '$client_id' ORDER BY domain_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_name = '$name' AND 1=1 " . apiClientScopeSql('domain_client_id') . " ORDER BY domain_id LIMIT $limit OFFSET $offset");
 
 } else {
     // All domains (by client ID or all in general if key permits)
-    $sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_client_id LIKE '$client_id' ORDER BY domain_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE 1=1 " . apiClientScopeSql('domain_client_id') . " ORDER BY domain_id LIMIT $limit OFFSET $offset");
 }
 
 // Output

api/v1/enforce_api_rbac.php

@@ -0,0 +1,173 @@
+<?php
+
+/*
+ * API - enforce_api_rbac.php
+ *
+ * Every API key runs as a user (api_key_user_id). This loads that user's role and
+ * client access, then enforces the SAME permissions the UI uses:
+ *   - module + operation (read/write/full) via lookupUserPermission()
+ *   - client access via the user's allow / deny lists
+ *
+ * There is no per-key client scope anymore - client access derives entirely from
+ * the user. Reads are scoped with apiClientScopeSql(); writes act on a single
+ * target client supplied in the request and validated against the user's access.
+ *
+ * Reuses the existing RBAC machinery so there is no parallel permission model.
+ * Included by validate_api_key.php - runs in global scope with $mysqli,
+ * $api_key_user_id and $return_arr available.
+ */
+
+// --- Helpers (defined first so they exist for the endpoint that includes us) ---
+
+// JSON 403 + stop.
+function apiDeny($message) {
+    global $return_arr;
+    $return_arr['success'] = "False";
+    $return_arr['message'] = $message;
+    header("HTTP/1.1 403 Forbidden");
+    echo json_encode($return_arr);
+    exit();
+}
+
+// Can the signed-in (key's) user access this single client? Mirrors enforceClientAccess:
+// admin -> yes; explicit deny -> no; otherwise allowed if in the allow list or the
+// user has no allow list (unrestricted).
+function apiUserCanAccessClient($client_id) {
+    global $session_is_admin, $client_access_array, $client_deny_array;
+    $client_id = intval($client_id);
+    if ($session_is_admin) {
+        return true;
+    }
+    if (in_array($client_id, $client_deny_array, true)) {
+        return false;
+    }
+    return empty($client_access_array) || in_array($client_id, $client_access_array, true);
+}
+
+// Client-scope SQL fragment for a read query, from the user's allow / deny lists.
+// Admin and unrestricted users get no restriction. Column-aware, so it works on any
+// resource. Returns " AND ..." or "" (used after a "WHERE 1=1" anchor).
+function apiClientScopeSql($column) {
+    global $session_is_admin, $client_access_array, $client_deny_array;
+    if ($session_is_admin) {
+        return '';
+    }
+    if (empty($client_access_array) && empty($client_deny_array)) {
+        return ''; // unrestricted user - all clients
+    }
+    $sql = '';
+    if (!empty($client_access_array)) {
+        $sql .= " AND $column IN (" . implode(',', array_map('intval', $client_access_array)) . ")";
+    }
+    if (!empty($client_deny_array)) {
+        $sql .= " AND $column NOT IN (" . implode(',', array_map('intval', $client_deny_array)) . ")";
+    }
+    return $sql;
+}
+
+// --- Every key must be tied to a user (legacy keys were removed in the 2.4.7 migration) ---
+if (empty($api_key_user_id)) {
+    apiDeny("This API key is not tied to a user and is no longer valid. Please recreate it.");
+}
+
+// --- 1) Load the linked user's session context (mirrors load_user_session.php) ---
+$sql_api_user = mysqli_query($mysqli,
+    "SELECT users.user_id, user_name, user_type, user_status, user_archived_at,
+            user_role_id, role_is_admin
+     FROM users
+     LEFT JOIN user_roles ON user_role_id = role_id
+     WHERE users.user_id = $api_key_user_id
+     LIMIT 1");
+
+$api_user = $sql_api_user ? mysqli_fetch_assoc($sql_api_user) : null;
+
+// Linked user must exist, be an active agent (user_type 1), and not be archived.
+if (!$api_user
+    || intval($api_user['user_type']) !== 1
+    || intval($api_user['user_status']) !== 1
+    || $api_user['user_archived_at'] !== null) {
+    apiDeny("The user linked to this API key is inactive, archived, or invalid.");
+}
+
+$session_user_id   = intval($api_user['user_id']);
+$session_name      = escapeSql($api_user['user_name']);
+$session_user_role = intval($api_user['user_role_id']);
+$session_is_admin  = isset($api_user['role_is_admin']) && $api_user['role_is_admin'] == 1;
+
+// Load the user's client allow / deny lists.
+$client_access_array = [];
+$client_deny_array   = [];
+$sql_api_perms = mysqli_query($mysqli,
+    "SELECT client_id, permission_type FROM user_client_permissions WHERE user_id = $session_user_id");
+while ($sql_api_perms && $prow = mysqli_fetch_assoc($sql_api_perms)) {
+    if ($prow['permission_type'] === 'deny') {
+        $client_deny_array[] = (int) $prow['client_id'];
+    } else {
+        $client_access_array[] = (int) $prow['client_id'];
+    }
+}
+
+// --- 2) Enforce module + operation permission for the requested endpoint ---
+// SCRIPT_NAME is the file actually executed, so rewrites can't spoof the resource.
+$script = $_SERVER['SCRIPT_NAME'] ?? $_SERVER['PHP_SELF'] ?? '';
+$parts  = array_values(array_filter(explode('/', $script), 'strlen'));
+$n      = count($parts);
+$operation_file = $n >= 1 ? strtolower($parts[$n - 1]) : '';
+$resource       = $n >= 2 ? strtolower($parts[$n - 2]) : '';
+
+// API resource -> UI module (matches the mapping used across the app).
+$resource_module = [
+    'assets'        => 'module_support',
+    'certificates'  => 'module_support',
+    'documents'     => 'module_support',
+    'domains'       => 'module_support',
+    'networks'      => 'module_support',
+    'software'      => 'module_support',
+    'tickets'       => 'module_support',
+    'technicians'   => 'module_support',
+    'clients'       => 'module_client',
+    'contacts'      => 'module_client',
+    'locations'     => 'module_client',
+    'vendors'       => 'module_client',
+    'invoices'      => 'module_sales',
+    'invoice_items' => 'module_sales',
+    'quotes'        => 'module_sales',
+    'products'      => 'module_sales',
+    'expenses'      => 'module_financial',
+    'credentials'   => 'module_credential',
+];
+
+// Operation -> required permission level (read = 1, create/update = 2, delete = 3).
+$operation_level = [
+    'read.php'   => 1,
+    'create.php' => 2,
+    'update.php' => 2,
+    'delete.php' => 3,
+];
+
+if (!isset($resource_module[$resource])) {
+    // Fail closed: any endpoint that reaches the enforcer must map to a module. When
+    // you add a new API resource, add it to $resource_module above - that deliberate
+    // step is what brings it under RBAC, so nothing can slip through ungated.
+    apiDeny("This API resource is not mapped to a permission module.");
+}
+
+$required_level = $operation_level[$operation_file] ?? 2;
+if (lookupUserPermission($resource_module[$resource]) < $required_level) {
+    apiDeny("The user linked to this API key does not have permission for this action.");
+}
+
+// --- 3) Target client for writes: taken from the request, validated against the user ---
+// Reads ignore this and use apiClientScopeSql(). Create/update/delete act on a single
+// client the caller names (client_id in the body/query); it must be within the user's
+// access. Callers that omit it get $client_id = 0 (creates that require a client fail
+// their own !empty($client_id) guard, which is the intended "must name a client").
+$client_id = intval($_POST['client_id'] ?? $_GET['client_id'] ?? 0);
+$is_write = in_array($operation_file, ['create.php', 'update.php', 'delete.php'], true);
+if ($is_write && !apiUserCanAccessClient($client_id)) {
+    // Writes act on a single client the caller names (client_id 0 = a global record).
+    // The user must be able to access it - this also blocks a restricted user from
+    // writing global (client_id 0) records, which their access does not include.
+    apiDeny("The user linked to this API key does not have access to the target client for this write.");
+}
+// Reads ignore $client_id entirely and are scoped by apiClientScopeSql().

