Skip to content

Commit c52fe57

Browse files
andrasbacsaiandrasbacsai
authored
Merge pull request coollabsio#3576 from peaklabs-dev/fix-api-enabeled
Fix: Disable API by default and do not allow API key creation when API is disabled
2 parents 4995675 + 111e9ba commit c52fe57

File tree

3 files changed

+72
-56
lines changed

3 files changed

+72
-56
lines changed

‎app/Livewire/Security/ApiTokens.php

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
namespace App\Livewire\Security;
44

5+
use App\Models\InstanceSettings;
56
use Livewire\Component;
67

78
class ApiTokens extends Component
@@ -16,13 +17,18 @@ class ApiTokens extends Component
1617

1718
public array $permissions = ['read-only'];
1819

20+
public $instanceSettings;
21+
1922
public function render()
2023
{
21-
return view('livewire.security.api-tokens');
24+
return view('livewire.security.api-tokens', [
25+
'instanceSettings' => $this->instanceSettings,
26+
]);
2227
}
2328

2429
public function mount()
2530
{
31+
$this->instanceSettings = InstanceSettings::get();
2632
$this->tokens = auth()->user()->tokens->sortByDesc('created_at');
2733
}
2834

‎database/migrations/2024_09_26_083441_disable_api_by_default.php

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
<?php
2+
3+
use Illuminate\Database\Migrations\Migration;
4+
use Illuminate\Database\Schema\Blueprint;
5+
use Illuminate\Support\Facades\Schema;
6+
7+
return new class extends Migration
8+
{
9+
/**
10+
* Run the migrations.
11+
*/
12+
public function up(): void
13+
{
14+
Schema::table('instance_settings', function (Blueprint $table) {
15+
$table->boolean('is_api_enabled')->default(false)->change();
16+
});
17+
}
18+
};

