From 47b895a98a3c98ae9980370008ab1bf8f3845d43 Mon Sep 17 00:00:00 2001 From: Dane Everitt Date: Wed, 4 Aug 2021 21:14:14 -0700 Subject: [PATCH] Update existing application API to use simplified user permission checking --- .../Http/ClientPermissionsRequest.php | 13 -- .../Servers/ExternalServerController.php | 7 +- .../Users/ExternalUserController.php | 7 +- .../Middleware/Api/ApiSubstituteBindings.php | 10 -- app/Http/Requests/Api/ApiRequest.php | 80 ++++++++++++ .../Allocations/DeleteAllocationRequest.php | 23 ---- .../Allocations/GetAllocationsRequest.php | 15 --- .../Allocations/StoreAllocationRequest.php | 4 - .../Api/Application/ApplicationApiRequest.php | 115 ++---------------- .../Databases/DeleteDatabaseRequest.php | 11 -- .../Databases/GetDatabaseRequest.php | 8 -- .../Databases/GetDatabasesRequest.php | 3 - .../Databases/StoreDatabaseRequest.php | 4 - .../Api/Application/Eggs/DeleteEggRequest.php | 4 - .../Api/Application/Eggs/GetEggRequest.php | 8 -- .../Api/Application/Eggs/GetEggsRequest.php | 3 - .../Api/Application/Eggs/StoreEggRequest.php | 4 - .../Locations/DeleteLocationRequest.php | 11 -- .../Locations/GetLocationRequest.php | 8 -- .../Locations/GetLocationsRequest.php | 3 - .../Locations/StoreLocationRequest.php | 4 - .../Locations/UpdateLocationRequest.php | 7 -- .../Application/Mounts/DeleteMountRequest.php | 11 -- .../Application/Mounts/GetMountRequest.php | 8 -- .../Application/Mounts/GetMountsRequest.php | 3 - .../Application/Mounts/MountEggsRequest.php | 4 - .../Application/Mounts/MountNodesRequest.php | 4 - .../Application/Mounts/StoreMountRequest.php | 4 - .../Application/Nests/DeleteNestRequest.php | 11 -- .../Api/Application/Nests/GetNestRequest.php | 8 -- .../Api/Application/Nests/GetNestsRequest.php | 3 - .../Application/Nests/StoreNestRequest.php | 9 -- .../Application/Nodes/DeleteNodeRequest.php | 11 -- .../Api/Application/Nodes/GetNodeRequest.php | 8 -- .../Api/Application/Nodes/GetNodesRequest.php | 3 - .../Application/Nodes/StoreNodeRequest.php | 4 - .../Application/Roles/DeleteRoleRequest.php | 11 -- .../Api/Application/Roles/GetRoleRequest.php | 8 -- .../Api/Application/Roles/GetRolesRequest.php | 3 - .../Application/Roles/StoreRoleRequest.php | 4 - .../Databases/GetServerDatabaseRequest.php | 11 -- .../Databases/GetServerDatabasesRequest.php | 3 - .../Databases/ServerDatabaseWriteRequest.php | 3 - .../Databases/StoreServerDatabaseRequest.php | 4 - .../Servers/GetExternalServerRequest.php | 27 ---- .../Application/Servers/GetServerRequest.php | 3 - .../Servers/ServerWriteRequest.php | 3 - .../Servers/StoreServerRequest.php | 8 +- .../Servers/UpdateServerStartupRequest.php | 4 - .../Application/Users/DeleteUserRequest.php | 11 -- .../Users/GetExternalUserRequest.php | 27 ---- .../Api/Application/Users/GetUserRequest.php | 8 -- .../Api/Application/Users/GetUsersRequest.php | 3 - .../Application/Users/StoreUserRequest.php | 4 - .../Requests/Api/Client/ClientApiRequest.php | 12 +- .../Servers/Settings/RenameServerRequest.php | 1 - app/Http/Requests/FrontendUserFormRequest.php | 40 ------ 57 files changed, 109 insertions(+), 532 deletions(-) delete mode 100644 app/Contracts/Http/ClientPermissionsRequest.php create mode 100644 app/Http/Requests/Api/ApiRequest.php delete mode 100644 app/Http/Requests/FrontendUserFormRequest.php diff --git a/app/Contracts/Http/ClientPermissionsRequest.php b/app/Contracts/Http/ClientPermissionsRequest.php deleted file mode 100644 index 85eae2259..000000000 --- a/app/Contracts/Http/ClientPermissionsRequest.php +++ /dev/null @@ -1,13 +0,0 @@ -fractal->item($request->getServerModel()) + $server = Server::query()->where('external_id', $external_id)->firstOrFail(); + + return $this->fractal->item($server) ->transformWith($this->getTransformer(ServerTransformer::class)) ->toArray(); } diff --git a/app/Http/Controllers/Api/Application/Users/ExternalUserController.php b/app/Http/Controllers/Api/Application/Users/ExternalUserController.php index ab1083d26..b7d653c32 100644 --- a/app/Http/Controllers/Api/Application/Users/ExternalUserController.php +++ b/app/Http/Controllers/Api/Application/Users/ExternalUserController.php @@ -2,6 +2,7 @@ namespace Pterodactyl\Http\Controllers\Api\Application\Users; +use Pterodactyl\Models\User; use Pterodactyl\Transformers\Api\Application\UserTransformer; use Pterodactyl\Http\Controllers\Api\Application\ApplicationApiController; use Pterodactyl\Http\Requests\Api\Application\Users\GetExternalUserRequest; @@ -13,9 +14,11 @@ class ExternalUserController extends ApplicationApiController * * @throws \Illuminate\Contracts\Container\BindingResolutionException */ - public function index(GetExternalUserRequest $request): array + public function index(GetExternalUserRequest $request, string $external_id): array { - return $this->fractal->item($request->getUserModel()) + $user = User::query()->where('external_id', $external_id)->firstOrFail(); + + return $this->fractal->item($user) ->transformWith($this->getTransformer(UserTransformer::class)) ->toArray(); } diff --git a/app/Http/Middleware/Api/ApiSubstituteBindings.php b/app/Http/Middleware/Api/ApiSubstituteBindings.php index 7ade7452a..e67956aa4 100644 --- a/app/Http/Middleware/Api/ApiSubstituteBindings.php +++ b/app/Http/Middleware/Api/ApiSubstituteBindings.php @@ -74,14 +74,4 @@ class ApiSubstituteBindings extends SubstituteBindings return $next($request); } - - /** - * Return the registered mappings. - * - * @return array - */ - public static function getMappings() - { - return self::$mappings; - } } diff --git a/app/Http/Requests/Api/ApiRequest.php b/app/Http/Requests/Api/ApiRequest.php new file mode 100644 index 000000000..79296bdba --- /dev/null +++ b/app/Http/Requests/Api/ApiRequest.php @@ -0,0 +1,80 @@ +passesAuthorization()) { + $this->failedAuthorization(); + } + + $this->hasValidated = true; + } + + /* + * Determine if the request passes the authorization check as well + * as the exists check. + * + * @return bool + * + * @throws \Symfony\Component\HttpKernel\Exception\NotFoundHttpException + */ + protected function passesAuthorization() + { + // If we have already validated we do not need to call this function + // again. This is needed to work around Laravel's normal auth validation + // that occurs after validating the request params since we are doing auth + // validation in the prepareForValidation() function. + if ($this->hasValidated) { + return true; + } + + if (!parent::passesAuthorization()) { + return false; + } + + // Only let the user know that a resource does not exist if they are + // authenticated to access the endpoint. This avoids exposing that + // an item exists (or does not exist) to the user until they can prove + // that they have permission to know about it. + if ($this->attributes->get('is_missing_model', false)) { + throw new NotFoundHttpException(trans('exceptions.api.resource_not_found')); + } + + return true; + } +} diff --git a/app/Http/Requests/Api/Application/Allocations/DeleteAllocationRequest.php b/app/Http/Requests/Api/Application/Allocations/DeleteAllocationRequest.php index 1729d7209..d062f7648 100644 --- a/app/Http/Requests/Api/Application/Allocations/DeleteAllocationRequest.php +++ b/app/Http/Requests/Api/Application/Allocations/DeleteAllocationRequest.php @@ -2,31 +2,8 @@ namespace Pterodactyl\Http\Requests\Api\Application\Allocations; -use Pterodactyl\Models\Node; -use Pterodactyl\Models\Allocation; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class DeleteAllocationRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_ALLOCATIONS; - protected int $permission = AdminAcl::WRITE; - - /** - * Determine if the requested allocation exists and belongs to the node that - * is being passed in the URL. - */ - public function resourceExists(): bool - { - $node = $this->route()->parameter('node'); - $allocation = $this->route()->parameter('allocation'); - - if ($node instanceof Node && $node->exists) { - if ($allocation instanceof Allocation && $allocation->exists && $allocation->node_id === $node->id) { - return true; - } - } - - return false; - } } diff --git a/app/Http/Requests/Api/Application/Allocations/GetAllocationsRequest.php b/app/Http/Requests/Api/Application/Allocations/GetAllocationsRequest.php index b811fe526..2f536af60 100644 --- a/app/Http/Requests/Api/Application/Allocations/GetAllocationsRequest.php +++ b/app/Http/Requests/Api/Application/Allocations/GetAllocationsRequest.php @@ -2,23 +2,8 @@ namespace Pterodactyl\Http\Requests\Api\Application\Allocations; -use Pterodactyl\Models\Node; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class GetAllocationsRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_ALLOCATIONS; - protected int $permission = AdminAcl::READ; - - /** - * Determine if the node that we are requesting the allocations - * for exists on the Panel. - */ - public function resourceExists(): bool - { - $node = $this->route()->parameter('node'); - - return $node instanceof Node && $node->exists; - } } diff --git a/app/Http/Requests/Api/Application/Allocations/StoreAllocationRequest.php b/app/Http/Requests/Api/Application/Allocations/StoreAllocationRequest.php index 5bd79970d..dd97e1332 100644 --- a/app/Http/Requests/Api/Application/Allocations/StoreAllocationRequest.php +++ b/app/Http/Requests/Api/Application/Allocations/StoreAllocationRequest.php @@ -2,14 +2,10 @@ namespace Pterodactyl\Http\Requests\Api\Application\Allocations; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class StoreAllocationRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_ALLOCATIONS; - protected int $permission = AdminAcl::WRITE; - public function rules(): array { return [ diff --git a/app/Http/Requests/Api/Application/ApplicationApiRequest.php b/app/Http/Requests/Api/Application/ApplicationApiRequest.php index 29e09b4f5..6a6dc48b3 100644 --- a/app/Http/Requests/Api/Application/ApplicationApiRequest.php +++ b/app/Http/Requests/Api/Application/ApplicationApiRequest.php @@ -2,119 +2,18 @@ namespace Pterodactyl\Http\Requests\Api\Application; -use Pterodactyl\Models\ApiKey; -use Illuminate\Foundation\Http\FormRequest; -use Pterodactyl\Http\Middleware\Api\ApiSubstituteBindings; -use Symfony\Component\HttpKernel\Exception\NotFoundHttpException; -use Symfony\Component\Routing\Exception\InvalidParameterException; +use Pterodactyl\Http\Requests\Api\ApiRequest; -abstract class ApplicationApiRequest extends FormRequest +abstract class ApplicationApiRequest extends ApiRequest { /** - * Tracks if the request has been validated internally or not to avoid - * making duplicate validation calls. - */ - private bool $hasValidated = false; - - /** - * Determine if the current user is authorized to perform the requested - * action against the API. + * This will eventually be replaced with per-request permissions checking + * on the API key and for the user. + * + * @return bool */ public function authorize(): bool { - return false; - } - - /** - * Determine if the requested resource exists on the server. - */ - public function resourceExists(): bool - { - return true; - } - - /** - * Default set of rules to apply to API requests. - */ - public function rules(): array - { - return []; - } - - /** - * Return the API key being used for the request. - */ - public function key(): ApiKey - { - return $this->attributes->get('api_key'); - } - - /** - * Grab a model from the route parameters. If no model is found in the - * binding mappings an exception will be thrown. - * - * @return mixed - * - * @deprecated - * - * @throws \Symfony\Component\Routing\Exception\InvalidParameterException - */ - public function getModel(string $model) - { - $parameterKey = array_get(array_flip(ApiSubstituteBindings::getMappings()), $model); - - if (is_null($parameterKey)) { - throw new InvalidParameterException(); - } - - return $this->route()->parameter($parameterKey); - } - - /** - * Validate that the resource exists and can be accessed prior to booting - * the validator and attempting to use the data. - * - * @throws \Illuminate\Auth\Access\AuthorizationException - */ - protected function prepareForValidation() - { - if (!