From a6bc36a710c62fad985b3bb7f894b85733e22e68 Mon Sep 17 00:00:00 2001
From: Dane Everitt <dane@daneeveritt.com>
Date: Sat, 16 Jan 2016 01:20:27 -0500
Subject: [PATCH] add initial api management page

---
 app/Http/Controllers/Admin/APIController.php | 32 +++++++
 app/Http/Routes/AdminRoutes.php              | 25 +++++-
 app/Models/APIKey.php                        | 14 +++
 app/Models/APIPermission.php                 |  8 ++
 resources/views/admin/api/index.blade.php    | 90 ++++++++++++++++++++
 resources/views/admin/api/new.blade.php      |  0
 resources/views/layouts/admin.blade.php      |  1 +
 7 files changed, 169 insertions(+), 1 deletion(-)
 create mode 100644 app/Http/Controllers/Admin/APIController.php
 create mode 100644 resources/views/admin/api/index.blade.php
 create mode 100644 resources/views/admin/api/new.blade.php

diff --git a/app/Http/Controllers/Admin/APIController.php b/app/Http/Controllers/Admin/APIController.php
new file mode 100644
index 000000000..77b60adc0
--- /dev/null
+++ b/app/Http/Controllers/Admin/APIController.php
@@ -0,0 +1,32 @@
+<?php
+
+namespace Pterodactyl\Http\Controllers\Admin;
+
+use Alert;
+use Log;
+use Pterodactyl\Models;
+
+use Pterodactyl\Http\Controllers\Controller;
+use Illuminate\Http\Request;
+
+class APIController extends Controller
+{
+
+    public function __construct()
+    {
+        //
+    }
+
+    public function getIndex(Request $request)
+    {
+        $keys = Models\APIKey::all();
+        foreach($keys as &$key) {
+            $key->permissions = Models\APIPermission::where('key_id', $key->id)->get();
+        }
+
+        return view('admin.api.index', [
+            'keys' => $keys
+        ]);
+    }
+
+}
diff --git a/app/Http/Routes/AdminRoutes.php b/app/Http/Routes/AdminRoutes.php
index 2e22b5285..0eecf410c 100644
--- a/app/Http/Routes/AdminRoutes.php
+++ b/app/Http/Routes/AdminRoutes.php
@@ -203,7 +203,7 @@ class AdminRoutes {
 
         });
 
-        // Server Routes
+        // Location Routes
         $router->group([
             'prefix' => 'admin/locations',
             'middleware' => [
@@ -218,6 +218,29 @@ class AdminRoutes {
             ]);
         });
 
+        // API Routes
+        $router->group([
+            'prefix' => 'admin/api',
+            'middleware' => [
+                'auth',
+                'admin',
+                'csrf'
+            ]
+        ], function () use ($router) {
+            $router->get('/', [
+                'as' => 'admin.api',
+                'uses' => 'Admin\APIController@getIndex'
+            ]);
+            $router->get('/new', [
+                'as' => 'admin.api.new',
+                'uses' => 'Admin\APIController@getNew'
+            ]);
+            $router->delete('/revoke/{key?}', [
+                'as' => 'admin.api.revoke',
+                'uses' => 'Admin\APIController@deleteKey'
+            ]);
+        });
+
     }
 
 }
diff --git a/app/Models/APIKey.php b/app/Models/APIKey.php
index dc7912f26..74ea8f60c 100644
--- a/app/Models/APIKey.php
+++ b/app/Models/APIKey.php
@@ -14,4 +14,18 @@ class APIKey extends Model
      */
     protected $table = 'api_keys';
 
+    /**
+     * The attributes excluded from the model's JSON form.
+     *
+     * @var array
+     */
+    protected $hidden = ['secret'];
+
+    /**
+     * Fields that are not mass assignable.
+     *
+     * @var array
+     */
+    protected $guarded = ['id', 'created_at', 'updated_at'];
+
 }
diff --git a/app/Models/APIPermission.php b/app/Models/APIPermission.php
index 037729716..487951b17 100644
--- a/app/Models/APIPermission.php
+++ b/app/Models/APIPermission.php
@@ -14,4 +14,12 @@ class APIPermission extends Model
      */
     protected $table = 'api_permissions';
 
