Initial Commit of Files

PufferPanel v0.9 (Laravel) is now Pterodactyl 1.0

app/Models/API.php

@@ -0,0 +1,63 @@
+<?php
+
+namespace Pterodactyl\Models;
+
+use Log;
+use Pterodactyl\Exceptions\DisplayException;
+use Pterodactyl\Models\APIPermission;
+use Illuminate\Database\Eloquent\Model;
+
+class API extends Model
+{
+
+    /**
+     * The table associated with the model.
+     *
+     * @var string
+     */
+    protected $table = 'api';
+
+    /**
+     * The attributes excluded from the model's JSON form.
+     *
+     * @var array
+     */
+    protected $hidden = ['daemonSecret'];
+
+    public function permissions()
+    {
+        return $this->hasMany(APIPermission::class);
+    }
+
+    public static function findKey($key)
+    {
+        return self::where('key', $key)->first();
+    }
+
+    /**
+     * Determine if an API key has permission to perform an action.
+     *
+     * @param  string $key
+     * @param  string $permission
+     * @return boolean
+     */
+    public static function checkPermission($key, $permission)
+    {
+        $api = self::findKey($key);
+
+        if (!$api) {
+            throw new DisplayException('The requested API key (' . $key . ') was not found in the system.');
+        }
+
+        return APIPermission::check($api->id, $permission);
+
+    }
+
+    public static function noPermissionError($error = 'You do not have permission to perform this action with this API key.')
+    {
+        return response()->json([
+            'error' => 'You do not have permission to perform this action with this API key.'
+        ], 403);
+    }
+
+}

app/Models/APIPermission.php

@@ -0,0 +1,30 @@
+<?php
+
+namespace Pterodactyl\Models;
+
+use Debugbar;
+use Illuminate\Database\Eloquent\Model;
+
+class APIPermission extends Model
+{
+
+    /**
+     * The table associated with the model.
+     *
+     * @var string
+     */
+    protected $table = 'api_permissions';
+
+    /**
+     * Checks if an API key has a specific permission.
+     *
+     * @param  int $id
+     * @param  string $permission
+     * @return boolean
+     */
+    public static function check($id, $permission)
+    {
+        return self::where('key_id', $id)->where('permission', $permission)->exists();
+    }
+
+}

app/Models/Download.php

@@ -0,0 +1,18 @@
+<?php
+
+namespace Pterodactyl\Models;
+
+use Debugbar;
+use Illuminate\Database\Eloquent\Model;
+
+class Download extends Model
+{
+
+    /**
+     * The table associated with the model.
+     *
+     * @var string
+     */
+    protected $table = 'downloads';
+
+}

app/Models/Node.php

@@ -0,0 +1,82 @@
+<?php
+
+namespace Pterodactyl\Models;
+
+use GuzzleHttp\Client;
+use Illuminate\Database\Eloquent\Model;
+
+class Node extends Model
+{
+
+    /**
+     * The table associated with the model.
+     *
+     * @var string
+     */
+    protected $table = 'nodes';
+
+    /**
+     * The attributes excluded from the model's JSON form.
+     *
+     * @var array
+     */
+    protected $hidden = ['daemonSecret'];
+
+    /**
+     * @var array
+     */
+    protected static $guzzle = [];
+
+    /**
+     * @var array
+     */
+    protected static $nodes = [];
+
+    /**
+     * Returns an instance of the database object for the requested node ID.
+     *
+     * @param  int $id
+     * @return \Illuminate\Database\Eloquent\Model
+     */
+    public static function getByID($id)
+    {
+
+        // The Node is already cached.
+        if (array_key_exists($id, self::$nodes)) {
+            return self::$nodes[$id];
+        }
+
+        self::$nodes[$id] = Node::where('id', $id)->first();
+        return self::$nodes[$id];
+
+    }
+
+    /**
+     * Returns a Guzzle Client for the node in question.
+     *
+     * @param  int $node
+     * @return \GuzzleHttp\Client
+     */
+    public static function guzzleRequest($node)
+    {
+
+        // The Guzzle Client is cached already.
+        if (array_key_exists($node, self::$guzzle)) {
+            return self::$guzzle[$node];
+        }
+
+        $nodeData = self::getByID($node);
+
+        // @TODO: Better solution to disabling verification. Security risk.
+        self::$guzzle[$node] = new Client([
+            'base_uri' => sprintf('https://%s:%s/', $nodeData->fqdn, $nodeData->daemonListen),
+            'timeout' => 10.0,
+            'connect_timeout' => 5.0,
+            'verify' => false,
+        ]);
+
+        return self::$guzzle[$node];
+
+    }
+
+}