$this->passesAuthorization()) { - $this->failedAuthorization(); - } - - $this->hasValidated = true; - } - - /* - * Determine if the request passes the authorization check as well - * as the exists check. - * - * @return bool - * - * @throws \Symfony\Component\HttpKernel\Exception\NotFoundHttpException - */ - protected function passesAuthorization() - { - // If we have already validated we do not need to call this function - // again. This is needed to work around Laravel's normal auth validation - // that occurs after validating the request params since we are doing auth - // validation in the prepareForValidation() function. - if ($this->hasValidated) { - return true; - } - - if (!parent::passesAuthorization()) { - return false; - } - - // Only let the user know that a resource does not exist if they are - // authenticated to access the endpoint. This avoids exposing that - // an item exists (or does not exist) to the user until they can prove - // that they have permission to know about it. - if ($this->attributes->get('is_missing_model', false) || !$this->resourceExists()) { - throw new NotFoundHttpException(trans('exceptions.api.resource_not_found')); - } - - return true; + return $this->user()->root_admin; } } diff --git a/app/Http/Requests/Api/Application/Databases/DeleteDatabaseRequest.php b/app/Http/Requests/Api/Application/Databases/DeleteDatabaseRequest.php index 0efd8e5d0..cde56da1c 100644 --- a/app/Http/Requests/Api/Application/Databases/DeleteDatabaseRequest.php +++ b/app/Http/Requests/Api/Application/Databases/DeleteDatabaseRequest.php @@ -2,19 +2,8 @@ namespace Pterodactyl\Http\Requests\Api\Application\Databases; -use Pterodactyl\Models\DatabaseHost; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class DeleteDatabaseRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_DATABASE_HOSTS; - protected int $permission = AdminAcl::WRITE; - - public function resourceExists(): bool - { - $databaseHost = $this->route()->parameter('databaseHost'); - - return $databaseHost instanceof DatabaseHost && $databaseHost->exists; - } } diff --git a/app/Http/Requests/Api/Application/Databases/GetDatabaseRequest.php b/app/Http/Requests/Api/Application/Databases/GetDatabaseRequest.php index 166064f9f..9392096e3 100644 --- a/app/Http/Requests/Api/Application/Databases/GetDatabaseRequest.php +++ b/app/Http/Requests/Api/Application/Databases/GetDatabaseRequest.php @@ -2,14 +2,6 @@ namespace Pterodactyl\Http\Requests\Api\Application\Databases; -use Pterodactyl\Models\DatabaseHost; - class GetDatabaseRequest extends GetDatabasesRequest { - public function resourceExists(): bool - { - $databaseHost = $this->route()->parameter('databaseHost'); - - return $databaseHost instanceof DatabaseHost && $databaseHost->exists; - } } diff --git a/app/Http/Requests/Api/Application/Databases/GetDatabasesRequest.php b/app/Http/Requests/Api/Application/Databases/GetDatabasesRequest.php index feb2c8ad0..f55da515b 100644 --- a/app/Http/Requests/Api/Application/Databases/GetDatabasesRequest.php +++ b/app/Http/Requests/Api/Application/Databases/GetDatabasesRequest.php @@ -2,11 +2,8 @@ namespace Pterodactyl\Http\Requests\Api\Application\Databases; -use Pterodactyl\Services\Acl\Api\AdminAcl as Acl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class GetDatabasesRequest extends ApplicationApiRequest { - protected string $resource = Acl::RESOURCE_DATABASE_HOSTS; - protected int $permission = Acl::READ; } diff --git a/app/Http/Requests/Api/Application/Databases/StoreDatabaseRequest.php b/app/Http/Requests/Api/Application/Databases/StoreDatabaseRequest.php index 600a93efa..2bfce7dbb 100644 --- a/app/Http/Requests/Api/Application/Databases/StoreDatabaseRequest.php +++ b/app/Http/Requests/Api/Application/Databases/StoreDatabaseRequest.php @@ -3,14 +3,10 @@ namespace Pterodactyl\Http\Requests\Api\Application\Databases; use Pterodactyl\Models\DatabaseHost; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class StoreDatabaseRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_DATABASE_HOSTS; - protected int $permission = AdminAcl::WRITE; - public function rules(array $rules = null): array { return $rules ?? DatabaseHost::getRules(); diff --git a/app/Http/Requests/Api/Application/Eggs/DeleteEggRequest.php b/app/Http/Requests/Api/Application/Eggs/DeleteEggRequest.php index a3ce1f2c3..154f06efd 100644 --- a/app/Http/Requests/Api/Application/Eggs/DeleteEggRequest.php +++ b/app/Http/Requests/Api/Application/Eggs/DeleteEggRequest.php @@ -3,14 +3,10 @@ namespace Pterodactyl\Http\Requests\Api\Application\Eggs; use Pterodactyl\Models\Egg; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class DeleteEggRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_EGGS; - protected int $permission = AdminAcl::WRITE; - public function resourceExists(): bool { $egg = $this->route()->parameter('egg'); diff --git a/app/Http/Requests/Api/Application/Eggs/GetEggRequest.php b/app/Http/Requests/Api/Application/Eggs/GetEggRequest.php index a01d6db37..ba79e08b0 100644 --- a/app/Http/Requests/Api/Application/Eggs/GetEggRequest.php +++ b/app/Http/Requests/Api/Application/Eggs/GetEggRequest.php @@ -2,14 +2,6 @@ namespace Pterodactyl\Http\Requests\Api\Application\Eggs; -use Pterodactyl\Models\Egg; - class GetEggRequest extends GetEggsRequest { - public function resourceExists(): bool - { - $egg = $this->route()->parameter('egg'); - - return $egg instanceof Egg && $egg->exists; - } } diff --git a/app/Http/Requests/Api/Application/Eggs/GetEggsRequest.php b/app/Http/Requests/Api/Application/Eggs/GetEggsRequest.php index fb2015a3f..4b18cd02c 100644 --- a/app/Http/Requests/Api/Application/Eggs/GetEggsRequest.php +++ b/app/Http/Requests/Api/Application/Eggs/GetEggsRequest.php @@ -2,11 +2,8 @@ namespace Pterodactyl\Http\Requests\Api\Application\Eggs; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class GetEggsRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_EGGS; - protected int $permission = AdminAcl::READ; } diff --git