api/v1/invoice_items/read.php

@@ -33,7 +33,7 @@ if (isset($_GET['item_id'])) {
          FROM invoice_items ii
          INNER JOIN invoices i ON i.invoice_id = ii.item_invoice_id
          WHERE ii.item_id = '$item_id'
-           AND i.invoice_client_id LIKE '$client_id'
+           AND i.1=1 " . apiClientScopeSql('invoice_client_id') . "
          LIMIT 1"
     );
 } elseif (isset($_GET['invoice_id'])) {
@@ -44,7 +44,7 @@ if (isset($_GET['item_id'])) {
          FROM invoice_items ii
          INNER JOIN invoices i ON i.invoice_id = ii.item_invoice_id
          WHERE ii.item_invoice_id = '$invoice_id'
-           AND i.invoice_client_id LIKE '$client_id'
+           AND i.1=1 " . apiClientScopeSql('invoice_client_id') . "
          ORDER BY ii.item_order ASC, ii.item_id ASC
          LIMIT $limit OFFSET $offset"
     );

api/v1/invoices/read.php

@@ -8,11 +8,11 @@ require_once '../require_get_method.php';
 if (isset($_GET['invoice_id'])) {
     // Invoice via ID (single)
     $id = intval($_GET['invoice_id']);
-    $sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_id = '$id' AND invoice_client_id LIKE '$client_id'");
+    $sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_id = '$id' AND 1=1 " . apiClientScopeSql('invoice_client_id') . "");
 
 } else {
     // All invoices (by client ID if given, or all in general if key permits)
-    $sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_client_id LIKE '$client_id' ORDER BY invoice_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE 1=1 " . apiClientScopeSql('invoice_client_id') . " ORDER BY invoice_id LIMIT $limit OFFSET $offset");
 }
 
 // Output

api/v1/locations/read.php

@@ -8,11 +8,11 @@ require_once '../require_get_method.php';
 if (isset($_GET['location_id'])) {
     // Location via ID (single)
     $id = intval($_GET['location_id']);
-    $sql = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_id = '$id' AND location_client_id LIKE '$client_id'");
+    $sql = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_id = '$id' AND 1=1 " . apiClientScopeSql('location_client_id') . "");
 
 } else {
     // All locations (by client ID if given, or all in general if key permits)
-    $sql = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_client_id LIKE '$client_id' ORDER BY location_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM locations WHERE 1=1 " . apiClientScopeSql('location_client_id') . " ORDER BY location_id LIMIT $limit OFFSET $offset");
 }
 
 // Output

api/v1/networks/read.php

@@ -8,16 +8,16 @@ require_once '../require_get_method.php';
 // Specific network via ID (single)
 if (isset($_GET['network_id'])) {
     $id = intval($_GET['network_id']);
-    $sql = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_id = '$id' AND network_client_id LIKE '$client_id'");
+    $sql = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_id = '$id' AND 1=1 " . apiClientScopeSql('network_client_id') . "");
 
 } elseif (isset($_GET['network_name'])) {
     // Network by name
     $name = mysqli_real_escape_string($mysqli, $_GET['network_name']);
-    $sql = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_name = '$name' AND network_client_id LIKE '$client_id' ORDER BY network_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_name = '$name' AND 1=1 " . apiClientScopeSql('network_client_id') . " ORDER BY network_id LIMIT $limit OFFSET $offset");
 
 } else {
     // All networks (by client ID or all in general if key permits)
-    $sql = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_client_id LIKE '$client_id' ORDER BY network_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM networks WHERE 1=1 " . apiClientScopeSql('network_client_id') . " ORDER BY network_id LIMIT $limit OFFSET $offset");
 }
 
 // Output

api/v1/quotes/read.php

@@ -12,7 +12,7 @@ if (isset($_GET['quote_id'])) {
 
 } else {
     // All quotes (by client ID if given, or all in general if key permits)
-    $sql = mysqli_query($mysqli, "SELECT * FROM quotes WHERE quote_client_id LIKE '$client_id' ORDER BY quote_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM quotes WHERE 1=1 " . apiClientScopeSql('quote_client_id') . " ORDER BY quote_id LIMIT $limit OFFSET $offset");
 }
 
 // Output

api/v1/software/read.php

@@ -8,26 +8,26 @@ require_once '../require_get_method.php';
 // Specific software via ID (single)
 if (isset($_GET['software_id'])) {
     $id = intval($_GET['software_id']);
-    $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_id = '$id' AND software_client_id LIKE '$client_id'");
+    $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_id = '$id' AND 1=1 " . apiClientScopeSql('software_client_id') . "");
 
 } elseif (isset($_GET['software_key'])) {
     // Specific software via key
     $key = mysqli_real_escape_string($mysqli, $_GET['software_license']);
-    $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_key = '$key' AND software_client_id LIKE '$client_id' ORDER BY software_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_key = '$key' AND 1=1 " . apiClientScopeSql('software_client_id') . " ORDER BY software_id LIMIT $limit OFFSET $offset");
 
