Skip to content

Commit d1ef43b

Browse files
9Insomnie9Insomnie
committed
fix: enforce API key project scope on provider endpoints
1 parent 89c0446 commit d1ef43b

18 files changed

Lines changed: 436 additions & 35 deletions

‎app/Actions/DNSProvider/CreateDNSProvider.php‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,12 @@
1111

1212
class CreateDNSProvider
1313
{
14-
public function create(User $user, array $input): DNSProvider
14+
public function create(User $user, array $input, ?int $projectId = null): DNSProvider
1515
{
1616
$this->validate($input);
1717

18+
$projectId ??= $user->currentProject?->id;
19+
1820
$provider = self::getProvider($input['provider']);
1921

2022
if (! $provider->connect($provider->credentialData($input))) {
@@ -30,7 +32,7 @@ public function create(User $user, array $input): DNSProvider
3032
$dnsProvider->name = $input['name'];
3133
$dnsProvider->provider = $input['provider'];
3234
$dnsProvider->credentials = $provider->credentialData($input);
33-
$dnsProvider->project_id = isset($input['global']) && $input['global'] ? null : $user->currentProject?->id;
35+
$dnsProvider->project_id = isset($input['global']) && $input['global'] ? null : $projectId;
3436
$dnsProvider->connected = true;
3537
$dnsProvider->save();
3638

‎app/Actions/ServerProvider/CreateServerProvider.php‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,12 @@ class CreateServerProvider
2121
*
2222
* @throws ValidationException
2323
*/
24-
public function create(User $user, array $input): ServerProvider
24+
public function create(User $user, array $input, ?int $projectId = null): ServerProvider
2525
{
2626
$this->validate($input);
2727

28+
$projectId ??= $user->currentProject?->id;
29+
2830
$provider = self::getProvider($input['provider']);
2931

3032
try {
@@ -42,7 +44,7 @@ public function create(User $user, array $input): ServerProvider
4244
$serverProvider->profile = $input['name'];
4345
$serverProvider->provider = $input['provider'];
4446
$serverProvider->credentials = $provider->credentialData($input);
45-
$serverProvider->project_id = isset($input['global']) && $input['global'] ? null : $user->currentProject?->id;
47+
$serverProvider->project_id = isset($input['global']) && $input['global'] ? null : $projectId;
4648
$serverProvider->save();
4749

4850
SocketEvent::dispatch(new SocketEventDTO(

‎app/Actions/SourceControl/ConnectSourceControl.php‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -15,15 +15,17 @@ class ConnectSourceControl
1515
*
1616
* @throws ValidationException
1717
*/
18-
public function connect(User $user, array $input): SourceControl
18+
public function connect(User $user, array $input, ?int $projectId = null): SourceControl
1919
{
2020
$this->validate($input);
2121

22+
$projectId ??= $user->currentProject?->id;
23+
2224
$sourceControl = new SourceControl([
2325
'provider' => $input['provider'],
2426
'profile' => $input['name'],
2527
'url' => isset($input['url']) && $input['url'] ? $input['url'] : null,
26-
'project_id' => isset($input['global']) && $input['global'] ? null : $user->currentProject?->id,
28+
'project_id' => isset($input['global']) && $input['global'] ? null : $projectId,
2729
'user_id' => $user->id,
2830
]);
2931

‎app/Actions/StorageProvider/CreateStorageProvider.php‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,15 +17,17 @@ class CreateStorageProvider
1717
*
1818
* @throws ValidationException
1919
*/
20-
public function create(User $user, array $input): StorageProvider
20+
public function create(User $user, array $input, ?int $projectId = null): StorageProvider
2121
{
2222
$this->validate($input);
2323

24+
$projectId ??= $user->currentProject?->id;
25+
2426
$storageProvider = new StorageProvider([
2527
'user_id' => $user->id,
2628
'provider' => $input['provider'],
2729
'profile' => $input['name'],
28-
'project_id' => isset($input['global']) && $input['global'] ? null : $user->currentProject?->id,
30+
'project_id' => isset($input['global']) && $input['global'] ? null : $projectId,
2931
]);
3032

3133
$storageProvider->credentials = $storageProvider->provider()->credentialData($input);

