AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-26 18:27:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add user-based RBAC for API keys

Browse Source 
API keys now run as a user and inherit that user's module, operation, and client permissions. Drops per-key client scoping and removes existing keys (must be recreated). Adds an edit modal to change a key's user.
This commit is contained in:
johnnyq
2026-07-25 16:50:58 -04:00
parent 8d46e2a7db
commit c509b7f693
25 changed files with 954 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
admin/database_updates/2.4.7.php Normal file
View File

@@ -0,0 +1,18 @@
<?php
/*
* ITFlow - Database update to version 2.4.7 (from 2.4.6)
* Included by admin/database_updates.php - do not access directly
*/
defined('FROM_DB_UPDATER') || die("Direct file access is not allowed");
// API keys now run as a user and inherit that user's RBAC (module / operation / client).
// Existing keys predate this and can't be safely mapped to a user, so they are removed
// and must be recreated with an owning user.
mysqli_query($mysqli, "DELETE FROM api_keys");
// Tie keys to a user; client access now derives from that user, so the old per-key
// client scope is removed.
mysqli_query($mysqli, "ALTER TABLE `api_keys` ADD COLUMN `api_key_user_id` INT(11) NOT NULL DEFAULT 0");
mysqli_query($mysqli, "ALTER TABLE `api_keys` DROP COLUMN `api_key_client_id`");