Feature/api create license 2 (#190)

* feat: implement an api endpoint to create a new license

* fix: format code

* feat: simplify api key

Author: SRWieZ

.env.example

@@ -85,3 +85,5 @@ ANYSTACK_FOREVER_POLICY_ID=
 ANYSTACK_TRIAL_POLICY_ID=
 
 FILAMENT_USERS=
+
+BIFROST_API_KEY=your-secure-api-key-here

app/Filament/Resources/PersonalAccessTokenResource.php

@@ -54,6 +54,7 @@ class Kernel extends HttpKernel
      */
     protected $middlewareAliases = [
         'auth' => \App\Http\Middleware\Authenticate::class,
+        'auth.api_key' => \App\Http\Middleware\AuthenticateApiKey::class,
         'auth.basic' => \Illuminate\Auth\Middleware\AuthenticateWithBasicAuth::class,
         'auth.session' => \Illuminate\Session\Middleware\AuthenticateSession::class,
         'cache.headers' => \Illuminate\Http\Middleware\SetCacheHeaders::class,

app/Filament/Resources/PersonalAccessTokenResource/Pages/CreatePersonalAccessToken.php

@@ -0,0 +1,38 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class AuthenticateApiKey
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Closure(\Illuminate\Http\Request): (\Symfony\Component\HttpFoundation\Response)  $next
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        $apiKey = config('services.bifrost.api_key');
+
+        if (! $apiKey) {
+            return response()->json(['message' => 'API key not configured'], 500);
+        }
+
+        $authHeader = $request->header('Authorization');
+
+        if (! $authHeader || ! str_starts_with($authHeader, 'Bearer ')) {
+            return response()->json(['message' => 'Unauthorized'], 401);
+        }
+
+        $providedKey = substr($authHeader, 7); // Remove 'Bearer ' prefix
+
+        if (! hash_equals($apiKey, $providedKey)) {
+            return response()->json(['message' => 'Unauthorized'], 401);
+        }
+
+        return $next($request);
+    }
+}

app/Filament/Resources/PersonalAccessTokenResource/Pages/EditPersonalAccessToken.php

@@ -34,4 +34,8 @@
     'anystack' => [
         'key' => env('ANYSTACK_API_KEY'),
     ],
+
+    'bifrost' => [
+        'api_key' => env('BIFROST_API_KEY'),
+    ],
 ];

app/Filament/Resources/PersonalAccessTokenResource/Pages/ListPersonalAccessTokens.php

@@ -44,5 +44,6 @@
         <env name="ANYSTACK_MINI_POLICY_ID" value="pol_mini"/>
         <env name="ANYSTACK_PRO_POLICY_ID" value="pol_pro"/>
         <env name="ANYSTACK_MAX_POLICY_ID" value="pol_max"/>
+        <env name="BIFROST_API_KEY" value="fake_key"/>
     </php>
 </phpunit>

app/Http/Kernel.php

@@ -15,7 +15,10 @@
 |
 */
 
+Route::middleware('auth.api_key')->group(function () {
+    Route::post('/licenses', [LicenseController::class, 'store']);
+});
+
 Route::middleware('auth:sanctum')->group(function () {
     Route::get('/user', fn (Request $request) => $request->user());
-    Route::post('/licenses', [LicenseController::class, 'store']);
 });