‎app/Http/Controllers/API/DNSProviderController.php‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
use App\Http\Controllers\Controller;
99
use App\Http\Resources\DNSProviderResource;
1010
use App\Models\DNSProvider;
11+
use App\Support\TokenProjectScope;
1112
use Illuminate\Http\JsonResponse;
1213
use Illuminate\Http\Request;
1314
use Illuminate\Http\Resources\Json\ResourceCollection;
@@ -27,9 +28,17 @@ public function index(): ResourceCollection
2728
{
2829
$this->authorize('viewAny', DNSProvider::class);
2930

30-
$dnsProviders = user()->dnsProviders()->simplePaginate(25);
31+
$user = user();
32+
$dnsProviders = $user->dnsProviders();
33+
34+
if (TokenProjectScope::restricted($user)) {
35+
$dnsProviders->where(function ($query) use ($user): void {
36+
$query->whereNull('project_id')
37+
->orWhereIn('project_id', TokenProjectScope::allowedProjectIds($user));
38+
});
39+
}
3140

32-
return DNSProviderResource::collection($dnsProviders);
41+
return DNSProviderResource::collection($dnsProviders->simplePaginate(25));
3342
}
3443

3544
#[Post('/', name: 'api.dns-providers.create', middleware: 'ability:write')]
@@ -38,7 +47,11 @@ public function create(Request $request): DNSProviderResource
3847
$this->authorize('create', DNSProvider::class);
3948

4049
$user = user();
41-
$dnsProvider = app(CreateDNSProvider::class)->create($user, $request->all());
50+
$projectId = $user->currentProject?->id;
51+
52+
abort_unless(TokenProjectScope::canCreate($user, $projectId, $request->boolean('global')), 403);
53+
54+
$dnsProvider = app(CreateDNSProvider::class)->create($user, $request->all(), $projectId);
4255

4356
return new DNSProviderResource($dnsProvider);
4457
}

‎app/Http/Controllers/API/ServerProviderController.php‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
use App\Http\Resources\ServerProviderResource;
1010
use App\Models\Project;
1111
use App\Models\ServerProvider;
12+
use App\Support\TokenProjectScope;
1213
use Illuminate\Http\JsonResponse;
1314
use Illuminate\Http\Request;
1415
use Illuminate\Http\Resources\Json\ResourceCollection;
@@ -49,7 +50,10 @@ public function create(Request $request, Project $project): ServerProviderResour
4950
$this->authorize('create', ServerProvider::class);
5051

5152
$user = user();
52-
$serverProvider = app(CreateServerProvider::class)->create($user, $request->all());
53+
54+
abort_unless(TokenProjectScope::canCreate($user, $project->id, $request->boolean('global')), 403);
55+
56+
$serverProvider = app(CreateServerProvider::class)->create($user, $request->all(), $project->id);
5357

5458
return new ServerProviderResource($serverProvider);
5559
}

‎app/Http/Controllers/API/SourceControlController.php‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
use App\Http\Resources\SourceControlResource;
1111
use App\Models\Project;
1212
use App\Models\SourceControl;
13+
use App\Support\TokenProjectScope;
1314
use Illuminate\Http\Request;
1415
use Illuminate\Http\Resources\Json\ResourceCollection;
1516
use Illuminate\Http\Response;
@@ -48,7 +49,11 @@ public function create(Request $request, Project $project): SourceControlResourc
4849
{
4950
$this->authorize('create', SourceControl::class);
5051

51-
$sourceControl = app(ConnectSourceControl::class)->connect(user(), $request->all());
52+
$user = user();
53+
54+
abort_unless(TokenProjectScope::canCreate($user, $project->id, $request->boolean('global')), 403);
55+
56+
$sourceControl = app(ConnectSourceControl::class)->connect($user, $request->all(), $project->id);
5257

5358
return new SourceControlResource($sourceControl);
5459
}

‎app/Http/Controllers/API/StorageProviderController.php‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
use App\Http\Resources\StorageProviderResource;
1010
use App\Models\Project;
1111
use App\Models\StorageProvider;
12+
use App\Support\TokenProjectScope;
1213
use Illuminate\Http\Request;
1314
use Illuminate\Http\Resources\Json\ResourceCollection;
1415
use Illuminate\Http\Response;
@@ -48,7 +49,10 @@ public function create(Request $request, Project $project): StorageProviderResou
4849
$this->authorize('create', StorageProvider::class);
4950

