5 Commits

Author	SHA1	Message	Date
johnnyq	2a5533ea2b	Roles stage 3: roles and agents in the API and Admin > API Keys rebuilt; new api/v1/roles/read.php where an admin key reads every role with its level per module and agent count, archived on request, and any other key reads only its own user's role, and new api/v1/technicians/read.php listing agents with their role under Support at Read; API role refusals now say what the call needs and what the key's user has, naming the module, level and role, and technicians/time.php needs Read instead of Modify; Admin > API Keys shows each key's agent and role, what it can open and for which clients, whether it works (works until, expires in N days, expired, or won't work with the reason when its agent is disabled, archived, has no role or is missing) and when it was last used, with search by key or agent name; New and Edit windows show the picked agent's access as they are picked and offer only active agents, Create before ticking the copied box opens the Key tab, new keys default to a year and must end after today, and an expired key can be renamed and stay expired; handlers moved to functions/api_keys.php with validation, escaped messages and audit entries naming the agent and what an edit changed, fixing empty names on revoke, delete and bulk delete, a backslash shown for apostrophes in names, the bulk count of keys ticked rather than deleted, keys created already expired and expired keys that could not be renamed; database 3.1.7 adds api_keys.api_key_last_used_at, set at most once a minute in the configured timezone; changelog updated	2026-10-17 21:10:48 -04:00
johnnyq	36ea4a9a80	API: allow reads to filter by client_id on top of RBAC client scoping ... The RBAC rework dropped the client_id read filter along with per-key client scope, so an all-clients key could no longer narrow to one client. apiClientScopeSql() now appends the filter after the scope fragment, so it can only narrow, never widen. Reads only - writes take client_id as their target client.	2026-08-31 18:30:09 -04:00
johnnyq	e6daf00528	Fix some broken API calls after RBAC update	2026-07-25 16:59:03 -04:00
johnnyq	c509b7f693	Add user-based RBAC for API keys ... API keys now run as a user and inherit that user's module, operation, and client permissions. Drops per-key client scoping and removes existing keys (must be recreated). Adds an edit modal to change a key's user.	2026-07-25 16:50:58 -04:00
Mads Iversen	62fb2c91a1	feat: Add API endpoint to retrieve time worked by technicians on tickets with filtering by date and technician.	2026-02-09 12:09:56 +00:00