First round of changes to API to support simpler permissions.

app/Transformers/Api/Admin/AllocationTransformer.php

@@ -3,9 +3,9 @@
 namespace Pterodactyl\Transformers\Api\Admin;
 
 use Pterodactyl\Models\Allocation;
-use Pterodactyl\Transformers\Api\ApiTransformer;
+use Pterodactyl\Transformers\Api\BaseTransformer;
 
-class AllocationTransformer extends ApiTransformer
+class AllocationTransformer extends BaseTransformer
 {
     /**
      * Relationships that can be loaded onto allocation transformations.

app/Transformers/Api/Admin/BaseTransformer.php

@@ -0,0 +1,69 @@
+<?php
+
+namespace Pterodactyl\Transformers\Api\Admin;
+
+use Pterodactyl\Models\APIKey;
+use Illuminate\Container\Container;
+use League\Fractal\TransformerAbstract;
+use Pterodactyl\Services\Acl\Api\AdminAcl;
+
+abstract class BaseTransformer extends TransformerAbstract
+{
+    /**
+     * @var \Pterodactyl\Models\APIKey
+     */
+    private $key;
+
+    /**
+     * Set the HTTP request class being used for this request.
+     *
+     * @param \Pterodactyl\Models\APIKey $key
+     * @return $this
+     */
+    public function setKey(APIKey $key)
+    {
+        $this->key = $key;
+
+        return $this;
+    }
+
+    /**
+     * Return the request instance being used for this transformer.
+     *
+     * @return \Pterodactyl\Models\APIKey
+     */
+    public function getKey(): APIKey
+    {
+        return $this->key;
+    }
+
+    /**
+     * Determine if the API key loaded onto the transformer has permission
+     * to access a different resource. This is used when including other
+     * models on a transformation request.
+     *
+     * @param string $resource
+     * @return bool
+     */
+    protected function authorize(string $resource): bool
+    {
+        return AdminAcl::check($this->getKey(), $resource, AdminAcl::READ);
+    }
+
+    /**
+     * Create a new instance of the transformer and pass along the currently
+     * set API key.
+     *
+     * @param string $abstract
+     * @param array  $parameters
+     * @return \Pterodactyl\Transformers\Api\Admin\BaseTransformer
+     */
+    protected function makeTransformer(string $abstract, array $parameters = []): self
+    {
+        /** @var \Pterodactyl\Transformers\Api\Admin\BaseTransformer $transformer */
+        $transformer = Container::getInstance()->makeWith($abstract, $parameters);
+        $transformer->setKey($this->getKey());
+
+        return $transformer;
+    }
+}

app/Transformers/Api/Admin/LocationTransformer.php

@@ -3,9 +3,9 @@
 namespace Pterodactyl\Transformers\Api\Admin;
 
 use Pterodactyl\Models\Location;
-use Pterodactyl\Transformers\Api\ApiTransformer;
+use Pterodactyl\Transformers\Api\BaseTransformer;
 
-class LocationTransformer extends ApiTransformer
+class LocationTransformer extends BaseTransformer
 {
     /**
      * List of resources that can be included.

app/Transformers/Api/Admin/NodeTransformer.php

@@ -3,9 +3,9 @@
 namespace Pterodactyl\Transformers\Api\Admin;
 
 use Pterodactyl\Models\Node;
-use Pterodactyl\Transformers\Api\ApiTransformer;
+use Pterodactyl\Transformers\Api\BaseTransformer;
 
-class NodeTransformer extends ApiTransformer
+class NodeTransformer extends BaseTransformer
 {
     /**
      * List of resources that can be included.

app/Transformers/Api/Admin/UserTransformer.php

@@ -3,9 +3,9 @@
 namespace Pterodactyl\Transformers\Api\Admin;
 
 use Pterodactyl\Models\User;
-use Pterodactyl\Transformers\Api\ApiTransformer;
+use Pterodactyl\Services\Acl\Api\AdminAcl;
 
-class UserTransformer extends ApiTransformer
+class UserTransformer extends BaseTransformer
 {
     /**
      * List of resources that can be included.
@@ -29,18 +29,16 @@ class UserTransformer extends ApiTransformer
      * Return the servers associated with this user.
      *
      * @param \Pterodactyl\Models\User $user
-     * @return bool|\League\Fractal\Resource\Collection
-     *
-     * @throws \Pterodactyl\Exceptions\PterodactylException
+     * @return \League\Fractal\Resource\Collection|\League\Fractal\Resource\NullResource
      */
     public function includeServers(User $user)
     {
-        if (! $this->authorize('server-list')) {
-            return false;
+        if (! $this->authorize(AdminAcl::RESOURCE_SERVERS)) {
+            return $this->null();
         }
 
         $user->loadMissing('servers');
 
-        return $this->collection($user->getRelation('servers'), new ServerTransformer($this->getRequest()), 'server');
+        return $this->collection($user->getRelation('servers'), $this->makeTransformer(ServerTransformer::class), 'server');
     }
 }