AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-27 02:37:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add user-based RBAC for API keys

Browse Source 
API keys now run as a user and inherit that user's module, operation, and client permissions. Drops per-key client scoping and removes existing keys (must be recreated). Adds an edit modal to change a key's user.
This commit is contained in:
johnnyq
2026-07-25 16:50:58 -04:00
parent 8d46e2a7db
commit c509b7f693
25 changed files with 954 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
admin/post/api_keys.php
View File

@@ -12,17 +12,17 @@ if (isset($_POST['add_api_key'])) {
$name = escapeSql($_POST['name']);
$expire = escapeSql($_POST['expire']);
$client_id = intval($_POST['client']);
$user_id = intval($_POST['run_as_user']);
$secret = escapeSql($_POST['key']); // API Key
// Credential decryption password
$apikey_specific_encryption_ciphertext = encryptUserSpecificKey(trim($_POST['password']));
mysqli_query($mysqli,"INSERT INTO api_keys SET api_key_name = '$name', api_key_secret = '$secret', api_key_decrypt_hash = '$apikey_specific_encryption_ciphertext', api_key_expire = '$expire', api_key_client_id = $client_id");
mysqli_query($mysqli,"INSERT INTO api_keys SET api_key_name = '$name', api_key_secret = '$secret', api_key_decrypt_hash = '$apikey_specific_encryption_ciphertext', api_key_expire = '$expire', api_key_user_id = $user_id");
$api_key_id = mysqli_insert_id($mysqli);
logAudit("API Key", "Create", "$session_name created API key $name set to expire on $expire", $client_id, $api_key_id);
logAudit("API Key", "Create", "$session_name created API key $name set to expire on $expire", 0, $api_key_id);
flashAlert("API Key <strong>$name</strong> created");
@@ -30,6 +30,25 @@ if (isset($_POST['add_api_key'])) {
}
if (isset($_POST['edit_api_key'])) {
validateCSRFToken();
$api_key_id = intval($_POST['api_key_id']);
$name = escapeSql($_POST['name']);
$expire = escapeSql($_POST['expire']);
$user_id = intval($_POST['run_as_user']);
mysqli_query($mysqli,"UPDATE api_keys SET api_key_name = '$name', api_key_expire = '$expire', api_key_user_id = $user_id WHERE api_key_id = $api_key_id");
logAudit("API Key", "Edit", "$session_name edited API key $name", 0, $api_key_id);
flashAlert("API Key <strong>$name</strong> updated");
redirect();
}
if (isset($_GET['revoke_api_key'])) {
validateCSRFToken();
@@ -37,13 +56,12 @@ if (isset($_GET['revoke_api_key'])) {
$api_key_id = intval($_GET['revoke_api_key']);
// Get API Key Name
$row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name, api_key_client_id FROM api_keys WHERE api_key_id = $api_key_id"));
$row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name FROM api_keys WHERE api_key_id = $api_key_id"));
$api_key_name = escapeSql($row['api_key_name']);
$client_id = intval($row['api_key_client_id']);
mysqli_query($mysqli,"UPDATE api_keys SET api_key_expire = NOW() WHERE api_key_id = $api_key_id");
logAudit("API Key", "Revoke", "$session_name revoked API key $name", $client_id);
logAudit("API Key", "Revoke", "$session_name revoked API key $name", 0);
flashAlert("API Key <strong>$name</strong> revoked", 'error');
@@ -58,13 +76,12 @@ if (isset($_GET['delete_api_key'])) {
$api_key_id = intval($_GET['delete_api_key']);
// Get API Key Name
$row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name, api_key_client_id FROM api_keys WHERE api_key_id = $api_key_id"));
$row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name FROM api_keys WHERE api_key_id = $api_key_id"));
$api_key_name = escapeSql($row['api_key_name']);
$client_id = intval($row['api_key_client_id']);
mysqli_query($mysqli,"DELETE FROM api_keys WHERE api_key_id = $api_key_id");
logAudit("API Key", "Delete", "$session_name deleted API key $name", $client_id);
logAudit("API Key", "Delete", "$session_name deleted API key $name", 0);
flashAlert("API Key <strong>$name</strong> deleted", 'error');
@@ -86,13 +103,12 @@ if (isset($_POST['bulk_delete_api_keys'])) {
$api_key_id = intval($api_key_id);
// Get API Key Name
$row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name, api_key_client_id FROM api_keys WHERE api_key_id = $api_key_id"));
$row = mysqli_fetch_assoc(mysqli_query($mysqli,"SELECT api_key_name FROM api_keys WHERE api_key_id = $api_key_id"));
$api_key_name = escapeSql($row['api_key_name']);
$client_id = intval($row['api_key_client_id']);
mysqli_query($mysqli, "DELETE FROM api_keys WHERE api_key_id = $api_key_id");
logAudit("API Key", "Delete", "$session_name deleted API key $name", $client_id);
logAudit("API Key", "Delete", "$session_name deleted API key $name", 0);
}