 } elseif (isset($_GET['software_name'])) {
     // Software by name
     $name = mysqli_real_escape_string($mysqli, $_GET['software_name']);
-    $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_name = '$name' AND software_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_name = '$name' AND 1=1 " . apiClientScopeSql('software_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset");
 
 } elseif (isset($_GET['software_type'])) {
     // Software via type
     $type = intval($_GET['software_type']);
-    $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_type = '$type' AND software_client_id LIKE '$client_id' ORDER BY software_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_type = '$type' AND 1=1 " . apiClientScopeSql('software_client_id') . " ORDER BY software_id LIMIT $limit OFFSET $offset");
 
 } else {
     // All software(s) (by client ID if given, or all in general if key permits)
-    $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_client_id LIKE '$client_id' ORDER BY software_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE 1=1 " . apiClientScopeSql('software_client_id') . " ORDER BY software_id LIMIT $limit OFFSET $offset");
 }
 
 // Output

api/v1/technicians/time.php

@@ -62,7 +62,7 @@ $sql = mysqli_query(
     WHERE tr.ticket_reply_time_worked IS NOT NULL
         AND tr.ticket_reply_time_worked != '00:00:00'
         AND $date_conditions
-        AND t.ticket_client_id LIKE '$client_id'
+        AND t.1=1 " . apiClientScopeSql('ticket_client_id') . "
         $technician_condition
     GROUP BY t.ticket_id, u.user_id
     ORDER BY c.client_name ASC, t.ticket_number ASC, u.user_name ASC

api/v1/tickets/read.php

@@ -12,12 +12,12 @@ if (isset($_GET['ticket_id'])) {
         $mysqli,
         "SELECT * FROM tickets
         LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
-        WHERE ticket_id = '$id' AND ticket_client_id LIKE '$client_id'"
+        WHERE ticket_id = '$id' AND 1=1 " . apiClientScopeSql('ticket_client_id') . ""
     );
 
 } else {
     // All tickets (by client ID if given, or all in general if key permits)
-    $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_client_id LIKE '$client_id' ORDER BY ticket_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE 1=1 " . apiClientScopeSql('ticket_client_id') . " ORDER BY ticket_id LIMIT $limit OFFSET $offset");
 }
 
 // Output

api/v1/validate_api_key.php

@@ -94,7 +94,7 @@ if (isset($api_key)) {
         $row = mysqli_fetch_assoc($sql);
         $api_key_name = htmlentities($row['api_key_name']);
         $api_key_decrypt_hash = $row['api_key_decrypt_hash']; // No sanitization
-        $client_id = intval($row['api_key_client_id']);
+        $api_key_user_id = intval($row['api_key_user_id']);
 
         // Set limit & offset for queries
         if (isset($_GET['limit'])) {
@@ -113,5 +113,8 @@ if (isset($api_key)) {
             $offset = 0;
         }
 
+        // When the key is tied to a user, enforce that user's RBAC (module + operation + client scope)
+        require __DIR__ . '/enforce_api_rbac.php';
+
     }
 }

api/v1/vendors/read.php

@@ -7,11 +7,11 @@ require_once '../require_get_method.php';
 // Specific vendor via their ID (single)
 if (isset($_GET['vendor_id'])) {
     $id = intval($_GET['vendor_id']);
-    $sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_id = '$id' AND vendor_client_id LIKE '$client_id'");
+    $sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_id = '$id' AND 1=1 " . apiClientScopeSql('vendor_client_id') . "");
 
 } else {
     // All Vendors (by client ID or all in general if key permits)
-    $sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_client_id LIKE '$client_id' ORDER BY vendor_id LIMIT $limit OFFSET $offset");
+    $sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE 1=1 " . apiClientScopeSql('vendor_client_id') . " ORDER BY vendor_id LIMIT $limit OFFSET $offset");
 }
 
