AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-26 18:27:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add user-based RBAC for API keys

Browse Source 
API keys now run as a user and inherit that user's module, operation, and client permissions. Drops per-key client scoping and removes existing keys (must be recreated). Adds an edit modal to change a key's user.
This commit is contained in:
johnnyq
2026-07-25 16:50:58 -04:00
parent 8d46e2a7db
commit c509b7f693
25 changed files with 954 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
admin/modals/api/api_key_add.php
View File

@@ -55,22 +55,23 @@ ob_start();
</div>
<div class="form-group">
<label>Client Access <strong class="text-danger">*</strong></label>
<label>Run as User <strong class="text-danger">*</strong></label>
<div class="input-group">
<div class="input-group-prepend">
<span class="input-group-text"><i class="fa fa-fw fa-user"></i></span>
<span class="input-group-text"><i class="fa fa-fw fa-user-shield"></i></span>
</div>
<select class="form-control select2" name="client" required>
<option value="0"> ALL CLIENTS </option>
<select class="form-control select2" name="run_as_user" required>
<option value="">- Select a user -</option>
<?php
$sql = mysqli_query($mysqli, "SELECT client_id, client_name FROM clients WHERE client_archived_at IS NULL ORDER BY client_name ASC");
while ($row = mysqli_fetch_assoc($sql)) {
$client_id = intval($row['client_id']);
$client_name = escapeHtml($row['client_name']); ?>
<option value="<?php echo $client_id; ?>"><?php echo "$client_name (Client ID: $client_id)"; ?></option>
$sql_run_users = mysqli_query($mysqli, "SELECT user_id, user_name FROM users WHERE user_type = 1 AND user_status = 1 AND user_archived_at IS NULL ORDER BY user_name ASC");
while ($run_user = mysqli_fetch_assoc($sql_run_users)) {
$run_user_id = intval($run_user['user_id']);
$run_user_name = escapeHtml($run_user['user_name']); ?>
<option value="<?php echo $run_user_id; ?>"><?php echo $run_user_name; ?></option>
<?php } ?>
</select>
</div>
<small class="form-text text-muted">The key inherits this user's module permissions and client access.</small>
</div>
</div>

79
admin/modals/api/api_key_edit.php Normal file
View File

@@ -0,0 +1,79 @@
<?php
require_once '../../../includes/modal_header.php';
$api_key_id = intval($_GET['id']);
$sql = mysqli_query($mysqli, "SELECT * FROM api_keys WHERE api_key_id = $api_key_id LIMIT 1");
$row = mysqli_fetch_assoc($sql);
$api_key_name = escapeHtml($row['api_key_name']);
$api_key_expire = escapeHtml($row['api_key_expire']);
$api_key_user_id = intval($row['api_key_user_id']);
ob_start();
?>
<div class="modal-header bg-dark">
<h5 class="modal-title"><i class="fas fa-fw fa-key mr-2"></i>Editing API Key:
<strong><?php echo $api_key_name; ?></strong></h5>
<button type="button" class="close text-white" data-dismiss="modal">
<span>&times;</span>
</button>
</div>
<form action="post.php" method="post" autocomplete="off">
<div class="modal-body">
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
<input type="hidden" name="api_key_id" value="<?php echo $api_key_id; ?>">
<div class="form-group">
<label>Name <strong class="text-danger">*</strong></label>
<div class="input-group">
<div class="input-group-prepend">
<span class="input-group-text"><i class="fa fa-fw fa-sticky-note"></i></span>
</div>
<input type="text" class="form-control" name="name" placeholder="Key Name" maxlength="255"
value="<?php echo $api_key_name; ?>" required autofocus>
</div>
</div>
<div class="form-group">
<label>Expiration Date <strong class="text-danger">*</strong></label>
<div class="input-group">
<div class="input-group-prepend">
<span class="input-group-text"><i class="fa fa-fw fa-calendar"></i></span>
</div>
<input type="date" class="form-control" name="expire" min="<?php echo date('Y-m-d')?>" max="2999-12-31"
value="<?php echo $api_key_expire; ?>" required>
</div>
</div>
<div class="form-group">
<label>Run as User <strong class="text-danger">*</strong></label>
<div class="input-group">
<div class="input-group-prepend">
<span class="input-group-text"><i class="fa fa-fw fa-user-shield"></i></span>
</div>
<select class="form-control select2" name="run_as_user" required>
<option value="">- Select a user -</option>
<?php
$sql_run_users = mysqli_query($mysqli, "SELECT user_id, user_name FROM users WHERE user_type = 1 AND user_status = 1 AND user_archived_at IS NULL ORDER BY user_name ASC");
while ($run_user = mysqli_fetch_assoc($sql_run_users)) {
$run_user_id = intval($run_user['user_id']);
$run_user_name = escapeHtml($run_user['user_name']); ?>
<option value="<?php echo $run_user_id; ?>" <?php if ($run_user_id == $api_key_user_id) { echo "selected"; } ?>><?php echo $run_user_name; ?></option>
<?php } ?>
</select>
</div>
<small class="form-text text-muted">The key inherits this user's module permissions and client access.</small>
</div>
</div>
<div class="modal-footer">
<button type="submit" name="edit_api_key" class="btn btn-primary text-bold"><i class="fas fa-check mr-2"></i>Save</button>
<button type="button" class="btn btn-light" data-dismiss="modal"><i class="fas fa-times mr-2"></i>Cancel</button>
</div>
</form>
<?php
require_once "../../../includes/modal_footer.php";