a/app/Http/Requests/Api/Application/Eggs/StoreEggRequest.php b/app/Http/Requests/Api/Application/Eggs/StoreEggRequest.php index 7b3cad7e5..6759615c9 100644 --- a/app/Http/Requests/Api/Application/Eggs/StoreEggRequest.php +++ b/app/Http/Requests/Api/Application/Eggs/StoreEggRequest.php @@ -3,14 +3,10 @@ namespace Pterodactyl\Http\Requests\Api\Application\Eggs; use Pterodactyl\Models\Egg; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class StoreEggRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_EGGS; - protected int $permission = AdminAcl::WRITE; - public function rules(array $rules = null): array { return $rules ?? Egg::getRules(); diff --git a/app/Http/Requests/Api/Application/Locations/DeleteLocationRequest.php b/app/Http/Requests/Api/Application/Locations/DeleteLocationRequest.php index ba97ec198..eb2cffd34 100644 --- a/app/Http/Requests/Api/Application/Locations/DeleteLocationRequest.php +++ b/app/Http/Requests/Api/Application/Locations/DeleteLocationRequest.php @@ -2,19 +2,8 @@ namespace Pterodactyl\Http\Requests\Api\Application\Locations; -use Pterodactyl\Models\Location; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class DeleteLocationRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_LOCATIONS; - protected int $permission = AdminAcl::WRITE; - - public function resourceExists(): bool - { - $location = $this->route()->parameter('location'); - - return $location instanceof Location && $location->exists; - } } diff --git a/app/Http/Requests/Api/Application/Locations/GetLocationRequest.php b/app/Http/Requests/Api/Application/Locations/GetLocationRequest.php index 59c3605dd..dea82db33 100644 --- a/app/Http/Requests/Api/Application/Locations/GetLocationRequest.php +++ b/app/Http/Requests/Api/Application/Locations/GetLocationRequest.php @@ -2,14 +2,6 @@ namespace Pterodactyl\Http\Requests\Api\Application\Locations; -use Pterodactyl\Models\Location; - class GetLocationRequest extends GetLocationsRequest { - public function resourceExists(): bool - { - $location = $this->route()->parameter('location'); - - return $location instanceof Location && $location->exists; - } } diff --git a/app/Http/Requests/Api/Application/Locations/GetLocationsRequest.php b/app/Http/Requests/Api/Application/Locations/GetLocationsRequest.php index 1a79846ef..dea300b91 100644 --- a/app/Http/Requests/Api/Application/Locations/GetLocationsRequest.php +++ b/app/Http/Requests/Api/Application/Locations/GetLocationsRequest.php @@ -2,11 +2,8 @@ namespace Pterodactyl\Http\Requests\Api\Application\Locations; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class GetLocationsRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_LOCATIONS; - protected int $permission = AdminAcl::READ; } diff --git a/app/Http/Requests/Api/Application/Locations/StoreLocationRequest.php b/app/Http/Requests/Api/Application/Locations/StoreLocationRequest.php index 08f9a1da6..9b403fa10 100644 --- a/app/Http/Requests/Api/Application/Locations/StoreLocationRequest.php +++ b/app/Http/Requests/Api/Application/Locations/StoreLocationRequest.php @@ -3,14 +3,10 @@ namespace Pterodactyl\Http\Requests\Api\Application\Locations; use Pterodactyl\Models\Location; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class StoreLocationRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_LOCATIONS; - protected int $permission = AdminAcl::WRITE; - public function rules(): array { return collect(Location::getRules())->only([ diff --git a/app/Http/Requests/Api/Application/Locations/UpdateLocationRequest.php b/app/Http/Requests/Api/Application/Locations/UpdateLocationRequest.php index 6229870ba..91ece11fe 100644 --- a/app/Http/Requests/Api/Application/Locations/UpdateLocationRequest.php +++ b/app/Http/Requests/Api/Application/Locations/UpdateLocationRequest.php @@ -6,13 +6,6 @@ use Pterodactyl\Models\Location; class UpdateLocationRequest extends StoreLocationRequest { - public function resourceExists(): bool - { - $location = $this->route()->parameter('location'); - - return $location instanceof Location && $location->exists; - } - public function rules(): array { $locationId = $this->route()->parameter('location')->id; diff --git a/app/Http/Requests/Api/Application/Mounts/DeleteMountRequest.php b/app/Http/Requests/Api/Application/Mounts/DeleteMountRequest.php index 0bef09b67..1325510f2 100644 --- a/app/Http/Requests/Api/Application/Mounts/DeleteMountRequest.php +++ b/app/Http/Requests/Api/Application/Mounts/DeleteMountRequest.php @@ -2,19 +2,8 @@ namespace Pterodactyl\Http\Requests\Api\Application\Mounts; -use Pterodactyl\Models\Mount; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class DeleteMountRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_MOUNTS; - protected int $permission = AdminAcl::WRITE; - - public function resourceExists(): bool - { - $mount = $this->route()->parameter('mount'); - - return $mount instanceof Mount && $mount->exists; - } } diff --git a/app/Http/Requests/Api/Application/Mounts/GetMountRequest.php b/app/Http/Requests/Api/Application/Mounts/GetMountRequest.php index e6fa96b26..aa30dee02 100644 --- a/app/Http/Requests/Api/Application/Mounts/GetMountRequest.php +++ b/app/Http/Requests/Api/Application/Mounts/GetMountRequest.php @@ -2,14 +2,6 @@ namespace Pterodactyl\Http\Requests\Api\Application\Mounts; -use Pterodactyl\Models\Mount; - class GetMountRequest extends GetMountsRequest { - public function resourceExists(): bool - { - $mount = $this->route()->parameter('mount'); - - return $mount instanceof Mount && $mount->exists; - } } diff --git a/app/Http/Requests/Api/Application/Mounts/GetMountsRequest.php b/app/Http/Requests/Api/Application/Mounts/GetMountsRequest.php index c56268625..28fe6ddbc 100644 --- a/app/Http/Requests/Api/Application/Mounts/GetMountsRequest.php +++ b/app/Http/Requests/Api/Application/Mounts/GetMountsRequest.php @@ -2,11 +2,8 @@ namespace Pterodactyl\Http\Requests\Api\Application\Mounts; -use Pterodactyl\Services\Acl\Api\AdminAcl as Acl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class GetMountsRequest extends ApplicationApiRequest { - protected string $resource = Acl::RESOURCE_MOUNTS; - protected int $permission = Acl::READ; } diff --git a/app/Http/Requests/Api/Application/Mounts/MountEggsRequest.php b/app/Http/Requests/Api/Application/Mounts/MountEggsRequest.php index 504247a2e..c29180824 100644 --- a/app/Http/Requests/Api/Application/Mounts/MountEggsRequest.php +++ b/app/Http/Requests/Api/Application/Mounts/MountEggsRequest.php @@ -2,14 +2,10 @@ namespace Pterodactyl\Http\Requests\Api\Application\Mounts; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class MountEggsRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_MOUNTS; - protected int $permission = AdminAcl::WRITE; - public function rules(array $rules = null): array { return $rules ?? ['eggs' => 'required|exists:eggs,id']; diff --git a/app/Http/Requests/Api/Application/Mounts/MountNodesRequest.php b/app/Http/Requests/Api/Application/Mounts/MountNodesRequest.php index 5922677e6..4810591a8 100644 --- a/app/Http/Requests/Api/Application/Mounts/MountNodesRequest.php +++ b/app/Http/Requests/Api/Application/Mounts/MountNodesRequest.php @@ -2,14 +2,10 @@ namespace Pterodactyl\Http\Requests\Api\Application\Mounts; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class MountNodesRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_MOUNTS; - protected int $permission = AdminAcl::WRITE; - public function rules(array $rules = null): array { return $rules ?? ['nodes' => 'required|exists:nodes,id']; diff --git a/app/Http/Requests/Api/Application/Mounts/StoreMountRequest.php b/app/Http/Requests/Api/Application/Mounts/StoreMountRequest.php index e6e4f423f..ba678d186 100644 --- a/app/Http/Requests/Api/Application/Mounts/StoreMountRequest.php +++ b/app/Http/Requests/Api/Application/Mounts/StoreMountRequest.php @@ -3,14 +3,10 @@ namespace Pterodactyl\Http\Requests\Api\Application\Mounts; use Pterodactyl\Models\Mount; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class StoreMountRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_MOUNTS; - protected int $permission = AdminAcl::WRITE; - public function rules(array $rules = null): array { return $rules ?? Mount::getRules(); diff --git a/app/Http/Requests/Api/Application/Nests/DeleteNestRequest.php b/app/Http/Requests/Api/Application/Nests/DeleteNestRequest.php index 92fbde617..8d505c93e 100644 --- a/app/Http/Requests/Api/Application/Nests/DeleteNestRequest.php +++ b/app/Http/Requests/Api/Application/Nests/DeleteNestRequest.php @@ -2,19 +2,8 @@ namespace Pterodactyl\Http\Requests\Api\Application\Nests; -use Pterodactyl\Models\Nest; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class DeleteNestRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_NESTS; - protected int $permission = AdminAcl::WRITE; - - public function resourceExists(): bool - { - $nest = $this->route()->parameter('nest'); - - return $nest instanceof Nest && $nest->exists; - } } diff --git a/app/Http/Requests/Api/Application/Nests/GetNestRequest.php b/app/Http/Requests/Api/Application/Nests/GetNestRequest.php index 370d7eab0..efc220dca 100644 --- a/app/Http/Requests/Api/Application/Nests/GetNestRequest.php +++ b/app/Http/Requests/Api/Application/Nests/GetNestRequest.php @@ -2,14 +2,6 @@ namespace Pterodactyl\Http\Requests\Api\Application\Nests; -use Pterodactyl\Models\Nest; - class GetNestRequest extends GetNestsRequest { - public function resourceExists(): bool - { - $nest = $this->route()->parameter('nest'); - - return $nest instanceof Nest && $nest->exists; - } } diff --git a/app/Http/Requests/Api/Application/Nests/GetNestsRequest.php b/app/Http/Requests/Api/Application/Nests/GetNestsRequest.php index ec04e8edb..899f15101 100644 --- a/app/Http/Requests/Api/Application/Nests/GetNestsRequest.php +++ b/app/Http/Requests/Api/Application/Nests/GetNestsRequest.php @@ -2,11 +2,8 @@ namespace Pterodactyl\Http\Requests\Api\Application\Nests; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class GetNestsRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_NESTS; - protected int $permission = AdminAcl::READ; } diff --git a/app/Http/Requests/Api/Application/Nests/StoreNestRequest.php b/app/Http/Requests/Api/Application/Nests/StoreNestRequest.php index 5be1f4be9..abb72dc5c 100644 --- a/app/Http/Requests/Api/Application/Nests/StoreNestRequest.php +++ b/app/Http/Requests/Api/Application/Nests/StoreNestRequest.php @@ -2,17 +2,8 @@ namespace Pterodactyl\Http\Requests\Api\Application\Nests; -use Pterodactyl\Models\Nest; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class StoreNestRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_NESTS; - protected int $permission = AdminAcl::WRITE; - - public function rules(array $rules = null): array - { - return $rules ?? Nest::getRules(); - } } diff --git a/app/Http/Requests/Api/Application/Nodes/DeleteNodeRequest.php b/app/Http/Requests/Api/Application/Nodes/DeleteNodeRequest.php index f9806ecbf..4bd5159d0 100644 --- a/app/Http/Requests/Api/Application/Nodes/DeleteNodeRequest.php +++ b/app/Http/Requests/Api/Application/Nodes/DeleteNodeRequest.php @@ -2,19 +2,8 @@ namespace Pterodactyl\Http\Requests\Api\Application\Nodes; -use Pterodactyl\Models\Node; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class DeleteNodeRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_NODES; - protected int $permission = AdminAcl::WRITE; - - public function resourceExists(): bool - { - $node = $this->route()->parameter('node'); - - return $node instanceof Node && $node->exists; - } } diff --git a/app/Http/Requests/Api/Application/Nodes/GetNodeRequest.php b/app/Http/Requests/Api/Application/Nodes/GetNodeRequest.php index d8098a0d9..6d231bc97 100644 --- a/app/Http/Requests/Api/Application/Nodes/GetNodeRequest.php +++ b/app/Http/Requests/Api/Application/Nodes/GetNodeRequest.php @@ -2,14 +2,6 @@ namespace Pterodactyl\Http\Requests\Api\Application\Nodes; -use Pterodactyl\Models\Node; - class GetNodeRequest extends GetNodesRequest { - public function resourceExists(): bool - { - $node = $this->route()->parameter('node'); - - return $node