+ /**
+ * Store a new API token in the system.
+ */
+ public function store(Request $request, int $userId)
+ {
+ $this->checkPermission('access-api');
+ $this->checkPermissionOrCurrentUser('manage-users', $userId);
+
+ $this->validate($request, [
+ 'name' => 'required|max:250',
+ 'expires_at' => 'date_format:Y-m-d',
+ ]);
+
+ $user = User::query()->findOrFail($userId);
+ $secret = Str::random(32);
+ $expiry = $request->get('expires_at', (Carbon::now()->addYears(100))->format('Y-m-d'));
+
+ $token = (new ApiToken())->forceFill([
+ 'name' => $request->get('name'),
+ 'client_id' => Str::random(32),
+ 'client_secret' => Hash::make($secret),
+ 'user_id' => $user->id,
+ 'expires_at' => $expiry
+ ]);
+
+ while (ApiToken::query()->where('client_id', '=', $token->client_id)->exists()) {
+ $token->client_id = Str::random(32);
+ }
+
+ $token->save();
+ // TODO - Notification and activity?
+ session()->flash('api-token-secret:' . $token->id, $secret);
+ return redirect($user->getEditUrl('/api-tokens/' . $token->id));
+ }
+
+ /**
+ * Show the details for a user API token, with access to edit.
+ */
+ public function edit(int $userId, int $tokenId)
+ {
+ [$user, $token] = $this->checkPermissionAndFetchUserToken($userId, $tokenId);
+ $secret = session()->pull('api-token-secret:' . $token->id, null);
+
+ return view('users.api-tokens.edit', [
+ 'user' => $user,
+ 'token' => $token,
+ 'model' => $token,
+ 'secret' => $secret,
+ ]);
+ }
+
+ /**
+ * Update the API token.
+ */
+ public function update(Request $request, int $userId, int $tokenId)
+ {
+ $this->validate($request, [
+ 'name' => 'required|max:250',
+ 'expires_at' => 'date_format:Y-m-d',
+ ]);
+
+ [$user, $token] = $this->checkPermissionAndFetchUserToken($userId, $tokenId);
+
+ $token->fill($request->all())->save();
+ // TODO - Notification and activity?
+ return redirect($user->getEditUrl('/api-tokens/' . $token->id));
+ }
+
+ /**
+ * Show the delete view for this token.
+ */
+ public function delete(int $userId, int $tokenId)
+ {
+ [$user, $token] = $this->checkPermissionAndFetchUserToken($userId, $tokenId);
+ return view('users.api-tokens.delete', [
+ 'user' => $user,
+ 'token' => $token,
+ ]);
+ }
+
+ /**
+ * Destroy a token from the system.
+ */
+ public function destroy(int $userId, int $tokenId)
+ {
+ [$user, $token] = $this->checkPermissionAndFetchUserToken($userId, $tokenId);
+ $token->delete();
+
+ // TODO - Notification and activity?, Might have text in translations already (user_api_token_delete_success)
+ return redirect($user->getEditUrl('#api_tokens'));
+ }
+
+ /**
+ * Check the permission for the current user and return an array
+ * where the first item is the user in context and the second item is their
+ * API token in context.
+ */
+ protected function checkPermissionAndFetchUserToken(int $userId, int $tokenId): array
+ {
+ $this->checkPermission('access-api');
+ $this->checkPermissionOrCurrentUser('manage-users', $userId);
+
+ $user = User::query()->findOrFail($userId);
+ $token = ApiToken::query()->where('user_id', '=', $user->id)->where('id', '=', $tokenId)->firstOrFail();
+ return [$user, $token];
+ }
projects / bookstack / commitdiff