+    /**
+     * Fields that are not mass assignable.
+     *
+     * @var array
+     */
+    protected $guarded = ['id'];
+
+
 }
diff --git a/resources/views/admin/api/index.blade.php b/resources/views/admin/api/index.blade.php
new file mode 100644
index 000000000..d6779c46a
--- /dev/null
+++ b/resources/views/admin/api/index.blade.php
@@ -0,0 +1,90 @@
+@extends('layouts.admin')
+
+@section('title')
+    API Management
+@endsection
+
+@section('content')
+<div class="col-md-12">
+    <ul class="breadcrumb">
+        <li><a href="/admin">Admin Control</a></li>
+        <li class="active">API Management</li>
+    </ul>
+    <h3>API Key Information</h3><hr />
+    <table class="table table-bordered table-hover">
+        <thead>
+            <tr>
+                <th>API Public Key</th>
+                <th>Allowed IPs</th>
+                <th>Permissions</th>
+                <th class="text-center">Created</th>
+                <th class="text-center"></th>
+            </tr>
+        </thead>
+        <tbody>
+            @foreach ($keys as $key)
+                <tr>
+                    <td><code>{{ $key->public }}</code></td>
+                    <td>
+                        @if (is_null($key->allowed_ips))
+                            <code>*</code>
+                        @else
+                            @foreach(json_decode($key->allowed_ips) as $ip)
+                                <code style="line-height:2;">{{ $ip }}</code><br />
+                            @endforeach
+                        @endif
+                    </td>
+                    <td>
+                        @foreach(json_decode($key->permissions) as &$perm)
+                            <code style="line-height:2;">{{ $perm->permission }}</code><br />
+                        @endforeach
+                    </td>
+                    <td class="text-center">{{ $key->created_at }}</td>
+                    <td class="text-center"><a href="#delete" class="text-danger" data-action="delete" data-attr="{{ $key->public }}"><i class="fa fa-trash"></i></a></td>
+                </tr>
+            @endforeach
+        </tbody>
+    </table>
+    <div class="well">
+        <a href="{{ route('admin.api.new') }}"><button class="btn btn-success btn-sm">Create New API Key</button></a>
+    </div>
+</div>
+<script>
+$(document).ready(function () {
+    $('#sidebar_links').find("a[href='/admin/api']").addClass('active');
+    $('[data-action="delete"]').click(function (event) {
+        var self = $(this);
+        event.preventDefault();
+        swal({
+            type: 'error',
+            title: 'Revoke API Key',
+            text: 'Once this API key is revoked any applications currently using it will stop working.',
+            showCancelButton: true,
+            allowOutsideClick: true,
+            confirmButtonText: 'Revoke',
+            confirmButtonColor: '#d9534f',
+        }, function () {
+            $.ajax({
+                method: 'DELETE',
+                url: '{{ route('admin.api.revoke') }}/' + self.data('attr'),
+                headers: {
+                    'X-CSRF-TOKEN': '{{ csrf_token() }}'
+                }
+            }).done(function (data) {
+                swal({
+                    type: 'success',
+                });
+                self.parent().parent().slideUp();
+            }).fail(function (jqXHR) {
+                console.error(jqXHR);
+                swal({
+                    type: 'error',
+                    title: 'Whoops!',
+                    text: 'An error occured while attempting to revoke this key.'
+                });
+            });
+        });
+    });
+});
+</script>
+@endsection
diff --git a/resources/views/admin/api/new.blade.php b/resources/views/admin/api/new.blade.php
new file mode 100644
index 000000000..e69de29bb
diff --git a/resources/views/layouts/admin.blade.php b/resources/views/layouts/admin.blade.php
index 34af132a1..a27e209c4 100644
--- a/resources/views/layouts/admin.blade.php
+++ b/resources/views/layouts/admin.blade.php
@@ -61,6 +61,7 @@
                         <a href="#" class="list-group-item list-group-item-heading"><strong>Management</strong></a>
                         <a href="/admin" id="sidenav_admin-index" class="list-group-item">Admin Index</a>
                         <a href="/admin/settings" class="list-group-item">General Settings</a>
+                        <a href="/admin/api" class="list-group-item">API Management</a>
                     </div>
                     <div class="list-group">
                         <a href="#" class="list-group-item list-group-item-heading"><strong>Account Management</strong></a>