johnnyq
2a5533ea2b
Roles stage 3: roles and agents in the API and Admin > API Keys rebuilt; new api/v1/roles/read.php where an admin key reads every role with its level per module and agent count, archived on request, and any other key reads only its own user's role, and new api/v1/technicians/read.php listing agents with their role under Support at Read; API role refusals now say what the call needs and what the key's user has, naming the module, level and role, and technicians/time.php needs Read instead of Modify; Admin > API Keys shows each key's agent and role, what it can open and for which clients, whether it works (works until, expires in N days, expired, or won't work with the reason when its agent is disabled, archived, has no role or is missing) and when it was last used, with search by key or agent name; New and Edit windows show the picked agent's access as they are picked and offer only active agents, Create before ticking the copied box opens the Key tab, new keys default to a year and must end after today, and an expired key can be renamed and stay expired; handlers moved to functions/api_keys.php with validation, escaped messages and audit entries naming the agent and what an edit changed, fixing empty names on revoke, delete and bulk delete, a backslash shown for apostrophes in names, the bulk count of keys ticked rather than deleted, keys created already expired and expired keys that could not be renamed; database 3.1.7 adds api_keys.api_key_last_used_at, set at most once a minute in the configured timezone; changelog updated
2026-10-17 21:10:48 -04:00
johnnyq
b3744e9ed5
More sweeps to replace select * with actual returned column names dramatically reduces php memory usage and speeds up processing dramatically especially in the crons since they run all the time
2026-08-06 13:10:23 -04:00
johnnyq
c509b7f693
Add user-based RBAC for API keys
...
API keys now run as a user and inherit that user's module, operation, and client permissions. Drops per-key client scoping and removes existing keys (must be recreated). Adds an edit modal to change a key's user.
2026-07-25 16:50:58 -04:00
johnnyq
b57ddc0e5c
Replace Function sanitizeInput() with just escapeSql() and update all instances throughout
2026-07-14 17:17:50 -04:00
johnnyq
0a30300bde
replace all instances of mysqli_fetch_array with mysqli_fetch_assoc for better performance and memory usage
2026-01-14 17:30:23 -05:00
wrongecho
2f28f96f8d
Log the API endpoint/URL path for API auth failures to assist with debugging
2025-11-06 14:43:32 +00:00
johnnyq
bfffec7363
Temp added vars session_ip and session_user_agent to validate_api_key so IP and User agent is logged with the new logAction function
2024-11-14 17:55:35 -05:00
wrongecho
c65db3431d
Tidying
2024-09-14 23:43:54 +01:00
wrongecho
a6113dc371
WIP: Allow decrypting logins/credentials via the API
2024-08-22 18:22:20 +01:00
johnnyq
3f028e8560
Fix Broken API due to incorrect named function https://forum.itflow.org/d/119-api-broken
2023-03-14 18:59:43 -04:00
johnnyq
48fe49cf77
BREAKING CHANGES - MAKE FULL BACKUP BEFORE PROCEEDING - Requires Manual Intervention on files see Forum Post Make sure you run the Database update directly after update. This Removes Multi-Company Functionality. Fixes issues with Reponsive tables and bunch of other UI and small Fixes
2023-03-11 16:16:46 -05:00
Marcus Hill
b36719eb99
General cleanup/tidying
2023-02-09 11:32:40 +00:00
Marcus Hill
f3456ead67
API
...
- Add PHP logging when API queries fail because of SQL errors
- Add user agent to logging
- Enhance asset update endpoint
2023-02-05 15:07:41 +00:00
Marcus Hill
531bd25f27
Convert custom function names to camelCase
2023-01-26 22:03:31 +00:00
Marcus Hill
10362f86ef
Convert custom function names to camelCase
2023-01-26 21:58:27 +00:00
Marcus Hill
447f20c91c
Escape potential HTML characters in the API Key name, as this is used in logs
2023-01-02 14:38:52 +00:00
Marcus Hill
1aa87ccaeb
API Key error wording
2023-01-02 14:37:56 +00:00
Marcus Hill
ff741c223e
API code style tidy
2023-01-01 16:00:07 +00:00
Marcus Hill
e55622827d
Add support for client-specific API keys
...
Refactoring API. Added a contact update endpoint.
Small misc changes.
2022-04-15 17:43:06 +01:00
Marcus Hill
a3ca268fcf
Small code cleanups
2022-04-14 07:54:40 +01:00
Marcus Hill
9040fdf847
Misc small changes/fixes
2022-03-27 22:26:22 +01:00
Marcus Hill
09b4eab1c3
Correct insert ID for create endpoint. Add contact create API endpoint
2022-03-26 13:39:43 +00:00
Marcus Hill
4b077cf6e0
Add create asset functionality to API
2022-02-27 16:09:21 +00:00
johnnyq
be0778ab84
Strip slashes on user agent and ip to prevent user header modification for XSS attack in API logging
2022-02-04 16:55:45 -05:00
johnnyq
338c991d21
Updated Logging in both APIs
2022-02-04 16:51:56 -05:00
johnnyq
b8e5d5844d
Updated new API Validation with api-keys table and added some additonal log fields
2022-02-04 16:37:19 -05:00
Marcus Hill
6e4025dc58
Initial new api
2022-02-02 22:16:08 +00:00
