Merge pull request 'Add application API keys' (#55) from codex/application-api-keys into main

Reviewed-on: OpenSource/KanbanGit#55

app/Actions/Tickets/ListAssignedTicketsByVisibleProject.php

@@ -0,0 +1,57 @@
+<?php
+
+namespace App\Actions\Tickets;
+
+use App\Actions\Projects\ListVisibleProjects;
+use App\Http\Resources\ProjectResource;
+use App\Http\Resources\TicketResource;
+use App\Models\Project;
+use App\Models\Ticket;
+use App\Models\User;
+use Illuminate\Database\Eloquent\Collection as EloquentCollection;
+use Illuminate\Support\Collection;
+
+class ListAssignedTicketsByVisibleProject
+{
+    public function __construct(
+        private readonly ListVisibleProjects $listVisibleProjects,
+    ) {}
+
+    /**
+     * @return array<int, array{project: array<string, mixed>, tickets: array<int, array<string, mixed>>}>
+     */
+    public function handle(User $viewer, User $assignee): array
+    {
+        /** @var EloquentCollection<int, Project> $visibleProjects */
+        $visibleProjects = $this->listVisibleProjects->handle($viewer);
+        $visibleProjectIds = $visibleProjects->pluck('id')->all();
+
+        if ($visibleProjectIds === []) {
+            return [];
+        }
+
+        /** @var Collection<int, Collection<int, Ticket>> $ticketsByProject */
+        $ticketsByProject = Ticket::query()
+            ->where('assignee_user_id', $assignee->id)
+            ->whereIn('project_id', $visibleProjectIds)
+            ->with([
+                'assignee',
+                'project',
+                'ticketPriority',
+                'ticketStatus.boardColumn',
+                'ticketType',
+            ])
+            ->orderByDesc('sequence_number')
+            ->get()
+            ->groupBy('project_id');
+
+        return $visibleProjects
+            ->filter(fn (Project $project): bool => $ticketsByProject->has($project->id))
+            ->map(fn (Project $project): array => [
+                'project' => ProjectResource::make($project)->resolve(),
+                'tickets' => TicketResource::collection($ticketsByProject->get($project->id))->resolve(),
+            ])
+            ->values()
+            ->all();
+    }
+}

app/Actions/UserApplications/CreateUserApplication.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace App\Actions\UserApplications;
+
+use App\Models\User;
+use App\Models\UserApplication;
+use Illuminate\Support\Arr;
+
+class CreateUserApplication
+{
+    /**
+     * @param  array{name: string}  $validated
+     * @return array{application: UserApplication, plain_text_key: string}
+     */
+    public function handle(User $user, array $validated): array
+    {
+        $plainTextKey = UserApplication::generatePlainTextKey();
+
+        $application = UserApplication::query()->create([
+            'key_hash' => UserApplication::hashKey($plainTextKey),
+            'name' => Arr::get($validated, 'name'),
+            'user_id' => $user->id,
+        ]);
+
+        return [
+            'application' => $application,
+            'plain_text_key' => $plainTextKey,
+        ];
+    }
+}

app/Actions/UserApplications/DeleteUserApplication.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace App\Actions\UserApplications;
+
+use App\Models\UserApplication;
+
+class DeleteUserApplication
+{
+    public function handle(UserApplication $application): string
+    {
+        $name = $application->name;
+
+        $application->delete();
+
+        return $name;
+    }
+}

app/Http/Controllers/Api/UserAssignedTicketController.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Actions\Tickets\ListAssignedTicketsByVisibleProject;
+use App\Http\Resources\UserResource;
+use App\Models\User;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+
+class UserAssignedTicketController extends ApiController
+{
+    public function __construct(
+        private readonly ListAssignedTicketsByVisibleProject $listAssignedTicketsByVisibleProject,
+    ) {}
+
+    public function __invoke(Request $request, User $user): JsonResponse
+    {
+        $viewer = $this->authenticatedUser($request);
+
+        $assignedTickets = $this->listAssignedTicketsByVisibleProject->handle($viewer, $user);
+
+        return response()->json([
+            'data' => $assignedTickets,
+            'meta' => [
+                'assignee' => $assignedTickets === []
+                    ? null
+                    : UserResource::make($user)->resolve(),
+            ],
+        ]);
+    }
+}

