Add initial restify API

- add dependancies
- add command to add api tokens
- add webview to create api tokens
- add authentication enforement
- add health endpoint

Author: Yoyasp

app/Console/Commands/ApiTokenCommand.php

@@ -0,0 +1,113 @@
+<?php
+
+namespace App\Console\Commands;
+
+use App\Console\LnmsCommand;
+use App\Models\User;
+use Symfony\Component\Console\Input\InputArgument;
+use Symfony\Component\Console\Input\InputOption;
+
+class ApiTokenCommand extends LnmsCommand
+{
+    protected $name = 'api:token';
+    protected $description = 'Manage API tokens for users';
+
+    public function __construct()
+    {
+        parent::__construct();
+
+        $this->addArgument('action', InputArgument::REQUIRED, 'Action to perform: create, list, revoke');
+        $this->addArgument('username', InputArgument::REQUIRED, 'Username to manage tokens for');
+        $this->addOption('token-name', null, InputOption::VALUE_REQUIRED, 'Name for the token', 'api-token');
+        $this->addOption('token-id', null, InputOption::VALUE_REQUIRED, 'Token ID to revoke (for revoke action)');
+    }
+
+    public function handle(): int
+    {
+        $action = $this->argument('action');
+        $username = $this->argument('username');
+
+        $user = User::where('username', $username)->first();
+
+        if (! $user) {
+            $this->error("User '{$username}' not found.");
+
+            return 1;
+        }
+
+        return match ($action) {
+            'create' => $this->createToken($user),
+            'list' => $this->listTokens($user),
+            'revoke' => $this->revokeToken($user),
+            default => $this->invalidAction($action),
+        };
+    }
+
+    private function createToken(User $user): int
+    {
+        $name = $this->option('token-name');
+        $token = $user->createToken($name);
+
+        $this->info('Token created successfully.');
+        $this->newLine();
+        $this->line($token->plainTextToken);
+        $this->newLine();
+        $this->warn('Save this token — it will not be shown again.');
+
+        return 0;
+    }
+
+    private function listTokens(User $user): int
+    {
+        $tokens = $user->tokens;
+
+        if ($tokens->isEmpty()) {
+            $this->info("No tokens found for user '{$user->username}'.");
+
+            return 0;
+        }
+
+        $this->table(
+            ['ID', 'Name', 'Last Used', 'Created'],
+            $tokens->map(fn ($token) => [
+                $token->id,
+                $token->name,
+                $token->last_used_at?->diffForHumans() ?? 'Never',
+                $token->created_at->diffForHumans(),
+            ])
+        );
+
+        return 0;
+    }
+
+    private function revokeToken(User $user): int
+    {
+        $tokenId = $this->option('token-id');
+
+        if (! $tokenId) {
+            $this->error('The --token-id option is required for the revoke action.');
+
+            return 1;
+        }
+
+        $token = $user->tokens()->where('id', $tokenId)->first();
+
+        if (! $token) {
+            $this->error("Token ID {$tokenId} not found for user '{$user->username}'.");
+
+            return 1;
+        }
+
+        $token->delete();
+        $this->info("Token '{$token->name}' (ID: {$tokenId}) revoked.");
+
+        return 0;
+    }
+
+    private function invalidAction(string $action): int
+    {
+        $this->error("Unknown action '{$action}'. Use: create, list, revoke");
+
+        return 1;
+    }
+}

app/Http/Controllers/Api/V1/HealthController.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace App\Http\Controllers\Api\V1;
+
+use App\Http\Controllers\Controller;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Support\Facades\Cache;
+use Illuminate\Support\Facades\DB;
+use Throwable;
+
+class HealthController extends Controller
+{
+    public function __invoke(): JsonResponse
+    {
+        $checks = [
+            'database' => $this->check(fn () => DB::connection()->select('SELECT 1')),
+            'cache' => $this->check(function () {
+                $key = 'health:ping:' . bin2hex(random_bytes(4));
+                Cache::put($key, '1', 5);
+                if (Cache::get($key) !== '1') {
+                    throw new \RuntimeException('cache round-trip mismatch');
+                }
+                Cache::forget($key);
+            }),
+        ];
+
+        $status = collect($checks)->every(fn ($c) => $c['ok']) ? 'ok' : 'down';
+        $httpStatus = $status === 'ok' ? 200 : 503;
+
+        return response()->json([
+            'status' => $status,
+            'checks' => $checks,
+        ], $httpStatus);
+    }
+
+    private function check(callable $probe): array
+    {
+        try {
+            $probe();
+
+            return ['ok' => true];
+        } catch (Throwable $e) {
+            return ['ok' => false, 'error' => $e->getMessage()];
+        }
+    }
+}

app/Http/Controllers/ApiAccessController.php

@@ -24,10 +24,12 @@
 namespace App\Http\Controllers;
 
 use App\Models\ApiToken;
+use App\Models\User;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\View\View;
+use Laravel\Sanctum\PersonalAccessToken;
 use LibreNMS\Authentication\LegacyAuth;
 
 class ApiAccessController extends Controller
@@ -46,8 +48,15 @@ public function index(Request $request): View
             ->orderBy('id')
             ->get();
 