 // Output

api_rbac_edits.patch

@@ -0,0 +1,590 @@
+diff --git a/admin/api_keys.php b/admin/api_keys.php
+index 387ae257..009f8cce 100644
+--- a/admin/api_keys.php
++++ b/admin/api_keys.php
+@@ -9,7 +9,7 @@ require_once "includes/inc_all_admin.php";
+ $sql = mysqli_query(
+     $mysqli,
+     "SELECT SQL_CALC_FOUND_ROWS * FROM api_keys
+-    LEFT JOIN clients on api_keys.api_key_client_id = clients.client_id
++    LEFT JOIN users on api_keys.api_key_user_id = users.user_id
+     WHERE (api_key_name LIKE '%$q%')
+     ORDER BY $sort $order LIMIT $record_from, $record_to"
+ );
+@@ -80,8 +80,8 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
+                             </a>
+                         </th>
+                         <th>
+-                            <a class="text-dark" href="?<?php echo $url_query_strings_sort; ?>&sort=api_key_client_id&order=<?php echo $disp; ?>">
+-                                Client <?php if ($sort == 'api_key_client_id') { echo $order_icon; } ?>
++                            <a class="text-dark" href="?<?php echo $url_query_strings_sort; ?>&sort=api_key_user_id&order=<?php echo $disp; ?>">
++                                User <?php if ($sort == 'api_key_user_id') { echo $order_icon; } ?>
+                             </a>
+                         </th>
+                         <th>
+@@ -115,11 +115,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
+                             $api_key_expire = $api_key_expire . " (Expired)";
+                         }
+ 
+-                        if ($row['api_key_client_id'] == 0) {
+-                            $api_key_client = "<i>All Clients</i>";
+-                        } else {
+-                            $api_key_client = escapeHtml($row['client_name']);
+-                        }
++                        $api_key_user = !empty($row['user_name']) ? escapeHtml($row['user_name']) : "<i>None</i>";
+ 
+                         ?>
+                         <tr>
+@@ -129,7 +125,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
+                                 </div>
+                             </td>
+                             <td class="text-bold"><?php echo $api_key_name; ?></td>
+-                            <td><?php echo $api_key_client; ?></td>
++                            <td><?php echo $api_key_user; ?></td>
+                             <td><?php echo $api_key_secret; ?></td>
+                             <td><?php echo $api_key_created_at; ?></td>
+                             <td><?php echo $api_key_expire; ?></td>
+@@ -139,6 +135,9 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
+                                         <i class="fas fa-ellipsis-h"></i>
+                                     </button>
+                                     <div class="dropdown-menu">
++                                        <a class="dropdown-item ajax-modal" href="#" data-modal-url="modals/api/api_key_edit.php?id=<?php echo $api_key_id; ?>">
++                                            <i class="fas fa-fw fa-edit mr-2"></i>Edit
++                                        </a>
+                                         <?php if ($api_key_expire > date("Y-m-d H:i:s")) { ?>
+                                             <a class="dropdown-item text-danger text-bold confirm-link" href="post.php?revoke_api_key=<?php echo $api_key_id; ?>&csrf_token=<?php echo $_SESSION['csrf_token'] ?>">
+                                                 <i class="fas fa-fw fa-times mr-2"></i>Revoke
+diff --git a/admin/modals/api/api_key_add.php b/admin/modals/api/api_key_add.php
+index bb46853a..0cb64a76 100644
+--- a/admin/modals/api/api_key_add.php
++++ b/admin/modals/api/api_key_add.php
+@@ -55,22 +55,23 @@ ob_start();
+                 </div>
+ 
+                 <div class="form-group">
+-                    <label>Client Access <strong class="text-danger">*</strong></label>
++                    <label>Run as User <strong class="text-danger">*</strong></label>
+                     <div class="input-group">
+                         <div class="input-group-prepend">
+-                            <span class="input-group-text"><i class="fa fa-fw fa-user"></i></span>
++                            <span class="input-group-text"><i class="fa fa-fw fa-user-shield"></i></span>
+                         </div>
+-                        <select class="form-control select2" name="client" required>
+-                            <option value="0"> ALL CLIENTS </option>
++                        <select class="form-control select2" name="run_as_user" required>
++                            <option value="">- Select a user -</option>
+                             <?php
+-                            $sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
+-                            while ($row = mysqli_fetch_assoc($sql)) {
+-                                $client_id = intval($row['client_id']);
+-                                $client_name = escapeHtml($row['client_name']); ?>
+-                                <option value="<?php echo $client_id; ?>"><?php echo "$client_name  (Client ID: $client_id)"; ?></option>
++                            $sql_run_users = mysqli_query($mysqli, "SELECT user_id, user_name FROM users WHERE user_type = 1 AND user_status = 1 AND user_archived_at IS NULL ORDER BY user_name ASC");
++                            while ($run_user = mysqli_fetch_assoc($sql_run_users)) {
++                                $run_user_id = intval($run_user['user_id']);
++                                $run_user_name = escapeHtml($run_user['user_name']); ?>
++                                <option value="<?php echo $run_user_id; ?>"><?php echo $run_user_name; ?></option>
+                             <?php } ?>
+                         </select>
+                     </div>
++                    <small class="form-text text-muted">The key inherits this user's module permissions and client access.</small>
+                 </div>
+             </div>
+ 
+diff --git a/admin/post/api_keys.php b/admin/post/api_keys.php
+index c36751d3..659f36c6 100644
+--- a/admin/post/api_keys.php
++++ b/admin/post/api_keys.php
+@@ -12,17 +12,17 @@ if (isset($_POST['add_api_key'])) {
+ 
+     $name = escapeSql($_POST['name']);
+     $expire = escapeSql($_POST['expire']);
+-    $client_id = intval($_POST['client']);
++    $user_id = intval($_POST['run_as_user']);
+     $secret = escapeSql($_POST['key']); // API Key
+ 
+     // Credential decryption password
+     $apikey_specific_encryption_ciphertext = encryptUserSpecificKey(trim($_POST['password']));
+ 
+-    mysqli_query($mysqli,"INSERT INTO api_keys SET api_key_name = '$name', api_key_secret = '$secret', api_key_decrypt_hash = '$apikey_specific_encryption_ciphertext', api_key_expire = '$expire', api_key_client_id = $client_id");
