copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

Add user key management routes and enforce user context checks

Browse Source 
Introduced GET and POST routes for managing user key-value pairs, restricted for administrative use. Added strict user context verification in `user_key_value_pairs_o` methods to ensure valid `user_id` is selected before operations. This enhances security and maintains data integrity for user-related actions.
This commit is contained in:
Jepp9350
2025-03-05 13:44:30 +01:00
parent 0d87b7acdd
commit ec9f760bea
2 changed files with 113 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/nginx/app/objects/user_key_value_pairs_o.php
+15
View File
@@ -4,6 +4,7 @@ namespace objects;
use classes\db;
use classes\object_property;
use Exception;
use traits\db_object_t;
class user_key_value_pairs_o extends db
@@ -39,6 +40,7 @@ class user_key_value_pairs_o extends db
public function setValue($var, $val): user_key_value_pairs_o
{
global $db;
self::requireSelected();
// Avoid SQL injection
$var = $db->escape_string($var);
$val = $db->escape_string($val);
@@ -54,9 +56,20 @@ class user_key_value_pairs_o extends db
return $this;
}
/**
* @throws Exception
*/
public function requireSelected(): void
{
if (empty($this->user_id)) {
throw new Exception('The user id is not set!.');
}
}
public function getValue($var): mixed
{
global $db;
self::requireSelected();
// Avoid SQL injection
$var = $db->escape_string($var);
// Get the record from the database
@@ -71,6 +84,7 @@ class user_key_value_pairs_o extends db
public function deleteValue($var): user_key_value_pairs_o
{
global $db;
self::requireSelected();
// Avoid SQL injection
$var = $db->escape_string($var);
// Create a new record in the database
@@ -82,6 +96,7 @@ class user_key_value_pairs_o extends db
public function getAllKeys(): array
{
global $db;
self::requireSelected();
// Get all the keys from the database
$sql = "SELECT var, val FROM $this->table WHERE user_id = $this->user_id";
$result = $db->query($sql);
services/nginx/app/routes/userRoute.php
+98
View File
@@ -180,5 +180,103 @@ class userRoute
'get_user_id' => 'Get user id from e-conomic customer number.'
]
);
$this->get('/superuser/user/keys', function () {
// Require the user to be logged in
global $response;
$this->requirePermission('get_user_keys');
// Get the user object
$user = (new authentication())->get_user();
// Check if the request was successful
if ($user) {
// Log the incident
(new logs_o())->add('users', 'global', 1, $user->id, 'GET_USER_KEYS', 'Successfully fetched user keys');
$targetUser = (new users_o())->automaticGetTargetUserFromRequest();
// Check if the user was found
if (!$targetUser->exists()) {
// Log the incident
(new logs_o())->add('users', 'global', 1, $user->id, 'GET_USER_KEYS', 'No user found');
// Return an error
$response->error('User not found', 404);
}
// Check if the request contains the key
if (self::isParametersSet(['key'])) {
// Check if the key is valid
if (!$targetUser->keys->getValue(self::getParameter('key'))) {
// Log the incident
(new logs_o())->add('users', 'global', 1, $user->id, 'GET_USER_KEYS', 'Invalid key');
// Return an error
$response->error('Invalid key', 400);
}
// Return the key
$response->success(
[
self::getParameter('key') => $targetUser->keys->getValue(self::getParameter('key'))
]
);
}
// Return the list of users
$response->success(
$targetUser->keys->getAllKeys()
);
} else {
// Log the incident
(new logs_o())->add('users', 'global', 1, 0, 'GET_USER_KEYS', 'No user found, or invalid session');
// Return an error
$response->error('Invalid session', 400);
}
},
[
'get_user_keys' => 'Get a user\'s keys, they are stored in the database as key-value pairs. THIS IS STRICTLY FOR ADMINISTRATION PURPOSES!'
]
);
$this->post('/superuser/user/keys', function () {
// Require the user to be logged in
global $response;
$this->requirePermission('set_user_keys');
// Get the user object
$user = (new authentication())->get_user();
// Check if the request was successful
if ($user) {
// Log the incident
(new logs_o())->add('users', 'global', 1, $user->id, 'SET_USER_KEYS', 'Successfully set user keys');
$targetUser = (new users_o())->automaticGetTargetUserFromRequest();
// Check if the user was found
if (!$targetUser->exists()) {
// Log the incident
(new logs_o())->add('users', 'global', 1, $user->id, 'SET_USER_KEYS', 'No user found');
// Return an error
$response->error('User not found', 404);
}
// Check if the request contains the key
if (!self::isParametersSet(['key'])) {
// Log the incident
(new logs_o())->add('users', 'global', 1, $user->id, 'SET_USER_KEYS', 'No key set');
// Return an error
$response->error('No key set', 400);
}
// Check if the request contains the value
if (!self::isParametersSet(['value'])) {
// Log the incident
(new logs_o())->add('users', 'global', 1, $user->id, 'SET_USER_KEYS', 'No value set');
// Return an error
$response->error('No value set', 400);
}
// Set the key-value pair
$targetUser->keys->setValue(self::getParameter('key'), self::getParameter('value'));
// Return a success message
$response->success('Successfully set user key');
} else {
// Log the incident
(new logs_o())->add('users', 'global', 1, 0, 'SET_USER_KEYS', 'No user found, or invalid session');
// Return an error
$response->error('Invalid session', 400);
}
},
[
'set_user_keys' => 'Set a user\'s keys, they are stored in the database as key-value pairs. THIS IS STRICTLY FOR ADMINISTRATION PURPOSES!'
]
);
}
}