instanceof Node && $node->exists; - } } diff --git a/app/Http/Requests/Api/Application/Nodes/GetNodesRequest.php b/app/Http/Requests/Api/Application/Nodes/GetNodesRequest.php index 4df2c8523..ac6191ea5 100644 --- a/app/Http/Requests/Api/Application/Nodes/GetNodesRequest.php +++ b/app/Http/Requests/Api/Application/Nodes/GetNodesRequest.php @@ -2,11 +2,8 @@ namespace Pterodactyl\Http\Requests\Api\Application\Nodes; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class GetNodesRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_NODES; - protected int $permission = AdminAcl::READ; } diff --git a/app/Http/Requests/Api/Application/Nodes/StoreNodeRequest.php b/app/Http/Requests/Api/Application/Nodes/StoreNodeRequest.php index 9ce8b37de..6ff6b0170 100644 --- a/app/Http/Requests/Api/Application/Nodes/StoreNodeRequest.php +++ b/app/Http/Requests/Api/Application/Nodes/StoreNodeRequest.php @@ -3,14 +3,10 @@ namespace Pterodactyl\Http\Requests\Api\Application\Nodes; use Pterodactyl\Models\Node; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class StoreNodeRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_NODES; - protected int $permission = AdminAcl::WRITE; - /** * Validation rules to apply to this request. */ diff --git a/app/Http/Requests/Api/Application/Roles/DeleteRoleRequest.php b/app/Http/Requests/Api/Application/Roles/DeleteRoleRequest.php index 02d042aca..5f6cd34b5 100644 --- a/app/Http/Requests/Api/Application/Roles/DeleteRoleRequest.php +++ b/app/Http/Requests/Api/Application/Roles/DeleteRoleRequest.php @@ -2,19 +2,8 @@ namespace Pterodactyl\Http\Requests\Api\Application\Roles; -use Pterodactyl\Models\AdminRole; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class DeleteRoleRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_ROLES; - protected int $permission = AdminAcl::WRITE; - - public function resourceExists(): bool - { - $role = $this->route()->parameter('role'); - - return $role instanceof AdminRole && $role->exists; - } } diff --git a/app/Http/Requests/Api/Application/Roles/GetRoleRequest.php b/app/Http/Requests/Api/Application/Roles/GetRoleRequest.php index 287323ed6..f8c71d954 100644 --- a/app/Http/Requests/Api/Application/Roles/GetRoleRequest.php +++ b/app/Http/Requests/Api/Application/Roles/GetRoleRequest.php @@ -2,14 +2,6 @@ namespace Pterodactyl\Http\Requests\Api\Application\Roles; -use Pterodactyl\Models\AdminRole; - class GetRoleRequest extends GetRolesRequest { - public function resourceExists(): bool - { - $role = $this->route()->parameter('role'); - - return $role instanceof AdminRole && $role->exists; - } } diff --git a/app/Http/Requests/Api/Application/Roles/GetRolesRequest.php b/app/Http/Requests/Api/Application/Roles/GetRolesRequest.php index 3384b3efd..89b5e5fb0 100644 --- a/app/Http/Requests/Api/Application/Roles/GetRolesRequest.php +++ b/app/Http/Requests/Api/Application/Roles/GetRolesRequest.php @@ -2,11 +2,8 @@ namespace Pterodactyl\Http\Requests\Api\Application\Roles; -use Pterodactyl\Services\Acl\Api\AdminAcl as Acl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class GetRolesRequest extends ApplicationApiRequest { - protected string $resource = Acl::RESOURCE_ROLES; - protected int $permission = Acl::READ; } diff --git a/app/Http/Requests/Api/Application/Roles/StoreRoleRequest.php b/app/Http/Requests/Api/Application/Roles/StoreRoleRequest.php index 7e1b6521c..5690dd683 100644 --- a/app/Http/Requests/Api/Application/Roles/StoreRoleRequest.php +++ b/app/Http/Requests/Api/Application/Roles/StoreRoleRequest.php @@ -3,14 +3,10 @@ namespace Pterodactyl\Http\Requests\Api\Application\Roles; use Pterodactyl\Models\AdminRole; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class StoreRoleRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_ROLES; - protected int $permission = AdminAcl::WRITE; - public function rules(array $rules = null): array { return $rules ?? AdminRole::getRules(); diff --git a/app/Http/Requests/Api/Application/Servers/Databases/GetServerDatabaseRequest.php b/app/Http/Requests/Api/Application/Servers/Databases/GetServerDatabaseRequest.php index 66e5781a0..dd1dd2fd1 100644 --- a/app/Http/Requests/Api/Application/Servers/Databases/GetServerDatabaseRequest.php +++ b/app/Http/Requests/Api/Application/Servers/Databases/GetServerDatabaseRequest.php @@ -2,19 +2,8 @@ namespace Pterodactyl\Http\Requests\Api\Application\Servers\Databases; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class GetServerDatabaseRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_SERVER_DATABASES; - protected int $permission = AdminAcl::READ; - - public function resourceExists(): bool - { - $server = $this->route()->parameter('server'); - $database = $this->route()->parameter('database'); - - return $database->server_id === $server->id; - } } diff --git a/app/Http/Requests/Api/Application/Servers/Databases/GetServerDatabasesRequest.php b/app/Http/Requests/Api/Application/Servers/Databases/GetServerDatabasesRequest.php index 22349eb6e..74f942278 100644 --- a/app/Http/Requests/Api/Application/Servers/Databases/GetServerDatabasesRequest.php +++ b/app/Http/Requests/Api/Application/Servers/Databases/GetServerDatabasesRequest.php @@ -2,11 +2,8 @@ namespace Pterodactyl\Http\Requests\Api\Application\Servers\Databases; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class GetServerDatabasesRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_SERVER_DATABASES; - protected int $permission = AdminAcl::READ; } diff --git a/app/Http/Requests/Api/Application/Servers/Databases/ServerDatabaseWriteRequest.php b/app/Http/Requests/Api/Application/Servers/Databases/ServerDatabaseWriteRequest.php index 66cec82c3..827d68c55 100644 --- a/app/Http/Requests/Api/Application/Servers/Databases/ServerDatabaseWriteRequest.php +++ b/app/Http/Requests/Api/Application/Servers/Databases/ServerDatabaseWriteRequest.php @@ -2,9 +2,6 @@ namespace Pterodactyl\Http\Requests\Api\Application\Servers\Databases; -use Pterodactyl\Services\Acl\Api\AdminAcl; - class ServerDatabaseWriteRequest extends GetServerDatabasesRequest { - protected int $permission = AdminAcl::WRITE; } diff --git a/app/Http/Requests/Api/Application/Servers/Databases/StoreServerDatabaseRequest.php b/app/Http/Requests/Api/Application/Servers/Databases/StoreServerDatabaseRequest.php index 69413a14f..f8549075a 100644 --- a/app/Http/Requests/Api/Application/Servers/Databases/StoreServerDatabaseRequest.php +++ b/app/Http/Requests/Api/Application/Servers/Databases/StoreServerDatabaseRequest.php @@ -6,15 +6,11 @@ use Webmozart\Assert\Assert; use Pterodactyl\Models\Server; use Illuminate\Validation\Rule; use Illuminate\Database\Query\Builder; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Services\Databases\DatabaseManagementService; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class StoreServerDatabaseRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_SERVER_DATABASES; - protected int $permission = AdminAcl::WRITE; - public function rules(): array { $server = $this->route()->parameter('server'); diff --git a/app/Http/Requests/Api/Application/Servers/GetExternalServerRequest.php b/app/Http/Requests/Api/Application/Servers/GetExternalServerRequest.php index bcbd87da0..790f55798 100644 --- a/app/Http/Requests/Api/Application/Servers/GetExternalServerRequest.php +++ b/app/Http/Requests/Api/Application/Servers/GetExternalServerRequest.php @@ -2,35 +2,8 @@ namespace Pterodactyl\Http\Requests\Api\Application\Servers; -use Pterodactyl\Models\Server; -use Pterodactyl\Services\Acl\Api\AdminAcl; -use Pterodactyl\Exceptions\Repository\RecordNotFoundException; -use Pterodactyl\Contracts\Repository\ServerRepositoryInterface; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class GetExternalServerRequest extends ApplicationApiRequest { - private Server $serverModel; - protected string $resource = AdminAcl::RESOURCE_SERVERS; - protected int $permission = AdminAcl::READ; - - public function resourceExists(): bool - { - $repository = $this->container->make(ServerRepositoryInterface::class); - - try { - $this->serverModel = $repository->findFirstWhere([ - ['external_id', '=', $this->route()->parameter('external_id')], - ]); - } catch (RecordNotFoundException $exception) { - return false; - } - - return true; - } - - public function getServerModel(): Server - { - return $this->serverModel; - } } diff --git a/app/Http/Requests/Api/Application/Servers/GetServerRequest.php b/app/Http/Requests/Api/Application/Servers/GetServerRequest.php index adc79c2fd..2f4f417cd 100644 --- a/app/Http/Requests/Api/Application/Servers/GetServerRequest.php +++ b/app/Http/Requests/Api/Application/Servers/GetServerRequest.php @@ -2,11 +2,8 @@ namespace Pterodactyl\Http\Requests\Api\Application\Servers; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class GetServerRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_SERVERS; - protected int $permission = AdminAcl::READ; } diff --git a/app/Http/Requests/Api/Application/Servers/ServerWriteRequest.php b/app/Http/Requests/Api/Application/Servers/ServerWriteRequest.php index 2d5ab7d84..e8d01a115 100644 --- a/app/Http/Requests/Api/Application/Servers/ServerWriteRequest.php +++ b/app/Http/Requests/Api/Application/Servers/ServerWriteRequest.php @@ -2,11 +2,8 @@ namespace Pterodactyl\Http\Requests\Api\Application\Servers; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class ServerWriteRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_SERVERS; - protected int $permission = AdminAcl::WRITE; } diff --git a/app/Http/Requests/Api/Application/Servers/StoreServerRequest.php b/app/Http/Requests/Api/Application/Servers/StoreServerRequest.php index 737dd54a3..3e42ab62a 100644 --- a/app/Http/Requests/Api/Application/Servers/StoreServerRequest.php +++ b/app/Http/Requests/Api/Application/Servers/StoreServerRequest.php @@ -4,16 +4,12 @@ namespace Pterodactyl\Http\Requests\Api\Application\Servers; use Pterodactyl\Models\Server; use Illuminate\Validation\Rule; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Illuminate\Contracts\Validation\Validator; use Pterodactyl\Models\Objects\DeploymentObject; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class StoreServerRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_SERVERS; - protected int $permission = AdminAcl::WRITE; - public function rules(): array { $rules = Server::getRules(); @@ -93,7 +89,9 @@ class StoreServerRequest extends ApplicationApiRequest public function withValidator(Validator $validator) { $validator->sometimes('allocation.default', [ - 'required', 'integer', 'bail', + 'required', + 'integer', + 'bail', Rule::exists('allocations', 'id')->where(function ($query) { $query->whereNull('server_id'); }), diff --git a/app/Http/Requests/Api/Application/Servers/UpdateServerStartupRequest.php b/app/Http/Requests/Api/Application/Servers/UpdateServerStartupRequest.php index 7cfb0ff37..05d9bb0f6 100644 --- a/app/Http/Requests/Api/Application/Servers/UpdateServerStartupRequest.php +++ b/app/Http/Requests/Api/Application/Servers/UpdateServerStartupRequest.php @@ -3,14 +3,10 @@ namespace Pterodactyl\Http\Requests\Api\Application\Servers; use Pterodactyl\Models\Server; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class UpdateServerStartupRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_SERVERS; - protected int $permission = AdminAcl::WRITE; - public function rules(): array { $data = Server::getRulesForUpdate($this->route()->parameter('server')->id); diff --git a/app/Http/Requests/Api/Application/Users/DeleteUserRequest.php b/app/Http/Requests/Api/Application/Users/DeleteUserRequest.php index 185277614..a2e3841fb 100644 --- a/app/Http/Requests/Api/Application/Users/DeleteUserRequest.php +++ b/app/Http/Requests/Api/Application/Users/DeleteUserRequest.php @@ -2,19 +2,8 @@ namespace Pterodactyl\Http\Requests\Api\Application\Users; -use Pterodactyl\Models\User; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class DeleteUserRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_USERS; - protected int $permission = AdminAcl::WRITE; - - public function resourceExists(): bool - { - $user = $this->route()->parameter('user'); - - return $user instanceof User && $user->exists; - } } diff --git a/app/Http/Requests/Api/Application/Users/GetExternalUserRequest.php b/app/Http/Requests/Api/Application/Users/GetExternalUserRequest.php index d432ae3d9..b26ef7661 100644 --- a/app/Http/Requests/Api/Application/Users/GetExternalUserRequest.php +++ b/app/Http/Requests/Api/Application/Users/GetExternalUserRequest.php @@ -2,35 +2,8 @@ namespace Pterodactyl\Http\Requests\Api\Application\Users; -use Pterodactyl\Models\User; -use Pterodactyl\Services\Acl\Api\AdminAcl; -use Pterodactyl\Contracts\Repository\UserRepositoryInterface; -use Pterodactyl\Exceptions\Repository\RecordNotFoundException; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class GetExternalUserRequest extends ApplicationApiRequest { - private User $userModel; - protected string $resource = AdminAcl::RESOURCE_USERS; - protected int $permission = AdminAcl::READ; - - public function resourceExists(): bool - { - $repository = $this->container->make(UserRepositoryInterface::class); - - try { - $this->userModel = $repository->findFirstWhere([ - ['external_id', '=', $this->route()->parameter('external_id')], - ]); - } catch (RecordNotFoundException $exception) { - return false; - } - - return true; - } - - public function getUserModel(): User - { - return $this->userModel; - } } diff --git a/app/Http/Requests/Api/Application/Users/GetUserRequest.php b/app/Http/Requests/Api/Application/Users/GetUserRequest.php index 417cfd59a..4e16088a5 100644 --- a/app/Http/Requests/Api/Application/Users/GetUserRequest.php +++ b/app/Http/Requests/Api/Application/Users/GetUserRequest.php @@ -2,14 +2,6 @@ namespace Pterodactyl\Http\Requests\Api\Application\Users; -use Pterodactyl\Models\User; - class GetUserRequest extends GetUsersRequest { - public function resourceExists(): bool - { - $user = $this->route()->parameter('user'); - - return $user instanceof User && $user->exists; - } } diff --git a/app/Http/Requests/Api/Application/Users/GetUsersRequest.php b/app/Http/Requests/Api/Application/Users/GetUsersRequest.php index 406883f7e..466eaf1aa 100644 --- a/app/Http/Requests/Api/Application/Users/GetUsersRequest.php +++ b/app/Http/Requests/Api/Application/Users/GetUsersRequest.php @@ -2,11 +2,8 @@ namespace Pterodactyl\Http\Requests\Api\Application\Users; -use Pterodactyl\Services\Acl\Api\AdminAcl as Acl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class GetUsersRequest extends ApplicationApiRequest { - protected string $resource = Acl::RESOURCE_USERS; - protected int $permission = Acl::READ; } diff --git a/app/Http/Requests/Api/Application/Users/StoreUserRequest.php b/app/Http/Requests/Api/Application/Users/StoreUserRequest.php index cdc4255c0..ad20272cc 100644 --- a/app/Http/Requests/Api/Application/Users/StoreUserRequest.php +++ b/app/Http/Requests/Api/Application/Users/StoreUserRequest.php @@ -3,14 +3,10 @@ namespace Pterodactyl\Http\Requests\Api\Application\Users; use Pterodactyl\Models\User; -use Pterodactyl\Services\Acl\Api\AdminAcl; use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; class StoreUserRequest extends ApplicationApiRequest { - protected string $resource = AdminAcl::RESOURCE_USERS; - protected int $permission = AdminAcl::WRITE; - public function rules(array $rules = null): array { $rules = $rules ?? User::getRules(); diff --git a/app/Http/Requests/Api/Client/ClientApiRequest.php b/app/Http/Requests/Api/Client/ClientApiRequest.php index f4622f84a..48a9b9e78 100644 --- a/app/Http/Requests/Api/Client/ClientApiRequest.php +++ b/app/Http/Requests/Api/Client/ClientApiRequest.php @@ -3,11 +3,17 @@ namespace Pterodactyl\Http\Requests\Api\Client; use Pterodactyl\Models\Server; -use Pterodactyl\Contracts\Http\ClientPermissionsRequest; -use Pterodactyl\Http\Requests\Api\Application\ApplicationApiRequest; +use Pterodactyl\Http\Requests\Api\ApiRequest; -abstract class ClientApiRequest extends ApplicationApiRequest implements ClientPermissionsRequest +abstract class ClientApiRequest extends ApiRequest { + /** + * Returns the permissions string indicating which permission should be used to + * validate that the authenticated user has permission to perform this action aganist + * the given resource (server). + */ + abstract public function permission(): string; + /** * Determine if the current user is authorized to perform the requested action * against the API. diff --git a/app/Http/Requests/Api/Client/Servers/Settings/RenameServerRequest.php b/app/Http/Requests/Api/Client/Servers/Settings/RenameServerRequest.php index f27666eb3..2c9eb8178 100644 --- a/app/Http/Requests/Api/Client/Servers/Settings/RenameServerRequest.php +++ b/app/Http/Requests/Api/Client/Servers/Settings/RenameServerRequest.php @@ -4,7 +4,6 @@ namespace Pterodactyl\Http\Requests\Api\Client\Servers\Settings; use Pterodactyl\Models\Server; use Pterodactyl\Models\Permission; -use Pterodactyl\Contracts\Http\ClientPermissionsRequest; use Pterodactyl\Http\Requests\Api\Client\ClientApiRequest; class RenameServerRequest extends ClientApiRequest diff --git a/app/Http/Requests/FrontendUserFormRequest.php b/app/Http/Requests/FrontendUserFormRequest.php deleted file mode 100644 index b5553dc16..000000000 --- a/app/Http/Requests/FrontendUserFormRequest.php +++ /dev/null @@ -1,40 +0,0 @@ -. - * - * This software is licensed under the terms of the MIT license. - * https://opensource.org/licenses/MIT - */ - -namespace Pterodactyl\Http\Requests; - -use Illuminate\Foundation\Http\FormRequest; - -abstract class FrontendUserFormRequest extends FormRequest -{ - abstract public function rules(); - - /** - * Determine if a user is authorized to access this endpoint. - * - * @return bool - */ - public function authorize() - { - return !is_null($this->user()); - } - - /** - * Return only the fields that we are interested in from the request. - * This will include empty fields as a null value. - * - * @return array - */ - public function normalize() - { - return $this->only( - array_keys($this->rules()) - ); - } -}