++    mysqli_query($mysqli,"INSERT INTO api_keys SET api_key_name = '$name', api_key_secret = '$secret', api_key_decrypt_hash = '$apikey_specific_encryption_ciphertext', api_key_expire = '$expire', api_key_user_id = $user_id");
+ 
+     $api_key_id = mysqli_insert_id($mysqli);
+ 
+-    logAudit("API Key", "Create", "$session_name created API key $name set to expire on $expire", $client_id, $api_key_id);
++    logAudit("API Key", "Create", "$session_name created API key $name set to expire on $expire", 0, $api_key_id);
+ 
+     flashAlert("API Key <strong>$name</strong> created");
+ 
+@@ -30,6 +30,25 @@ if (isset($_POST['add_api_key'])) {
+ 
+ }
+ 
++if (isset($_POST['edit_api_key'])) {
++
++    validateCSRFToken();
++
++    $api_key_id = intval($_POST['api_key_id']);
++    $name = escapeSql($_POST['name']);
++    $expire = escapeSql($_POST['expire']);
++    $user_id = intval($_POST['run_as_user']);
++
++    mysqli_query($mysqli,"UPDATE api_keys SET api_key_name = '$name', api_key_expire = '$expire', api_key_user_id = $user_id WHERE api_key_id = $api_key_id");
++
++    logAudit("API Key", "Edit", "$session_name edited API key $name", 0, $api_key_id);
++
++    flashAlert("API Key <strong>$name</strong> updated");
++
++    redirect();
++
++}
++
+ if (isset($_GET['revoke_api_key'])) {
+ 
+     validateCSRFToken();
+@@ -37,13 +56,12 @@ if (isset($_GET['revoke_api_key'])) {
+     $api_key_id = intval($_GET['revoke_api_key']);
+ 
+     // Get API Key Name
+-    $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name, api_key_client_id FROM api_keys WHERE api_key_id = $api_key_id"));
++    $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name FROM api_keys WHERE api_key_id = $api_key_id"));
+     $api_key_name = escapeSql($row['api_key_name']);
+-    $client_id = intval($row['api_key_client_id']);
+ 
+     mysqli_query($mysqli,"UPDATE api_keys SET api_key_expire = NOW() WHERE api_key_id = $api_key_id");
+ 
+-    logAudit("API Key", "Revoke", "$session_name revoked API key $name", $client_id);
++    logAudit("API Key", "Revoke", "$session_name revoked API key $name", 0);
+ 
+     flashAlert("API Key <strong>$name</strong> revoked", 'error');
+ 
+@@ -58,13 +76,12 @@ if (isset($_GET['delete_api_key'])) {
+     $api_key_id = intval($_GET['delete_api_key']);
+ 
+     // Get API Key Name
+-    $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name, api_key_client_id FROM api_keys WHERE api_key_id = $api_key_id"));
++    $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name FROM api_keys WHERE api_key_id = $api_key_id"));
+     $api_key_name = escapeSql($row['api_key_name']);
+-    $client_id = intval($row['api_key_client_id']);
+ 
+     mysqli_query($mysqli,"DELETE FROM api_keys WHERE api_key_id = $api_key_id");
+ 
+-    logAudit("API Key", "Delete", "$session_name deleted API key $name", $client_id);
++    logAudit("API Key", "Delete", "$session_name deleted API key $name", 0);
+ 
+     flashAlert("API Key <strong>$name</strong> deleted", 'error');
+ 
+@@ -86,13 +103,12 @@ if (isset($_POST['bulk_delete_api_keys'])) {
+             $api_key_id = intval($api_key_id);
+ 
+             // Get API Key Name
+-            $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name, api_key_client_id FROM api_keys WHERE api_key_id = $api_key_id"));
++            $row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name FROM api_keys WHERE api_key_id = $api_key_id"));
+             $api_key_name = escapeSql($row['api_key_name']);
+-            $client_id = intval($row['api_key_client_id']);
+ 
+             mysqli_query($mysqli, "DELETE FROM api_keys WHERE api_key_id = $api_key_id");
+ 
+-            logAudit("API Key", "Delete", "$session_name deleted API key $name", $client_id);
++            logAudit("API Key", "Delete", "$session_name deleted API key $name", 0);
+ 
+         }
+ 
+diff --git a/agent/post/client.php b/agent/post/client.php
+index 00a0050f..1a43d33f 100644
+--- a/agent/post/client.php
++++ b/agent/post/client.php
+@@ -394,7 +394,6 @@ if (isset($_GET['delete_client'])) {
+ 
+     // Delete Associations
+     // Delete Client Data
+-    mysqli_query($mysqli, "DELETE FROM api_keys WHERE api_key_client_id = $client_id");
+     mysqli_query($mysqli, "DELETE FROM certificates WHERE certificate_client_id = $client_id");
+     mysqli_query($mysqli, "DELETE FROM documents WHERE document_client_id = $client_id");
+ 
+diff --git a/api/v1/assets/read.php b/api/v1/assets/read.php
+index 1dc1d9d0..0ba013a7 100644
+--- a/api/v1/assets/read.php
++++ b/api/v1/assets/read.php
+@@ -8,41 +8,41 @@ require_once '../require_get_method.php';
+ // Asset via ID (single)
+ if (isset($_GET['asset_id'])) {
+     $id = intval($_GET['asset_id']);
+-    $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_id = $id AND asset_client_id LIKE '$client_id'");
++    $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_id = $id AND 1=1 " . apiClientScopeSql('asset_client_id') . "");
+ 
+ } elseif (isset($_GET['asset_type'])) {
+     // Asset query via type
+     $type = mysqli_real_escape_string($mysqli, ucfirst($_GET['asset_type']));
+-    $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_type = '$type' AND asset_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset");
++    $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_type = '$type' AND 1=1 " . apiClientScopeSql('asset_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset");
+ 
+ } elseif (isset($_GET['asset_name'])) {
+     // Asset query via name
+     $name = mysqli_real_escape_string($mysqli, $_GET['asset_name']);
+-    $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_name = '$name' AND asset_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset");
++    $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_name = '$name' AND 1=1 " . apiClientScopeSql('asset_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset");
+ 
+ } elseif (isset($_GET['asset_serial'])) {
+     // Asset query via serial
+     $serial = mysqli_real_escape_string($mysqli, $_GET['asset_serial']);
+-    $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_serial = '$serial' AND asset_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset");
++    $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_serial = '$serial' AND 1=1 " . apiClientScopeSql('asset_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset");
+ 
+ } elseif (isset($_GET['asset_mac'])) {
+     // Asset query via mac
+     $mac = mysqli_real_escape_string($mysqli, $_GET['asset_mac']);
+-    $sql = mysqli_query($mysqli, "SELECT * FROM assets LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1 WHERE interface_mac = '$mac' AND asset_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset");
++    $sql = mysqli_query($mysqli, "SELECT * FROM assets LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1 WHERE interface_mac = '$mac' AND 1=1 " . apiClientScopeSql('asset_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset");
+ 
+ } elseif (isset($_GET['asset_uri'])) {
+     // Asset query via uri
