AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-26 18:27:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add user-based RBAC for API keys

Browse Source 
API keys now run as a user and inherit that user's module, operation, and client permissions. Drops per-key client scoping and removes existing keys (must be recreated). Adds an edit modal to change a key's user.
This commit is contained in:
johnnyq
2026-07-25 16:50:58 -04:00
parent 8d46e2a7db
commit c509b7f693
25 changed files with 954 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
api/v1/invoice_items/read.php
View File

@@ -33,7 +33,7 @@ if (isset($_GET['item_id'])) {
FROM invoice_items ii
INNER JOIN invoices i ON i.invoice_id = ii.item_invoice_id
WHERE ii.item_id = '$item_id'
AND i.invoice_client_id LIKE '$client_id'
AND i.1=1 " . apiClientScopeSql('invoice_client_id') . "
LIMIT 1"
);
} elseif (isset($_GET['invoice_id'])) {
@@ -44,7 +44,7 @@ if (isset($_GET['item_id'])) {
FROM invoice_items ii
INNER JOIN invoices i ON i.invoice_id = ii.item_invoice_id
WHERE ii.item_invoice_id = '$invoice_id'
AND i.invoice_client_id LIKE '$client_id'
AND i.1=1 " . apiClientScopeSql('invoice_client_id') . "
ORDER BY ii.item_order ASC, ii.item_id ASC
LIMIT $limit OFFSET $offset"
);