‎resources/views/livewire/security/api-tokens.blade.php

Lines changed: 47 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -1,79 +1,71 @@
11
<div>
22
<x-slot:title>
33
API Tokens | Coolify
4-
</x-slot>
5-
<x-security.navbar />
6-
<div class="pb-4 ">
7-
<h2>API Tokens</h2>
8-
<div>Tokens are created with the current team as scope. You will only have access to this team's resources.
9-
</div>
10-
</div>
11-
<h3>New Token</h3>
12-
<form class="flex flex-col gap-2 pt-4" wire:submit='addNewToken'>
13-
<div class="flex items-end gap-2">
14-
<x-forms.input required id="description" label="Description" />
15-
<x-forms.button type="submit">Create New Token</x-forms.button>
4+
</x-slot>
5+
<x-security.navbar />
6+
<div class="pb-4 ">
7+
<h2>API Tokens</h2>
8+
@if (!$instanceSettings->is_api_enabled)
9+
<strong>API is disabled. If you want to use the API, please enable it in the Coolify Instance Settings.</strong>
10+
@else
11+
<div>Tokens are created with the current team as scope. You will only have access to this team's resources.
12+
</div>
1613
</div>
17-
<div class="flex">
18-
Permissions <x-helper class="px-1" helper="These permissions will be granted to the token." /><span
19-
class="pr-1">:</span>
20-
<div class="flex gap-1 font-bold dark:text-white">
21-
@if ($permissions)
14+
<h3>New Token</h3>
15+
<form class="flex flex-col gap-2 pt-4" wire:submit='addNewToken'>
16+
<div class="flex items-end gap-2">
17+
<x-forms.input required id="description" label="Description" />
18+
<x-forms.button type="submit">Create New Token</x-forms.button>
19+
</div>
20+
<div class="flex">
21+
Permissions
22+
<x-helper class="px-1" helper="These permissions will be granted to the token." /><span class="pr-1">:</span>
23+
<div class="flex gap-1 font-bold dark:text-white">
24+
@if ($permissions)
2225
@foreach ($permissions as $permission)
23-
@if ($permission === '*')
24-
<div>All (root/admin access), be careful!</div>
25-
@else
26-
<div>{{ $permission }}</div>
27-
@endif
26+
@if ($permission === '*')
27+
<div>All (root/admin access), be careful!</div>
28+
@else
29+
<div>{{ $permission }}</div>
30+
@endif
2831
@endforeach
29-
@endif
32+
@endif
33+
</div>
3034
</div>
31-
</div>
32-
<h4>Token Permissions</h4>
33-
<div class="w-64">
34-
<x-forms.checkbox label="Read-only" wire:model.live="readOnly"></x-forms.checkbox>
35-
<x-forms.checkbox label="View Sensitive Data" wire:model.live="viewSensitiveData"></x-forms.checkbox>
36-
</div>
37-
</form>
38-
@if (session()->has('token'))
35+
<h4>Token Permissions</h4>
36+
<div class="w-64">
37+
<x-forms.checkbox label="Read-only" wire:model.live="readOnly"></x-forms.checkbox>
38+
<x-forms.checkbox label="View Sensitive Data" wire:model.live="viewSensitiveData"></x-forms.checkbox>
39+
</div>
40+
</form>
41+
@if (session()->has('token'))
3942
<div class="py-4 font-bold dark:text-warning">Please copy this token now. For your security, it won't be shown
4043
again.
4144
</div>
4245
<div class="pb-4 font-bold dark:text-white"> {{ session('token') }}</div>
43-
@endif
44-
<h3 class="py-4">Issued Tokens</h3>
45-
<div class="grid gap-2 lg:grid-cols-1">
46-
@forelse ($tokens as $token)
46+
@endif
47+
<h3 class="py-4">Issued Tokens</h3>
48+
<div class="grid gap-2 lg:grid-cols-1">
49+
@forelse ($tokens as $token)
4750
<div class="flex flex-col gap-1 p-2 border dark:border-coolgray-200 hover:no-underline">
4851
<div>Description: {{ $token->name }}</div>
4952
<div>Last used: {{ $token->last_used_at ? $token->last_used_at->diffForHumans() : 'Never' }}</div>
5053
<div class="flex gap-1">
5154
@if ($token->abilities)
52-
Abilities:
53-
@foreach ($token->abilities as $ability)
54-
<div class="font-bold dark:text-white">{{ $ability }}</div>
55-
@endforeach
55+
Abilities:
56+
@foreach ($token->abilities as $ability)
57+
<div class="font-bold dark:text-white">{{ $ability }}</div>
58+
@endforeach
5659
@endif
5760
</div>
5861

59-
<x-modal-confirmation
60-
title="Confirm API Token Revocation?"
61-
isErrorButton
62-
buttonTitle="Revoke token"
63-
submitAction="revoke({{ data_get($token, 'id') }})"
64-
:actions="['This API Token will be revoked and permanently deleted.', 'Any API call made with this token will fail.']"
65-
confirmationText="{{ $token->name }}"
66-
confirmationLabel="Please confirm the execution of the actions by entering the API Token Description below"
67-
shortConfirmationLabel="API Token Description"
68-
:confirmWithPassword="false"
69-
step2ButtonText="Revoke API Token"
70-
/>
62+
<x-modal-confirmation title="Confirm API Token Revocation?" isErrorButton buttonTitle="Revoke token" submitAction="revoke({{ data_get($token, 'id') }})" :actions="['This API Token will be revoked and permanently deleted.', 'Any API call made with this token will fail.']" confirmationText="{{ $token->name }}" confirmationLabel="Please confirm the execution of the actions by entering the API Token Description below" shortConfirmationLabel="API Token Description" :confirmWithPassword="false" step2ButtonText="Revoke API Token" />
7163
</div>
72-
@empty
64+
@empty
7365
<div>
7466
<div>No API tokens found.</div>
7567
</div>
76-
@endforelse
77-
</div>
78-
68+
@endforelse
69+
</div>
70+
@endif
7971
</div>

0 commit comments

Comments
 (0)