5051
$user = user();
51-
$storageProvider = app(CreateStorageProvider::class)->create($user, $request->all());
52+
53+
abort_unless(TokenProjectScope::canCreate($user, $project->id, $request->boolean('global')), 403);
54+
55+
$storageProvider = app(CreateStorageProvider::class)->create($user, $request->all(), $project->id);
5256

5357
return new StorageProviderResource($storageProvider);
5458
}

‎app/Http/Controllers/API/UserServerProviderController.php‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
use App\Http\Controllers\Controller;
99
use App\Http\Resources\ServerProviderResource;
1010
use App\Models\ServerProvider;
11+
use App\Support\TokenProjectScope;
1112
use Illuminate\Http\JsonResponse;
1213
use Illuminate\Http\Request;
1314
use Illuminate\Http\Resources\Json\ResourceCollection;
@@ -28,9 +29,17 @@ public function index(): ResourceCollection
2829
{
2930
$this->authorize('viewAny', ServerProvider::class);
3031

31-
$serverProviders = user()->serverProviders()->simplePaginate(25);
32+
$user = user();
33+
$serverProviders = $user->serverProviders();
34+
35+
if (TokenProjectScope::restricted($user)) {
36+
$serverProviders->where(function ($query) use ($user): void {
37+
$query->whereNull('project_id')
38+
->orWhereIn('project_id', TokenProjectScope::allowedProjectIds($user));
39+
});
40+
}
3241

33-
return ServerProviderResource::collection($serverProviders);
42+
return ServerProviderResource::collection($serverProviders->simplePaginate(25));
3443
}
3544

3645
#[Post('/', name: 'api.user.server-providers.create', middleware: 'ability:write')]
@@ -39,7 +48,11 @@ public function create(Request $request): ServerProviderResource
3948
$this->authorize('create', ServerProvider::class);
4049

4150
$user = user();
42-
$serverProvider = app(CreateServerProvider::class)->create($user, $request->all());
51+
$projectId = $user->currentProject?->id;
52+
53+
abort_unless(TokenProjectScope::canCreate($user, $projectId, $request->boolean('global')), 403);
54+
55+
$serverProvider = app(CreateServerProvider::class)->create($user, $request->all(), $projectId);
4356

4457
return new ServerProviderResource($serverProvider);
4558
}

‎app/Http/Controllers/API/UserSourceControlController.php‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
use App\Http\Controllers\Controller;
99
use App\Http\Resources\SourceControlResource;
1010
use App\Models\SourceControl;
11+
use App\Support\TokenProjectScope;
1112
use Illuminate\Http\Request;
1213
use Illuminate\Http\Resources\Json\ResourceCollection;
1314
use Illuminate\Http\Response;
@@ -27,9 +28,17 @@ public function index(): ResourceCollection
2728
{
2829
$this->authorize('viewAny', SourceControl::class);
2930

30-
$sourceControls = user()->sourceControls()->simplePaginate(25);
31+
$user = user();
32+
$sourceControls = $user->sourceControls();
33+
34+
if (TokenProjectScope::restricted($user)) {
35+
$sourceControls->where(function ($query) use ($user): void {
36+
$query->whereNull('project_id')
37+
->orWhereIn('project_id', TokenProjectScope::allowedProjectIds($user));
38+
});
39+
}
3140

32-
return SourceControlResource::collection($sourceControls);
41+
return SourceControlResource::collection($sourceControls->simplePaginate(25));
3342
}
3443

3544
#[Post('/', name: 'api.user.source-controls.create', middleware: 'ability:write')]
@@ -38,7 +47,11 @@ public function create(Request $request): SourceControlResource
3847
$this->authorize('create', SourceControl::class);
3948

4049
$user = user();
41-
$sourceControl = app(ConnectSourceControl::class)->connect($user, $request->all());
50+
$projectId = $user->currentProject?->id;
51+
52+
abort_unless(TokenProjectScope::canCreate($user, $projectId, $request->boolean('global')), 403);
53+
54+
$sourceControl = app(ConnectSourceControl::class)->connect($user, $request->all(), $projectId);
4255

4356
return new SourceControlResource($sourceControl);
4457
}

0 commit comments

Comments
 (0)