app/Http/Controllers/Settings/UserApplicationController.php

@@ -0,0 +1,57 @@
+<?php
+
+namespace App\Http\Controllers\Settings;
+
+use App\Actions\UserApplications\CreateUserApplication;
+use App\Actions\UserApplications\DeleteUserApplication;
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Settings\StoreUserApplicationRequest;
+use App\Http\Resources\UserApplicationResource;
+use App\Models\UserApplication;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Inertia\Inertia;
+use Inertia\Response;
+
+class UserApplicationController extends Controller
+{
+    public function __construct(
+        private readonly CreateUserApplication $createUserApplication,
+        private readonly DeleteUserApplication $deleteUserApplication,
+    ) {}
+
+    public function edit(Request $request): Response
+    {
+        return Inertia::render('settings/Applications', [
+            'applicationKey' => $request->session()->get('applicationKey'),
+            'applications' => UserApplicationResource::collection($request->user()->userApplications)->resolve(),
+            'status' => $request->session()->get('status'),
+        ]);
+    }
+
+    public function store(StoreUserApplicationRequest $request): RedirectResponse
+    {
+        $result = $this->createUserApplication->handle($request->user(), $request->validated());
+
+        return to_route('applications.edit')
+            ->with('applicationKey', $result['plain_text_key'])
+            ->with('status', "{$result['application']->name} was created. Save this key now; it will not be shown again.");
+    }
+
+    public function destroy(Request $request, UserApplication $userApplication): RedirectResponse
+    {
+        $this->abortUnlessOwner($request, $userApplication);
+
+        $name = $this->deleteUserApplication->handle($userApplication);
+
+        return to_route('applications.edit')
+            ->with('status', "{$name} was removed.");
+    }
+
+    private function abortUnlessOwner(Request $request, UserApplication $userApplication): void
+    {
+        $user = $request->user();
+
+        abort_unless($userApplication->user_id === $user->id, 403);
+    }
+}

app/Http/Middleware/AuthenticateApiApplicationKey.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Models\UserApplication;
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Symfony\Component\HttpFoundation\Response;
+
+class AuthenticateApiApplicationKey
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  Closure(Request): (Response)  $next
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        $plainTextKey = $request->bearerToken();
+
+        if ($plainTextKey === null || trim($plainTextKey) === '') {
+            return response()->json(['message' => 'Unauthenticated.'], 401);
+        }
+
+        $application = UserApplication::query()
+            ->with('user')
+            ->where('key_hash', UserApplication::hashKey($plainTextKey))
+            ->first();
+
+        if ($application === null || $application->user === null) {
+            return response()->json(['message' => 'Unauthenticated.'], 401);
+        }
+
+        Auth::setUser($application->user);
+        $request->setUserResolver(fn () => $application->user);
+
+        $application->forceFill([
+            'last_used_at' => now(),
+        ])->save();
+
+        return $next($request);
+    }
+}

app/Http/Requests/Settings/StoreUserApplicationRequest.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Http\Requests\Settings;
+
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Support\Str;
+
+class StoreUserApplicationRequest extends FormRequest
+{
+    /**
+     * Determine if the user is authorized to make this request.
+     */
+    public function authorize(): bool
+    {
+        return $this->user() !== null;
+    }
+
+    protected function prepareForValidation(): void
+    {
+        $this->merge([
+            'name' => Str::of((string) $this->input('name'))->trim()->value(),
+        ]);
+    }
+
+    /**
+     * Get the validation rules that apply to the request.
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:255'],
+        ];
+    }
+}

app/Http/Resources/UserApplicationResource.php

@@ -0,0 +1,26 @@
+<?php
+
+namespace App\Http\Resources;
+
+use Illuminate\Http\Request;
+use Illuminate\Http\Resources\Json\JsonResource;
+
+class UserApplicationResource extends JsonResource
+{
+    /**
+     * Transform the resource into an array.
+     *
+     * @return array<string, mixed>
+     */
+    public function toArray(Request $request): array
+    {
+        return [
+            'id' => $this->id,
+            'user_id' => $this->user_id,
+            'name' => $this->name,
+            'last_used_at' => $this->last_used_at?->toISOString(),
+            'created_at' => $this->created_at?->toISOString(),
+            'updated_at' => $this->updated_at?->toISOString(),
+        ];
+    }
+}

app/Models/User.php

@@ -63,6 +63,13 @@ class User extends Authenticatable
             ->orderBy('base_url');
     }
 
+    public function userApplications(): HasMany
+    {
+        return $this->hasMany(UserApplication::class)
+            ->orderBy('name')
+            ->orderBy('id');
+    }
+
     public function assignedTickets(): HasMany
     {
         return $this->hasMany(Ticket::class, 'assignee_user_id');

app/Models/UserApplication.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace App\Models;
+
+use Database\Factories\UserApplicationFactory;
+use Illuminate\Database\Eloquent\Attributes\Fillable;
+use Illuminate\Database\Eloquent\Attributes\Hidden;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Support\Str;
+
+#[Fillable(['key_hash', 'last_used_at', 'name', 'user_id'])]
+#[Hidden(['key_hash'])]
+class UserApplication extends Model
+{
+    /** @use HasFactory<UserApplicationFactory> */
+    use HasFactory;
+
+    public static function generatePlainTextKey(): string
+    {
+        return 'kg_app_'.Str::random(64);
+    }
+
+    public static function hashKey(string $plainTextKey): string
+    {
+        return hash_hmac('sha256', $plainTextKey, (string) config('app.key'));
+    }
+
+    /**
+     * @return array<string, string>
+     */
+    protected function casts(): array
+    {
+        return [
+            'last_used_at' => 'datetime',
+        ];
+    }
+
+    public function user(): BelongsTo
+    {
+        return $this->belongsTo(User::class);
+    }
+}