+     $uri = mysqli_real_escape_string($mysqli, $_GET['asset_uri']);
+-    $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_uri = '$uri' AND asset_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset");
++    $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_uri = '$uri' AND 1=1 " . apiClientScopeSql('asset_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset");
+ 
+ } elseif (isset($_GET['asset_uri_2'])) {
+     // Asset query via uri2
+     $uri2 = mysqli_real_escape_string($mysqli, $_GET['asset_uri_2']);
+-    $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_uri_2 = '$uri2' AND asset_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset");
++    $sql = mysqli_query($mysqli, "SELECT * FROM assets WHERE asset_uri_2 = '$uri2' AND 1=1 " . apiClientScopeSql('asset_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset");
+ 
+ }else {
+     // All assets (by client ID or all in general if key permits)
+-    $sql = mysqli_query($mysqli, "SELECT * FROM assets LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1 WHERE asset_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset");
++    $sql = mysqli_query($mysqli, "SELECT * FROM assets LEFT JOIN asset_interfaces ON interface_asset_id = asset_id AND interface_primary = 1 WHERE 1=1 " . apiClientScopeSql('asset_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset");
+ }
+ 
+ // Output
+diff --git a/api/v1/certificates/read.php b/api/v1/certificates/read.php
+index 7d08673c..210680b3 100644
+--- a/api/v1/certificates/read.php
++++ b/api/v1/certificates/read.php
+@@ -8,16 +8,16 @@ require_once '../require_get_method.php';
+ // Specific certificate via ID (single)
+ if (isset($_GET['certificate_id'])) {
+     $id = intval($_GET['certificate_id']);
+-    $sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_id = '$id' AND certificate_client_id LIKE '$client_id'");
++    $sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_id = '$id' AND 1=1 " . apiClientScopeSql('certificate_client_id') . "");
+ 
+ } elseif (isset($_GET['certificate_name'])) {
+     // Certificate by name
+     $name = mysqli_real_escape_string($mysqli, $_GET['certificate_name']);
+-    $sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_name = '$name' AND certificate_client_id LIKE '$client_id' ORDER BY certificate_id LIMIT $limit OFFSET $offset");
++    $sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_name = '$name' AND 1=1 " . apiClientScopeSql('certificate_client_id') . " ORDER BY certificate_id LIMIT $limit OFFSET $offset");
+ 
+ } else {
+     // All certificates (by client ID or all in general if key permits)
+-    $sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE certificate_client_id LIKE '$client_id' ORDER BY certificate_id LIMIT $limit OFFSET $offset");
++    $sql = mysqli_query($mysqli, "SELECT * FROM certificates WHERE 1=1 " . apiClientScopeSql('certificate_client_id') . " ORDER BY certificate_id LIMIT $limit OFFSET $offset");
+ }
+ 
+ // Output
+diff --git a/api/v1/contacts/read.php b/api/v1/contacts/read.php
+index 114c11dd..730e88a2 100644
+--- a/api/v1/contacts/read.php
++++ b/api/v1/contacts/read.php
+@@ -8,21 +8,21 @@ require_once '../require_get_method.php';
+ // Specific contact via ID (single)
+ if (isset($_GET['contact_id'])) {
+     $id = intval($_GET['contact_id']);
+-    $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_id = '$id' AND contact_client_id LIKE '$client_id'");
++    $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_id = '$id' AND 1=1 " . apiClientScopeSql('contact_client_id') . "");
+ 
+ } elseif (isset($_GET['contact_email'])) {
+     // Specific contact via email (single)
+     $email = mysqli_real_escape_string($mysqli, $_GET['contact_email']);
+-    $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_email = '$email' AND contact_client_id LIKE '$client_id'");
++    $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_email = '$email' AND 1=1 " . apiClientScopeSql('contact_client_id') . "");
+ 
+ } elseif (isset($_GET['contact_phone_or_mobile'])) {
+     // Specific contact via phone number or mobile (single)
+     $phone_or_mob = mysqli_real_escape_string($mysqli, $_GET['contact_phone_or_mobile']);
+-    $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_mobile = '$phone_or_mob' OR contact_phone = '$phone_or_mob' AND contact_client_id LIKE '$client_id' LIMIT 1");
++    $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_mobile = '$phone_or_mob' OR contact_phone = '$phone_or_mob' AND 1=1 " . apiClientScopeSql('contact_client_id') . " LIMIT 1");
+ 
+ } else {
+     // All contacts (by client ID, or all in general if key permits)
+-    $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE contact_client_id LIKE '$client_id' ORDER BY contact_id LIMIT $limit OFFSET $offset");
++    $sql = mysqli_query($mysqli, "SELECT * FROM contacts WHERE 1=1 " . apiClientScopeSql('contact_client_id') . " ORDER BY contact_id LIMIT $limit OFFSET $offset");
+ }
+ 
+ // Output
+diff --git a/api/v1/credentials/read.php b/api/v1/credentials/read.php
+index 6d540af3..d6bd98c0 100644
+--- a/api/v1/credentials/read.php
++++ b/api/v1/credentials/read.php
+@@ -17,13 +17,13 @@ if (isset($_GET['credential_id']) && !empty($api_key_decrypt_password)) {
+ 
+     $id = intval($_GET['credential_id']);
+ 
+-    $sql = mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_id = '$id' AND credential_client_id LIKE '$client_id' LIMIT 1");
++    $sql = mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_id = '$id' AND 1=1 " . apiClientScopeSql('credential_client_id') . " LIMIT 1");
+ 
+ 
+ } elseif (!empty($api_key_decrypt_password)) {
+     // All credentials ("credentials")
+ 
+-    $sql = mysqli_query($mysqli, "SELECT * FROM credentials WHERE credential_client_id LIKE '$client_id' ORDER BY credential_id LIMIT $limit OFFSET $offset");
++    $sql = mysqli_query($mysqli, "SELECT * FROM credentials WHERE 1=1 " . apiClientScopeSql('credential_client_id') . " ORDER BY credential_id LIMIT $limit OFFSET $offset");
+ 
+ }
+ 
+diff --git a/api/v1/documents/read.php b/api/v1/documents/read.php
+index a376381b..5abe9d10 100644
+--- a/api/v1/documents/read.php
++++ b/api/v1/documents/read.php
+@@ -8,11 +8,11 @@ require_once '../require_get_method.php';
+ if (isset($_GET['document_id'])) {
+     // Document via ID (single)
+     $id = intval($_GET['document_id']);
+-    $sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_id = '$id' AND document_client_id LIKE '$client_id'");
++    $sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_id = '$id' AND 1=1 " . apiClientScopeSql('document_client_id') . "");
+ 
+ } else {
+     // All documents (by client ID if given, or all in general if key permits)
+-    $sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE document_client_id LIKE '$client_id' ORDER BY document_id LIMIT $limit OFFSET $offset");
++    $sql = mysqli_query($mysqli, "SELECT * FROM documents WHERE 1=1 " . apiClientScopeSql('document_client_id') . " ORDER BY document_id LIMIT $limit OFFSET $offset");
