Push basis of new API key policy

Will need to revisit this another day when I’m fresh to figure out the
best method to do this.

Author: DaneEveritt

app/Http/Controllers/API/Admin/ServerController.php

@@ -60,9 +60,17 @@ public function index(Request $request)
     public function view(Request $request, $id)
     {
         $server = Server::findOrFail($id);
-
         $fractal = Fractal::create()->item($server);
 
+        // dd($request->user()->can('view-node', $request->apiKey()));
+
+        // Have the api key model return a list of includes that would be allowed
+        // given the permissions they have aleady been granted?
+        //
+        // If someone has 'view-node' they would then be able to use ->parseIncludes(['*.node.*']);
+        // How that logic will work is beyond me currently, but should keep things
+        // fairly clean?
+
         if ($request->input('include')) {
             $fractal->parseIncludes(explode(',', $request->input('include')));
         }

app/Http/Middleware/HMACAuthorization.php

@@ -92,6 +92,7 @@ public function handle(Request $request, Closure $next)
 
         $this->checkBearer();
         $this->validateRequest();
+        $this->validateIPAccess();
         $this->validateContents();
 
         Auth::loginUsingId($this->key()->user_id);
@@ -137,23 +138,6 @@ protected function validateRequest()
         if (! $this->key) {
             throw new AccessDeniedHttpException('Unable to identify requester. Authorization token is invalid.');
         }
-
-        if (empty($this->request()->route()->getName())) {
-            throw new \Exception('Attempting to access un-named route. This should not be possible.');
-        }
-
-        $this->validateIPAccess();
-
-        $query = APIPermission::where('key_id', $this->key()->id)
-            ->where('permission', $this->request()->route()->getName());
-
-        if (starts_with($this->request()->route()->getName(), 'api.user')) {
-            $query->orWhere('permission', 'api.user.*');
-        }
-
-        if (! $query->first()) {
-            throw new AccessDeniedHttpException('You do not have permission to access this resource on the API.');
-        }
     }
 
     /**

app/Policies/APIKeyPolicy.php

@@ -0,0 +1,77 @@
+<?php
+/**
+ * Pterodactyl - Panel
+ * Copyright (c) 2015 - 2017 Dane Everitt <dane@daneeveritt.com>.
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in all
+ * copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+
+namespace Pterodactyl\Policies;
+
+use Cache;
+use Carbon;
+use Pterodactyl\Models\User;
+use Pterodactyl\Models\APIKey as Key;
+use Pterodactyl\Models\APIPermission as Permission;
+
+class APIKeyPolicy
+{
+    /**
+     * Checks if the API key has permission to perform an action.
+     *
+     * @param \Pterodactyl\Models\User   $user
+     * @param \Pterodactyl\Models\APIKey $key
+     * @param string                     $permission
+     * @return bool
+     */
+    private function checkPermission(User $user, Key $key, $permission)
+    {
+        $permissions = Cache::remember('APIKeyPolicy.' . $user->uuid . $key->public, Carbon::now()->addSeconds(5), function () use ($key) {
+            return $key->permissions()->get()->transform(function ($item) {
+                return $item->permission;
+            })->values();
+        });
+
+        return $permissions->search($permission, true) !== false;
+    }
+
+    /**
+     * Determine if API key is allowed to view all nodes.
+     *
+     * @param  \Pterodactyl\Models\User    $user
+     * @param  \Pterodactyl\Models\APIKey  $key
+     * @return bool
+     */
+    public function listNodes(User $user, Key $key)
+    {
+        return $this->checkPermission($user, $key, 'list-nodes');
+    }
+
+    /**
+     * Determine if API key is allowed to view a specific node.
+     *
+     * @param  \Pterodactyl\Models\User    $user
+     * @param  \Pterodactyl\Models\APIKey  $key
+     * @return bool
+     */
+    public function viewNode(User $user, Key $key)
+    {
+        return $this->checkPermission($user, $key, 'view-node');
+    }
+}

app/Policies/ServerPolicy.php

@@ -45,7 +45,7 @@ private function checkPermission(User $user, Server $server, $permission)
             return true;
         }
 
-        $permissions = Cache::remember('ServerPolicy.' . $user->uuid . $server->uuid, Carbon::now()->addSeconds(10), function () use ($user, $server) {
+        $permissions = Cache::remember('ServerPolicy.' . $user->uuid . $server->uuid, Carbon::now()->addSeconds(5), function () use ($user, $server) {
             return $user->permissions()->server($server)->get()->transform(function ($item) {
                 return $item->permission;
             })->values();

app/Providers/AuthServiceProvider.php

@@ -13,6 +13,7 @@ class AuthServiceProvider extends ServiceProvider
      */
     protected $policies = [
         'Pterodactyl\Models\Server' => 'Pterodactyl\Policies\ServerPolicy',
+        'Pterodactyl\Models\APIKey' => 'Pterodactyl\Policies\APIKeyPolicy',
     ];
 
     /**

app/Providers/MacroServiceProvider.php

@@ -25,6 +25,7 @@
 namespace Pterodactyl\Providers;
 
 use File;
+use Request;
 use Illuminate\Support\ServiceProvider;
 
 class MacroServiceProvider extends ServiceProvider
@@ -48,5 +49,19 @@ public function boot()
 
             return round($size, ($i < 2) ? 0 : $precision) . ' ' . $units[$i];
         });
+
+        Request::macro('apiKey', function () {
+            if (! Request::bearerToken()) {
+                return false;
+            }
+
+            $parts = explode('.', Request::bearerToken());
+
+            if (count($parts) === 2) {
+                return \Pterodactyl\Models\APIKey::where('public', $parts[0])->first();
+            }
+
+            return false;
+        });
     }
 }