+        $v1Tokens = PersonalAccessToken::query()
+            ->where('tokenable_type', User::class)
+            ->where('tokenable_id', $user->user_id)
+            ->orderBy('id')
+            ->get();
+
         return view('user.api-access', [
             'tokens' => $tokens,
+            'v1_tokens' => $v1Tokens,
             'legacy_auth_type' => LegacyAuth::getType(),
         ]);
     }

app/Http/Middleware/EnforceJsonApi.php

@@ -0,0 +1,39 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class EnforceJsonApi
+{
+    public const CONTENT_TYPE = 'application/vnd.api+json';
+
+    public function handle(Request $request, Closure $next): Response
+    {
+        // Reject request bodies with wrong Content-Type (JSON:API §5.3)
+        if ($request->getContent() && ! $this->isJsonApi($request->header('Content-Type', ''))) {
+            return response()->json([
+                'errors' => [['status' => '415', 'title' => 'Unsupported Media Type']],
+            ], 415)->withHeaders(['Content-Type' => self::CONTENT_TYPE]);
+        }
+
+        // Tell Laravel to treat this as a JSON request
+        $request->headers->set('Accept', 'application/json');
+
+        $response = $next($request);
+
+        // Set JSON:API Content-Type on responses (§5.2)
+        $response->headers->set('Content-Type', self::CONTENT_TYPE);
+
+        return $response;
+    }
+
+    private function isJsonApi(string $contentType): bool
+    {
+        // Accept both application/vnd.api+json and application/json for pragmatism
+        return str_contains($contentType, 'application/vnd.api+json')
+            || str_contains($contentType, 'application/json');
+    }
+}

app/Models/User.php

@@ -12,6 +12,7 @@
 use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\Gate;
 use Illuminate\Support\Facades\Hash;
+use Laravel\Sanctum\HasApiTokens;
 use LibreNMS\Authentication\LegacyAuth;
 use NotificationChannels\WebPush\HasPushSubscriptions;
 use Permissions;
@@ -22,6 +23,7 @@
  */
 class User extends Authenticatable
 {
+    use HasApiTokens;
     use HasFactory;
     use HasPushSubscriptions;
     use HasRoles;

app/Providers/RestifyServiceProvider.php

@@ -0,0 +1,46 @@
+<?php
+
+namespace App\Providers;
+
+use App\Http\Controllers\Api\V1\HealthController;
+use Binaryk\LaravelRestify\Bootstrap\RoutesBoot;
+use Binaryk\LaravelRestify\Restify;
+use Binaryk\LaravelRestify\RestifyApplicationServiceProvider;
+use Illuminate\Support\Facades\Gate;
+use Illuminate\Support\Facades\Route;
+
+class RestifyServiceProvider extends RestifyApplicationServiceProvider
+{
+    protected function gate(): void
+    {
+        Gate::define('viewRestify', function ($user = null) {
+            return true;
+        });
+    }
+
+    protected function routes(): void
+    {
+        // v1 custom endpoints that are not Restify repositories. The health
+        // endpoint is intentionally public (no auth middleware).
+        Route::prefix('api/v1')->group(function (): void {
+            Route::get('health', HealthController::class)->name('v1.health');
+        });
+
+        parent::routes();
+
+        // Parent only registers routes in console (for route:list) and
+        // skips both web requests and unit tests. Register for both.
+        if (! app()->runningInConsole() || app()->runningUnitTests()) {
+            app(RoutesBoot::class)->boot();
+        }
+    }
+
+    public function boot(): void
+    {
+        parent::boot();
+
+        // No model repositories are registered yet. Add repository classes
+        // here as v1 resources are introduced.
+        Restify::repositories([]);
+    }
+}

bootstrap/providers.php

@@ -8,4 +8,6 @@
     App\Providers\DatastoreServiceProvider::class,
     App\Providers\SnmptrapProvider::class,
     App\Providers\PluginProvider::class,
+    Binaryk\LaravelRestify\LaravelRestifyServiceProvider::class,
+    App\Providers\RestifyServiceProvider::class,
 ];

composer.json

@@ -27,6 +27,7 @@
         "ext-xml": "*",
         "ext-zlib": "*",
         "amenadiel/jpgraph": "^4",
+        "binaryk/laravel-restify": "^10.4.6",
         "clue/socket-raw": "^1.4",
         "dapphp/radius": "^3.0",
         "easybook/geshi": "^1.0.8",
@@ -38,6 +39,7 @@
         "justinrainbow/json-schema": "^6.4",
         "laravel-notification-channels/webpush": "^10.0",
         "laravel/framework": "^12.10",
+        "laravel/sanctum": "^4.3.1",
         "laravel/tinker": "^3.0",
         "laravel/ui": "^4.6",
         "librenms/laravel-vue-i18n-generator": "dev-master",