+ }
+ 
+ // Output
+diff --git a/api/v1/domains/read.php b/api/v1/domains/read.php
+index 6bbd96a2..e75b31c0 100644
+--- a/api/v1/domains/read.php
++++ b/api/v1/domains/read.php
+@@ -8,16 +8,16 @@ require_once '../require_get_method.php';
+ // Specific domain via ID (single)
+ if (isset($_GET['domain_id'])) {
+     $id = intval($_GET['domain_id']);
+-    $sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_id = '$id' AND domain_client_id LIKE '$client_id'");
++    $sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_id = '$id' AND 1=1 " . apiClientScopeSql('domain_client_id') . "");
+ 
+ } elseif (isset($_GET['domain_name'])) {
+     // Domain by name
+     $name = mysqli_real_escape_string($mysqli, $_GET['domain_name']);
+-    $sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_name = '$name' AND domain_client_id LIKE '$client_id' ORDER BY domain_id LIMIT $limit OFFSET $offset");
++    $sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_name = '$name' AND 1=1 " . apiClientScopeSql('domain_client_id') . " ORDER BY domain_id LIMIT $limit OFFSET $offset");
+ 
+ } else {
+     // All domains (by client ID or all in general if key permits)
+-    $sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE domain_client_id LIKE '$client_id' ORDER BY domain_id LIMIT $limit OFFSET $offset");
++    $sql = mysqli_query($mysqli, "SELECT * FROM domains WHERE 1=1 " . apiClientScopeSql('domain_client_id') . " ORDER BY domain_id LIMIT $limit OFFSET $offset");
+ }
+ 
+ // Output
+diff --git a/api/v1/invoice_items/read.php b/api/v1/invoice_items/read.php
+index 9b6a435b..eca3276f 100644
+--- a/api/v1/invoice_items/read.php
++++ b/api/v1/invoice_items/read.php
+@@ -33,7 +33,7 @@ if (isset($_GET['item_id'])) {
+          FROM invoice_items ii
+          INNER JOIN invoices i ON i.invoice_id = ii.item_invoice_id
+          WHERE ii.item_id = '$item_id'
+-           AND i.invoice_client_id LIKE '$client_id'
++           AND i.1=1 " . apiClientScopeSql('invoice_client_id') . "
+          LIMIT 1"
+     );
+ } elseif (isset($_GET['invoice_id'])) {
+@@ -44,7 +44,7 @@ if (isset($_GET['item_id'])) {
+          FROM invoice_items ii
+          INNER JOIN invoices i ON i.invoice_id = ii.item_invoice_id
+          WHERE ii.item_invoice_id = '$invoice_id'
+-           AND i.invoice_client_id LIKE '$client_id'
++           AND i.1=1 " . apiClientScopeSql('invoice_client_id') . "
+          ORDER BY ii.item_order ASC, ii.item_id ASC
+          LIMIT $limit OFFSET $offset"
+     );
+diff --git a/api/v1/invoices/read.php b/api/v1/invoices/read.php
+index f9f40425..072489e6 100644
+--- a/api/v1/invoices/read.php
++++ b/api/v1/invoices/read.php
+@@ -8,11 +8,11 @@ require_once '../require_get_method.php';
+ if (isset($_GET['invoice_id'])) {
+     // Invoice via ID (single)
+     $id = intval($_GET['invoice_id']);
+-    $sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_id = '$id' AND invoice_client_id LIKE '$client_id'");
++    $sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_id = '$id' AND 1=1 " . apiClientScopeSql('invoice_client_id') . "");
+ 
+ } else {
+     // All invoices (by client ID if given, or all in general if key permits)
+-    $sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE invoice_client_id LIKE '$client_id' ORDER BY invoice_id LIMIT $limit OFFSET $offset");
++    $sql = mysqli_query($mysqli, "SELECT * FROM invoices WHERE 1=1 " . apiClientScopeSql('invoice_client_id') . " ORDER BY invoice_id LIMIT $limit OFFSET $offset");
+ }
+ 
+ // Output
+diff --git a/api/v1/locations/read.php b/api/v1/locations/read.php
+index d26efd0d..516fad78 100644
+--- a/api/v1/locations/read.php
++++ b/api/v1/locations/read.php
+@@ -8,11 +8,11 @@ require_once '../require_get_method.php';
+ if (isset($_GET['location_id'])) {
+     // Location via ID (single)
+     $id = intval($_GET['location_id']);
+-    $sql = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_id = '$id' AND location_client_id LIKE '$client_id'");
++    $sql = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_id = '$id' AND 1=1 " . apiClientScopeSql('location_client_id') . "");
+ 
+ } else {
+     // All locations (by client ID if given, or all in general if key permits)
+-    $sql = mysqli_query($mysqli, "SELECT * FROM locations WHERE location_client_id LIKE '$client_id' ORDER BY location_id LIMIT $limit OFFSET $offset");
++    $sql = mysqli_query($mysqli, "SELECT * FROM locations WHERE 1=1 " . apiClientScopeSql('location_client_id') . " ORDER BY location_id LIMIT $limit OFFSET $offset");
+ }
+ 
+ // Output
+diff --git a/api/v1/networks/read.php b/api/v1/networks/read.php
+index 168757ae..28b01756 100644
+--- a/api/v1/networks/read.php
++++ b/api/v1/networks/read.php
+@@ -8,16 +8,16 @@ require_once '../require_get_method.php';
+ // Specific network via ID (single)
+ if (isset($_GET['network_id'])) {
+     $id = intval($_GET['network_id']);
+-    $sql = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_id = '$id' AND network_client_id LIKE '$client_id'");
++    $sql = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_id = '$id' AND 1=1 " . apiClientScopeSql('network_client_id') . "");
+ 
+ } elseif (isset($_GET['network_name'])) {
+     // Network by name
+     $name = mysqli_real_escape_string($mysqli, $_GET['network_name']);
+-    $sql = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_name = '$name' AND network_client_id LIKE '$client_id' ORDER BY network_id LIMIT $limit OFFSET $offset");
++    $sql = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_name = '$name' AND 1=1 " . apiClientScopeSql('network_client_id') . " ORDER BY network_id LIMIT $limit OFFSET $offset");
+ 
+ } else {
+     // All networks (by client ID or all in general if key permits)
+-    $sql = mysqli_query($mysqli, "SELECT * FROM networks WHERE network_client_id LIKE '$client_id' ORDER BY network_id LIMIT $limit OFFSET $offset");
++    $sql = mysqli_query($mysqli, "SELECT * FROM networks WHERE 1=1 " . apiClientScopeSql('network_client_id') . " ORDER BY network_id LIMIT $limit OFFSET $offset");
+ }
+ 
+ // Output
+diff --git a/api/v1/quotes/read.php b/api/v1/quotes/read.php
+index 7331de49..194c7800 100644
+--- a/api/v1/quotes/read.php
++++ b/api/v1/quotes/read.php
+@@ -12,7 +12,7 @@ if (isset($_GET['quote_id'])) {
+ 
+ } else {
+     // All quotes (by client ID if given, or all in general if key permits)
+-    $sql = mysqli_query($mysqli, "SELECT * FROM quotes WHERE quote_client_id LIKE '$client_id' ORDER BY quote_id LIMIT $limit OFFSET $offset");
++    $sql = mysqli_query($mysqli, "SELECT * FROM quotes WHERE 1=1 " . apiClientScopeSql('quote_client_id') . " ORDER BY quote_id LIMIT $limit OFFSET $offset");
+ }
+ 
+ // Output
+diff --git a/api/v1/software/read.php b/api/v1/software/read.php
+index 7ff2dbf5..e738d22e 100644
+--- a/api/v1/software/read.php
++++ b/api/v1/software/read.php
+@@ -8,26 +8,26 @@ require_once '../require_get_method.php';