app/Models/Permission.php

@@ -0,0 +1,27 @@
+<?php
+
+namespace Pterodactyl\Models;
+
+use Illuminate\Database\Eloquent\Model;
+
+class Permission extends Model
+{
+
+    /**
+     * The table associated with the model.
+     *
+     * @var string
+     */
+    protected $table = 'permissions';
+
+    public function scopePermission($query, $permission)
+    {
+        return $query->where('permission', $permission);
+    }
+
+    public function scopeServer($query, $server)
+    {
+        return $query->where('server_id', $server->id);
+    }
+
+}

app/Models/Server.php

@@ -0,0 +1,141 @@
+<?php
+
+namespace Pterodactyl\Models;
+
+use Auth;
+use Pterodactyl\Models\Permission;
+use Pterodactyl\Models\Subuser;
+use Illuminate\Database\Eloquent\Model;
+
+class Server extends Model
+{
+
+    /**
+     * The table associated with the model.
+     *
+     * @var string
+     */
+    protected $table = 'servers';
+
+    /**
+     * The attributes excluded from the model's JSON form.
+     *
+     * @var array
+     */
+    protected $hidden = ['daemonSecret'];
+
+    /**
+     * @var array
+     */
+    protected static $serverUUIDInstance = [];
+
+    /**
+     * @var mixed
+     */
+    protected static $user;
+
+    /**
+     * Constructor
+     */
+    public function __construct()
+    {
+        self::$user = Auth::user();
+    }
+
+    /**
+     * Determine if we need to change the server's daemonSecret value to
+     * match that of the user if they are a subuser.
+     *
+     * @param Illuminate\Database\Eloquent\Model\Server $server
+     * @return string
+     */
+    protected static function getUserDaemonSecret(Server $server)
+    {
+
+        if (self::$user->id === $server->owner || self::$user->root_admin === 1) {
+            return $server->daemonSecret;
+        }
+
+        $subuser = Subuser::where('server_id', $server->id)->where('user_id', self::$user->id)->first();
+
+        if (is_null($subuser)) {
+            return null;
+        }
+
+        return $subuser->daemonSecret;
+
+    }
+
+    /**
+     * Returns array of all servers owned by the logged in user.
+     * Returns all active servers if user is a root admin.
+     *
+     * @return \Illuminate\Database\Eloquent\Collection
+     */
+    public static function getUserServers()
+    {
+
+        $query = self::select('servers.*', 'nodes.name as nodeName', 'locations.long as location')
+                    ->join('nodes', 'servers.node', '=', 'nodes.id')
+                    ->join('locations', 'nodes.location', '=', 'locations.id')
+                    ->where('active', 1);
+
+        if (self::$user->root_admin !== 1) {
+            $query->whereIn('servers.id', Subuser::accessServers());
+        }
+
+        return $query->get();
+
+    }
+
+    /**
+     * Returns a single server specified by UUID
+     *
+     * @param  string $uuid The Short-UUID of the server to return an object about.
+     * @return \Illuminate\Database\Eloquent\Collection
+     */
+    public static function getByUUID($uuid)
+    {
+
+        if (array_key_exists($uuid, self::$serverUUIDInstance)) {
+            return self::$serverUUIDInstance[$uuid];
+        }
+
+        $query = self::where('uuidShort', $uuid)->where('active', 1);
+
+        if (self::$user->root_admin !== 1) {
+            $query->whereIn('servers.id', Subuser::accessServers());
+        }
+
+        $result = $query->first();
+
+        if(!is_null($result)) {
+            $result->daemonSecret = self::getUserDaemonSecret($result);
+        }
+
+        self::$serverUUIDInstance[$uuid] = $result;
+        return self::$serverUUIDInstance[$uuid];
+
+    }
+
+    /**
+     * Returns non-administrative headers for accessing a server on Scales
+     *
+     * @param  string $uuid
+     * @return array
+     */
+    public static function getGuzzleHeaders($uuid)
+    {
+
+        if (array_key_exists($uuid, self::$serverUUIDInstance)) {
+            return [
+                'X-Access-Server' => self::$serverUUIDInstance[$uuid]->uuid,
+                'X-Access-Token' => self::$serverUUIDInstance[$uuid]->daemonSecret
+            ];
+        }
+
+        return [];
+
+    }
+
+}

app/Models/Subuser.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace Pterodactyl\Models;
+
+use Auth;
+use Illuminate\Database\Eloquent\Model;
+
+class Subuser extends Model
+{
+
+    /**
+     * The table associated with the model.
+     *
+     * @var string
+     */
+    protected $table = 'subusers';
+
+    /**
+     * @var mixed
+     */
+    protected static $user;
+
+    /**
+     * Constructor
+     */
+    public function __construct()
+    {
+        self::$user = Auth::user();
+    }
+
+    /**
+     * Returns an array of each server ID that the user has access to.
+     *
+     * @return array
+     */
+    public static function accessServers()
+    {
+
+        $access = [];
+
+        $union = self::select('server_id')->where('user_id', self::$user->id);
+        $select = Server::select('id')->where('owner', self::$user->id)->union($union)->get();
+
+        foreach($select as &$select) {
+            $access = array_merge($access, [ $select->id ]);
+        }
+
+        return $access;
+
+    }
+
+}

