mirror of
https://github.com/opensourcepos/opensourcepos.git
synced 2026-05-30 03:07:56 -04:00
e45af91e2e
Implement comprehensive REST API for OSPOS with the following: Database: - Migration for ospos_api_keys table - Seeder for module permissions Models: - ApiKey model with key generation, validation, revocation - SHA-256 hashing for secure key storage - Support for key expiration Filters: - ApiAuth filter for X-API-Key header authentication - CSRF exemption for API routes Controllers: - Api/BaseController with response helpers and field transformation - Api/Customers (CRUD + batch delete, suggestions) - Api/Suppliers (CRUD + batch delete, suggestions) - Api/Items (CRUD + batch delete, quantities endpoint) - Api/Inventory (adjustments with set/adjust modes, bulk support) - ApiKeys (UI controller for key management) Routes: - /api/v1/* endpoints with apiauth filter - /office/api-keys/* endpoints for key management UI Tests: - ApiKeyTest for model functionality - ApiAuthTest for authentication filter Features: - camelCase JSON field names (API standard) - Offset/limit pagination - Soft delete support - Permission-based authorization - Key prefix for UI identification - Last used timestamp tracking Refs: #2463, #615, #3789, #3809, #1680, #876, #1959, #157
84 lines
2.5 KiB
PHP
84 lines
2.5 KiB
PHP
<?php
|
|
|
|
namespace App\Controllers;
|
|
|
|
use App\Models\ApiKey;
|
|
use App\Models\Employee;
|
|
|
|
class ApiKeys extends Secure_Controller
|
|
{
|
|
protected ApiKey $apiKeyModel;
|
|
|
|
public function __construct()
|
|
{
|
|
parent::__construct('api_keys');
|
|
$this->apiKeyModel = model(ApiKey::class);
|
|
}
|
|
|
|
public function index(): void
|
|
{
|
|
$employeeId = $this->employee->get_logged_in_employee_info()->person_id;
|
|
$keys = $this->apiKeyModel->getKeysForEmployee($employeeId);
|
|
|
|
echo view('api_keys/manage', [
|
|
'keys' => $keys,
|
|
'employee_info' => $this->employee->get_logged_in_employee_info()
|
|
]);
|
|
}
|
|
|
|
public function generate(): void
|
|
{
|
|
$employeeId = $this->employee->get_logged_in_employee_info()->person_id;
|
|
$name = $this->request->getPost('name');
|
|
$expiresAt = $this->request->getPost('expires_at') ?: null;
|
|
|
|
$apiKey = $this->apiKeyModel->generateKey($employeeId, $name, $expiresAt);
|
|
|
|
if ($apiKey) {
|
|
echo json_encode([
|
|
'success' => true,
|
|
'message' => lang('Api_keys.key_generated'),
|
|
'apiKey' => $apiKey,
|
|
'keyPrefix' => substr($apiKey, 0, 12) . '...'
|
|
]);
|
|
} else {
|
|
echo json_encode([
|
|
'success' => false,
|
|
'message' => lang('Api_keys.key_generation_failed')
|
|
]);
|
|
}
|
|
}
|
|
|
|
public function revoke(int $apiKeyId): void
|
|
{
|
|
$employeeId = $this->employee->get_logged_in_employee_info()->person_id;
|
|
|
|
$success = $this->apiKeyModel->revokeKey($apiKeyId, $employeeId);
|
|
|
|
echo json_encode([
|
|
'success' => $success,
|
|
'message' => $success ? lang('Api_keys.key_revoked') : lang('Api_keys.key_revoke_failed')
|
|
]);
|
|
}
|
|
|
|
public function regenerate(int $apiKeyId): void
|
|
{
|
|
$employeeId = $this->employee->get_logged_in_employee_info()->person_id;
|
|
|
|
$newKey = $this->apiKeyModel->regenerateKey($apiKeyId, $employeeId);
|
|
|
|
if ($newKey) {
|
|
echo json_encode([
|
|
'success' => true,
|
|
'message' => lang('Api_keys.key_regenerated'),
|
|
'apiKey' => $newKey,
|
|
'keyPrefix' => substr($newKey, 0, 12) . '...'
|
|
]);
|
|
} else {
|
|
echo json_encode([
|
|
'success' => false,
|
|
'message' => lang('Api_keys.key_regeneration_failed')
|
|
]);
|
|
}
|
|
}
|
|
} |