AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-27 02:37:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add user-based RBAC for API keys

Browse Source 
API keys now run as a user and inherit that user's module, operation, and client permissions. Drops per-key client scoping and removes existing keys (must be recreated). Adds an edit modal to change a key's user.
This commit is contained in:
johnnyq
2026-07-25 16:50:58 -04:00
parent 8d46e2a7db
commit c509b7f693
25 changed files with 954 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
api/v1/validate_api_key.php
View File

@@ -94,7 +94,7 @@ if (isset($api_key)) {
$row = mysqli_fetch_assoc($sql);
$api_key_name = htmlentities($row['api_key_name']);
$api_key_decrypt_hash = $row['api_key_decrypt_hash']; // No sanitization
$client_id = intval($row['api_key_client_id']);
$api_key_user_id = intval($row['api_key_user_id']);
// Set limit & offset for queries
if (isset($_GET['limit'])) {
@@ -113,5 +113,8 @@ if (isset($api_key)) {
$offset = 0;
}
// When the key is tied to a user, enforce that user's RBAC (module + operation + client scope)
require __DIR__ . '/enforce_api_rbac.php';
}
}