Restrict QTY on Developer Tokens

Thorvaldsen

I am running the latest Flarum forum, and I would like to restrict the quantity of how many Developer/Access token users can make.

I tried to open the extend.php which I have already used to set minWordLimit, for posts and it's working fabulously.

I wrote this code into the extend.php, but somehow it does not do what I expected.

use Flarum\Extend;
use Flarum\Post\Event\Saving;
use Flarum\Post\Exception\InvalidPostException;
use Illuminate\Events\Dispatcher;
// use Illuminate\Contracts\Events\Dispatcher;
use Flarum\User\User;
use Flarum\Post\Event\Posted;
use Flarum\Event\TokenCreated;

return [

-- Existing code which is working is here  - I will skip that --

(new Extend\Event())
    ->listen(Saving::class, function (Saving $event) {
        $user = $event->post->user;
        $existingTokensCount = count($user->getDeveloperAccessTokens());

        if ($existingTokensCount >= 1) {
            $event->post->addError('token', 'You can only have one developer access token.');
            throw new InvalidPostException;
        }
    })
];

Can someone assist me to succeed on my problem?

luceos

What would be the use case for limiting the access tokens, or is this about api keys? Access tokens include all active sessions with multiple browsers as well.

Thorvaldsen

luceos sorry this is about API keys.

What we are trying to succeed on we have group of users which can get access with their "developer token" our external API, and to avoid misusing on that external API of ours we need to be able to allow each member to create only one key instead of allowing them to have multiple keys.

Thorvaldsen

referring to this (Token, API key, Access key) or what ever it's called originally 🫣

luceos

You were on the right path. But there's no getDeveloperAccessTokens method on the user object.

What might work is this:

use Flarum\Http\DeveloperAccessToken;
use Flarum\Http\Event\DeveloperTokenCreated;
use Flarum\User\Exception\PermissionDeniedException;
-- Your old imports, check them!  - I will skip that --

return [

-- Existing code which is working is here  - I will skip that --

(new Extend\Event())
    ->listen(DeveloperTokenCreated::class, function (DeveloperTokenCreated $event) {
        $user = $event->token->user;
        // User model has no relation to access tokens if type developer access token, so directly use that model
        $existingTokensCount = DeveloperAccessToken::where('user_id', $user->id)->count();

        if ($existingTokensCount > 1) {
            // Event is dispatched after save, so delete the token
            $event->token->delete();
            throw new PermissionDeniedException("You can only have one developer access token");
        }
    })
];

This is untested.

Thorvaldsen

Ok I tested it and it works partially.

When token is revoked, I cannot create new one, so I raised the number to 20 I was able to create 19 pcs, but if I revoke them all, I cannot create new one.

I changed it little bit:

(new Extend\Event())
    ->listen(DeveloperTokenCreated::class, function (DeveloperTokenCreated $event) {
		$maxTokenLimit = 20;
        $user = $event->token->user;
        // User model has no relation to access tokens if type developer access token, so directly use that model
        $existingTokensCount = DeveloperAccessToken::where('user_id', $user->id)->count();
		
		if ($existingTokensCount > $maxTokenLimit) {
            // Event is dispatched after save, so delete the token
            $event->token->delete();
            throw new PermissionDeniedException('You can only have one developer access token');
        }
    })

luceos

Thorvaldsen I wasn't entirely sure revoked tokens would remain in the database, so we need to count only the active ones:

use Flarum\Http\DeveloperAccessToken;
use Flarum\Http\Event\DeveloperTokenCreated;
use Flarum\User\Exception\PermissionDeniedException;
-- Your old imports, check them!  - I will skip that --

return [

-- Existing code which is working is here  - I will skip that --

(new Extend\Event())
    ->listen(DeveloperTokenCreated::class, function (DeveloperTokenCreated $event) {
        $user = $event->token->user;
        // User model has no relation to access tokens if type developer access token, so directly use that model
        $existingTokensCount = DeveloperAccessToken::where('user_id', $user->id)->whereValid()->count();

        if ($existingTokensCount > 1) {
            // Event is dispatched after save, so delete the token
            $event->token->delete();
            throw new PermissionDeniedException("You can only have one developer access token");
        }
    })
];