app/Models/User.php

@@ -0,0 +1,157 @@
+<?php
+
+namespace Pterodactyl\Models;
+
+use Google2FA;
+use Pterodactyl\Exceptions\AccountNotFoundException;
+use Pterodactyl\Exceptions\DisplayException;
+use Pterodactyl\Models\Permission;
+
+use Illuminate\Auth\Authenticatable;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Auth\Passwords\CanResetPassword;
+use Illuminate\Foundation\Auth\Access\Authorizable;
+use Illuminate\Contracts\Auth\Authenticatable as AuthenticatableContract;
+use Illuminate\Contracts\Auth\Access\Authorizable as AuthorizableContract;
+use Illuminate\Contracts\Auth\CanResetPassword as CanResetPasswordContract;
+
+class User extends Model implements AuthenticatableContract,
+                                    AuthorizableContract,
+                                    CanResetPasswordContract
+{
+    use Authenticatable, Authorizable, CanResetPassword;
+
+    /**
+     * The table associated with the model.
+     *
+     * @var string
+     */
+    protected $table = 'users';
+
+    /**
+     * The attributes that are mass assignable.
+     *
+     * @var array
+     */
+    protected $fillable = ['name', 'email', 'password'];
+
+    /**
+     * The attributes excluded from the model's JSON form.
+     *
+     * @var array
+     */
+    protected $hidden = ['password', 'remember_token', 'totp_secret'];
+
+    public function permissions()
+    {
+        return $this->hasMany(Permission::class);
+    }
+
+    /**
+     * Sets the TOTP secret for an account.
+     *
+     * @param int $id Account ID for which we want to generate a TOTP secret
+     * @return string
+     */
+    public static function setTotpSecret($id)
+    {
+
+        $totpSecretKey = Google2FA::generateSecretKey();
+
+        $user = User::find($id);
+
+        if (!$user) {
+            throw new AccountNotFoundException('An account with that ID (' . $id . ') does not exist in the system.');
+        }
+
+        $user->totp_secret = $totpSecretKey;
+        $user->save();
+
+        return $totpSecretKey;
+
+    }
+
+    /**
+     * Enables or disables TOTP on an account if the token is valid.
+     *
+     * @param int $id Account ID for which we want to generate a TOTP secret
+     * @return boolean
+     */
+    public static function toggleTotp($id, $token)
+    {
+
+        $user = User::find($id);
+
+        if (!$user) {
+            throw new AccountNotFoundException('An account with that ID (' . $id . ') does not exist in the system.');
+        }
+
+        if (!Google2FA::verifyKey($user->totp_secret, $token)) {
+            return false;
+        }
+
+        $user->use_totp = ($user->use_totp === 1) ? 0 : 1;
+        $user->save();
+
+        return true;
+
+    }
+
+    /**
+     * Set a user password to a new value assuming it meets the following requirements:
+     * 		- 8 or more characters in length
+     * 		- at least one uppercase character
+     * 		- at least one lowercase character
+     * 		- at least one number
+     *
+     * @param int $id The ID of the account to update the password on.
+     * @param string $password The raw password to set the account password to.
+     * @param string $regex The regex to use when validating the password. Defaults to '((?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{8,})'.
+     * @return void
+     */
+    public static function setPassword($id, $password, $regex = '((?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{8,})')
+    {
+
+        $user = User::find($id);
+        if (!$user) {
+            throw new AccountNotFoundException('An account with that ID (' . $id . ') does not exist in the system.');
+        }
+
+        if (!preg_match($regex, $password)) {
+            throw new DisplayException('The password passed did not meet the minimum password requirements.');
+        }
+
+        $user->password = password_hash($password, PASSWORD_BCRYPT);
+        $user->save();
+
+        return;
+
+    }
+
+    /**
+     * Updates the email address for an account.
+     *
+     * @param int $id
+     * @param string $email
+     * @return void
+     */
+    public static function setEmail($id, $email)
+    {
+
+        $user = User::find($id);
+        if (!$user) {
+            throw new AccountNotFoundException('An account with that ID (' . $id . ') does not exist in the system.');
+        }
+
+        if (!filter_var($email, FILTER_VALIDATE_EMAIL)) {
+            throw new DisplayException('The email provided (' . $email . ') was not valid.');
+        }
+
+        $user->email = $email;
+        $user->save();
+
+        return;
+
+    }
+
+}