+ // Specific software via ID (single)
+ if (isset($_GET['software_id'])) {
+     $id = intval($_GET['software_id']);
+-    $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_id = '$id' AND software_client_id LIKE '$client_id'");
++    $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_id = '$id' AND 1=1 " . apiClientScopeSql('software_client_id') . "");
+ 
+ } elseif (isset($_GET['software_key'])) {
+     // Specific software via key
+     $key = mysqli_real_escape_string($mysqli, $_GET['software_license']);
+-    $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_key = '$key' AND software_client_id LIKE '$client_id' ORDER BY software_id LIMIT $limit OFFSET $offset");
++    $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_key = '$key' AND 1=1 " . apiClientScopeSql('software_client_id') . " ORDER BY software_id LIMIT $limit OFFSET $offset");
+ 
+ } elseif (isset($_GET['software_name'])) {
+     // Software by name
+     $name = mysqli_real_escape_string($mysqli, $_GET['software_name']);
+-    $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_name = '$name' AND software_client_id LIKE '$client_id' ORDER BY asset_id LIMIT $limit OFFSET $offset");
++    $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_name = '$name' AND 1=1 " . apiClientScopeSql('software_client_id') . " ORDER BY asset_id LIMIT $limit OFFSET $offset");
+ 
+ } elseif (isset($_GET['software_type'])) {
+     // Software via type
+     $type = intval($_GET['software_type']);
+-    $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_type = '$type' AND software_client_id LIKE '$client_id' ORDER BY software_id LIMIT $limit OFFSET $offset");
++    $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_type = '$type' AND 1=1 " . apiClientScopeSql('software_client_id') . " ORDER BY software_id LIMIT $limit OFFSET $offset");
+ 
+ } else {
+     // All software(s) (by client ID if given, or all in general if key permits)
+-    $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE software_client_id LIKE '$client_id' ORDER BY software_id LIMIT $limit OFFSET $offset");
++    $sql = mysqli_query($mysqli, "SELECT * FROM software WHERE 1=1 " . apiClientScopeSql('software_client_id') . " ORDER BY software_id LIMIT $limit OFFSET $offset");
+ }
+ 
+ // Output
+diff --git a/api/v1/technicians/time.php b/api/v1/technicians/time.php
+index 5d17be98..3e67ea6d 100644
+--- a/api/v1/technicians/time.php
++++ b/api/v1/technicians/time.php
+@@ -62,7 +62,7 @@ $sql = mysqli_query(
+     WHERE tr.ticket_reply_time_worked IS NOT NULL
+         AND tr.ticket_reply_time_worked != '00:00:00'
+         AND $date_conditions
+-        AND t.ticket_client_id LIKE '$client_id'
++        AND t.1=1 " . apiClientScopeSql('ticket_client_id') . "
+         $technician_condition
+     GROUP BY t.ticket_id, u.user_id
+     ORDER BY c.client_name ASC, t.ticket_number ASC, u.user_name ASC
+diff --git a/api/v1/tickets/read.php b/api/v1/tickets/read.php
+index 408190ae..d6a28a32 100644
+--- a/api/v1/tickets/read.php
++++ b/api/v1/tickets/read.php
+@@ -12,12 +12,12 @@ if (isset($_GET['ticket_id'])) {
+         $mysqli,
+         "SELECT * FROM tickets
+         LEFT JOIN ticket_statuses ON ticket_status = ticket_status_id
+-        WHERE ticket_id = '$id' AND ticket_client_id LIKE '$client_id'"
++        WHERE ticket_id = '$id' AND 1=1 " . apiClientScopeSql('ticket_client_id') . ""
+     );
+ 
+ } else {
+     // All tickets (by client ID if given, or all in general if key permits)
+-    $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE ticket_client_id LIKE '$client_id' ORDER BY ticket_id LIMIT $limit OFFSET $offset");
++    $sql = mysqli_query($mysqli, "SELECT * FROM tickets WHERE 1=1 " . apiClientScopeSql('ticket_client_id') . " ORDER BY ticket_id LIMIT $limit OFFSET $offset");
+ }
+ 
+ // Output
+diff --git a/api/v1/validate_api_key.php b/api/v1/validate_api_key.php
+index 2945a321..2404bc8c 100644
+--- a/api/v1/validate_api_key.php
++++ b/api/v1/validate_api_key.php
+@@ -94,7 +94,7 @@ if (isset($api_key)) {
+         $row = mysqli_fetch_assoc($sql);
+         $api_key_name = htmlentities($row['api_key_name']);
+         $api_key_decrypt_hash = $row['api_key_decrypt_hash']; // No sanitization
+-        $client_id = intval($row['api_key_client_id']);
++        $api_key_user_id = intval($row['api_key_user_id']);
+ 
+         // Set limit & offset for queries
+         if (isset($_GET['limit'])) {
+@@ -113,5 +113,8 @@ if (isset($api_key)) {
+             $offset = 0;
+         }
+ 
++        // When the key is tied to a user, enforce that user's RBAC (module + operation + client scope)
++        require __DIR__ . '/enforce_api_rbac.php';
++
+     }
+ }
+diff --git a/api/v1/vendors/read.php b/api/v1/vendors/read.php
+index e6971f52..f12d572c 100644
+--- a/api/v1/vendors/read.php
++++ b/api/v1/vendors/read.php
+@@ -7,11 +7,11 @@ require_once '../require_get_method.php';
+ // Specific vendor via their ID (single)
+ if (isset($_GET['vendor_id'])) {
+     $id = intval($_GET['vendor_id']);
+-    $sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_id = '$id' AND vendor_client_id LIKE '$client_id'");
++    $sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_id = '$id' AND 1=1 " . apiClientScopeSql('vendor_client_id') . "");
+ 
+ } else {
+     // All Vendors (by client ID or all in general if key permits)
+-    $sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE vendor_client_id LIKE '$client_id' ORDER BY vendor_id LIMIT $limit OFFSET $offset");
++    $sql = mysqli_query($mysqli, "SELECT * FROM vendors WHERE 1=1 " . apiClientScopeSql('vendor_client_id') . " ORDER BY vendor_id LIMIT $limit OFFSET $offset");
+ }
+ 
+ // Output
+diff --git a/db.sql b/db.sql
+index 832e141b..5a6abded 100644
+--- a/db.sql
++++ b/db.sql
+@@ -91,7 +91,7 @@ CREATE TABLE `api_keys` (
+   `api_key_decrypt_hash` varchar(200) NOT NULL,
+   `api_key_created_at` datetime NOT NULL DEFAULT current_timestamp(),
+   `api_key_expire` date NOT NULL,
+-  `api_key_client_id` int(11) NOT NULL DEFAULT 0,
++  `api_key_user_id` int(11) NOT NULL DEFAULT 0,
+   PRIMARY KEY (`api_key_id`)
+ ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
+ /*!40101 SET character_set_client = @saved_cs_client */;

db.sql

@@ -91,7 +91,7 @@ CREATE TABLE `api_keys` (
   `api_key_decrypt_hash` varchar(200) NOT NULL,
   `api_key_created_at` datetime NOT NULL DEFAULT current_timestamp(),
   `api_key_expire` date NOT NULL,
-  `api_key_client_id` int(11) NOT NULL DEFAULT 0,
+  `api_key_user_id` int(11) NOT NULL DEFAULT 0,
   PRIMARY KEY (`api_key_id`)
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_general_ci;
 /*!40101 SET character_set_client = @saved_cs_client */;
@@ -2996,4 +2996,4 @@ CREATE TABLE `vendors` (
 /*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */;
 /*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */;
 
--- Dump completed on 2026-07-25 13:20:49
+-- Dump completed on 2026-07-25 16:50:10